]> git.wh0rd.org - tt-rss.git/blobdiff - classes/opml.php
git.wh0rd.org / tt-rss.git / blobdiff
? search:
summary | shortlog | log | commit | commitdiff | tree
raw | inline | side by side
implement upload-related support for open_basedir
[tt-rss.git] / classes / opml.php
diff --git a/classes/opml.php b/classes/opml.php
index 34067e017330642e5bfb68d746d096c8ebcaf8bb..2ecae42379ca5de4a7ad5a105fda8ecaf5d29f83 100644 (file)
--- a/classes/opml.php
+++ b/classes/opml.php
@@ -29,8 +29,8 @@ class Opml extends Handler_Protected {
                                <meta http-equiv=\"Content-Type\" content=\"text/html; charset=utf-8\"/>
                        </head>
                        <body>
-                       <div class=\"floatingLogo\"><img src=\"images/logo_wide.png\"></div>
-                       <h1>".__('OPML Utility')."</h1>";
+                       <div class=\"floatingLogo\"><img src=\"images/logo_small.png\"></div>
+                       <h1>".__('OPML Utility')."</h1><div class='content'>";
 
                add_feed_category($this->link, "Imported feeds");
 
@@ -41,7 +41,7 @@ class Opml extends Handler_Protected {
                        <input type=\"submit\" value=\"".__("Return to preferences")."\">
                        </form>";
 
-               print "</body></html>";
+               print "</div></body></html>";
 
 
        }
@@ -253,13 +253,13 @@ class Opml extends Handler_Protected {
        private function opml_import_feed($doc, $node, $cat_id, $owner_uid) {
                $attrs = $node->attributes;
 
-               $feed_title = db_escape_string($attrs->getNamedItem('text')->nodeValue);
-               if (!$feed_title) $feed_title = db_escape_string($attrs->getNamedItem('title')->nodeValue);
+               $feed_title = db_escape_string($this->link, mb_substr($attrs->getNamedItem('text')->nodeValue, 0, 250));
+               if (!$feed_title) $feed_title = db_escape_string($this->link, mb_substr($attrs->getNamedItem('title')->nodeValue, 0, 250));
 
-               $feed_url = db_escape_string($attrs->getNamedItem('xmlUrl')->nodeValue);
-               if (!$feed_url) $feed_url = db_escape_string($attrs->getNamedItem('xmlURL')->nodeValue);
+               $feed_url = db_escape_string($this->link, mb_substr($attrs->getNamedItem('xmlUrl')->nodeValue, 0, 250));
+               if (!$feed_url) $feed_url = db_escape_string($this->link, mb_substr($attrs->getNamedItem('xmlURL')->nodeValue, 0, 250));
 
-               $site_url = db_escape_string($attrs->getNamedItem('htmlUrl')->nodeValue);
+               $site_url = db_escape_string($this->link, mb_substr($attrs->getNamedItem('htmlUrl')->nodeValue, 0, 250));
 
                if ($feed_url && $feed_title) {
                        $result = db_query($this->link, "SELECT id FROM ttrss_feeds WHERE
@@ -285,11 +285,11 @@ class Opml extends Handler_Protected {
 
        private function opml_import_label($doc, $node, $owner_uid) {
                $attrs = $node->attributes;
-               $label_name = db_escape_string($attrs->getNamedItem('label-name')->nodeValue);
+               $label_name = db_escape_string($this->link, $attrs->getNamedItem('label-name')->nodeValue);
 
                if ($label_name) {
-                       $fg_color = db_escape_string($attrs->getNamedItem('label-fg-color')->nodeValue);
-                       $bg_color = db_escape_string($attrs->getNamedItem('label-bg-color')->nodeValue);
+                       $fg_color = db_escape_string($this->link, $attrs->getNamedItem('label-fg-color')->nodeValue);
+                       $bg_color = db_escape_string($this->link, $attrs->getNamedItem('label-bg-color')->nodeValue);
 
                        if (!label_find_id($this->link, $label_name, $_SESSION['uid'])) {
                                $this->opml_notice(T_sprintf("Adding label %s", htmlspecialchars($label_name)));
@@ -302,10 +302,10 @@ class Opml extends Handler_Protected {
 
        private function opml_import_preference($doc, $node, $owner_uid) {
                $attrs = $node->attributes;
-               $pref_name = db_escape_string($attrs->getNamedItem('pref-name')->nodeValue);
+               $pref_name = db_escape_string($this->link, $attrs->getNamedItem('pref-name')->nodeValue);
 
                if ($pref_name) {
-                       $pref_value = db_escape_string($attrs->getNamedItem('value')->nodeValue);
+                       $pref_value = db_escape_string($this->link, $attrs->getNamedItem('value')->nodeValue);
 
                        $this->opml_notice(T_sprintf("Setting preference key %s to %s",
                                $pref_name, $pref_value));
@@ -317,7 +317,7 @@ class Opml extends Handler_Protected {
        private function opml_import_filter($doc, $node, $owner_uid) {
                $attrs = $node->attributes;
 
-               $filter_type = db_escape_string($attrs->getNamedItem('filter-type')->nodeValue);
+               $filter_type = db_escape_string($this->link, $attrs->getNamedItem('filter-type')->nodeValue);
 
                if ($filter_type == '2') {
                        $filter = json_decode($node->nodeValue, true);
@@ -344,13 +344,13 @@ class Opml extends Handler_Protected {
 
                                                if (!$rule["cat_filter"]) {
                                                        $tmp_result = db_query($this->link, "SELECT id FROM ttrss_feeds
-                                                               WHERE title = '".db_escape_string($rule["feed"])."' AND owner_uid = ".$_SESSION["uid"]);
+                                                               WHERE title = '".db_escape_string($this->link, $rule["feed"])."' AND owner_uid = ".$_SESSION["uid"]);
                                                        if (db_num_rows($tmp_result) > 0) {
                                                                $feed_id = db_fetch_result($tmp_result, 0, "id");
                                                        }
                                                } else {
                                                        $tmp_result = db_query($this->link, "SELECT id FROM ttrss_feed_categories
-                                                               WHERE title = '".db_escape_string($rule["feed"])."' AND owner_uid = ".$_SESSION["uid"]);
+                                                               WHERE title = '".db_escape_string($this->link, $rule["feed"])."' AND owner_uid = ".$_SESSION["uid"]);
 
                                                        if (db_num_rows($tmp_result) > 0) {
                                                                $cat_id = db_fetch_result($tmp_result, 0, "id");
@@ -358,7 +358,7 @@ class Opml extends Handler_Protected {
                                                }
 
                                                $cat_filter = bool_to_sql_bool($rule["cat_filter"]);
-                                               $reg_exp = db_escape_string($rule["reg_exp"]);
+                                               $reg_exp = db_escape_string($this->link, $rule["reg_exp"]);
                                                $filter_type = (int)$rule["filter_type"];
 
                                                db_query($this->link, "INSERT INTO ttrss_filters2_rules (feed_id,cat_id,filter_id,filter_type,reg_exp,cat_filter)
@@ -368,7 +368,7 @@ class Opml extends Handler_Protected {
                                        foreach ($filter["actions"] as $action) {
 
                                                $action_id = (int)$action["action_id"];
-                                               $action_param = db_escape_string($action["action_param"]);
+                                               $action_param = db_escape_string($this->link, $action["action_param"]);
 
                                                db_query($this->link, "INSERT INTO ttrss_filters2_actions (filter_id,action_id,action_param)
                                                        VALUES ($filter_id, $action_id, '$action_param')");
@@ -386,10 +386,10 @@ class Opml extends Handler_Protected {
                $default_cat_id = (int) get_feed_category($this->link, 'Imported feeds', false);
 
                if ($root_node) {
-                       $cat_title = db_escape_string($root_node->attributes->getNamedItem('text')->nodeValue);
+                       $cat_title = db_escape_string($this->link, mb_substr($root_node->attributes->getNamedItem('text')->nodeValue, 0, 250));
 
                        if (!$cat_title)
-                               $cat_title = db_escape_string($root_node->attributes->getNamedItem('title')->nodeValue);
+                               $cat_title = db_escape_string($this->link, mb_substr($root_node->attributes->getNamedItem('title')->nodeValue, 0, 250));
 
                        if (!in_array($cat_title, array("tt-rss-filters", "tt-rss-labels", "tt-rss-prefs"))) {
                                $cat_id = get_feed_category($this->link, $cat_title, $parent_id);
@@ -418,12 +418,12 @@ class Opml extends Handler_Protected {
                foreach ($outlines as $node) {
                        if ($node->hasAttributes() && strtolower($node->tagName) == "outline") {
                                $attrs = $node->attributes;
-                               $node_cat_title = db_escape_string($attrs->getNamedItem('text')->nodeValue);
+                               $node_cat_title = db_escape_string($this->link, $attrs->getNamedItem('text')->nodeValue);
 
                                if (!$node_cat_title)
-                                       $node_cat_title = db_escape_string($attrs->getNamedItem('title')->nodeValue);
+                                       $node_cat_title = db_escape_string($this->link, $attrs->getNamedItem('title')->nodeValue);
 
-                               $node_feed_url = db_escape_string($attrs->getNamedItem('xmlUrl')->nodeValue);
+                               $node_feed_url = db_escape_string($this->link, $attrs->getNamedItem('xmlUrl')->nodeValue);
 
                                if ($node_cat_title && !$node_feed_url) {
                                        $this->opml_import_category($doc, $node, $owner_uid, $cat_id);
@@ -461,11 +461,35 @@ class Opml extends Handler_Protected {
 
 #              if ($debug) $doc = DOMDocument::load("/tmp/test.opml");
 
-               if (is_file($_FILES['opml_file']['tmp_name'])) {
+               if ($_FILES['opml_file']['error'] != 0) {
+                       print_error(T_sprintf("Upload failed with error code %d",
+                               $_FILES['opml_file']['error']));
+                       return;
+               }
+
+               $tmp_file = false;
+
+               if (is_uploaded_file($_FILES['opml_file']['tmp_name'])) {
+                       $tmp_file = tempnam(CACHE_DIR . '/upload', 'opml');
+
+                       $result = move_uploaded_file($_FILES['opml_file']['tmp_name'],
+                               $tmp_file);
+
+                       if (!$result) {
+                               print_error(__("Unable to move uploaded file."));
+                               return;
+                       }
+               } else {
+                       print_error(__('Error: please upload OPML file.'));
+                       return;
+               }
+
+               if (is_file($tmp_file)) {
                        $doc = new DOMDocument();
-                       $doc->load($_FILES['opml_file']['tmp_name']);
+                       $doc->load($tmp_file);
+                       unlink($tmp_file);
                } else if (!$doc) {
-                       print_error(__('Error: please upload OPML file.'));
+                       print_error(__('Error: unable to find moved OPML file.'));
                        return;
                }
 
web-based news feed (RSS/Atom) reader and aggregator; see https://tt-rss.org/