implement upload-related support for open_basedir

[tt-rss.git] / classes / opml.php
diff --git a/classes/opml.php b/classes/opml.php

index d4a0e987567c7061d385f33f2cf765bb70c8a4e8..2ecae42379ca5de4a7ad5a105fda8ecaf5d29f83 100644 (file)
--- a/classes/opml.php
+++ b/classes/opml.php
@@ -29,8 +29,8 @@ class Opml extends Handler_Protected {
                                 <meta http-equiv=\"Content-Type\" content=\"text/html; charset=utf-8\"/>
                         </head>
                         <body>
-                       <div class=\"floatingLogo\"><img src=\"images/logo_wide.png\"></div>
-                       <h1>".__('OPML Utility')."</h1>";
+                       <div class=\"floatingLogo\"><img src=\"images/logo_small.png\"></div>
+                       <h1>".__('OPML Utility')."</h1><div class='content'>";
  
                 add_feed_category($this->link, "Imported feeds");
  
@@ -41,7 +41,7 @@ class Opml extends Handler_Protected {
                         <input type=\"submit\" value=\"".__("Return to preferences")."\">
                         </form>";
  
-               print "</body></html>";
+               print "</div></body></html>";
  
  
         }
@@ -253,13 +253,13 @@ class Opml extends Handler_Protected {
         private function opml_import_feed($doc, $node, $cat_id, $owner_uid) {
                 $attrs = $node->attributes;
  
-               $feed_title = db_escape_string($this->link, $attrs->getNamedItem('text')->nodeValue);
-               if (!$feed_title) $feed_title = db_escape_string($this->link, $attrs->getNamedItem('title')->nodeValue);
+               $feed_title = db_escape_string($this->link, mb_substr($attrs->getNamedItem('text')->nodeValue, 0, 250));
+               if (!$feed_title) $feed_title = db_escape_string($this->link, mb_substr($attrs->getNamedItem('title')->nodeValue, 0, 250));
  
-               $feed_url = db_escape_string($this->link, $attrs->getNamedItem('xmlUrl')->nodeValue);
-               if (!$feed_url) $feed_url = db_escape_string($this->link, $attrs->getNamedItem('xmlURL')->nodeValue);
+               $feed_url = db_escape_string($this->link, mb_substr($attrs->getNamedItem('xmlUrl')->nodeValue, 0, 250));
+               if (!$feed_url) $feed_url = db_escape_string($this->link, mb_substr($attrs->getNamedItem('xmlURL')->nodeValue, 0, 250));
  
-               $site_url = db_escape_string($this->link, $attrs->getNamedItem('htmlUrl')->nodeValue);
+               $site_url = db_escape_string($this->link, mb_substr($attrs->getNamedItem('htmlUrl')->nodeValue, 0, 250));
  
                 if ($feed_url && $feed_title) {
                         $result = db_query($this->link, "SELECT id FROM ttrss_feeds WHERE
@@ -386,10 +386,10 @@ class Opml extends Handler_Protected {
                 $default_cat_id = (int) get_feed_category($this->link, 'Imported feeds', false);
  
                 if ($root_node) {
-                       $cat_title = db_escape_string($this->link, $root_node->attributes->getNamedItem('text')->nodeValue);
+                       $cat_title = db_escape_string($this->link, mb_substr($root_node->attributes->getNamedItem('text')->nodeValue, 0, 250));
  
                         if (!$cat_title)
-                               $cat_title = db_escape_string($this->link, $root_node->attributes->getNamedItem('title')->nodeValue);
+                               $cat_title = db_escape_string($this->link, mb_substr($root_node->attributes->getNamedItem('title')->nodeValue, 0, 250));
  
                         if (!in_array($cat_title, array("tt-rss-filters", "tt-rss-labels", "tt-rss-prefs"))) {
                                 $cat_id = get_feed_category($this->link, $cat_title, $parent_id);
@@ -461,11 +461,35 @@ class Opml extends Handler_Protected {
  
  #              if ($debug) $doc = DOMDocument::load("/tmp/test.opml");
  
-               if (is_file($_FILES['opml_file']['tmp_name'])) {
+               if ($_FILES['opml_file']['error'] != 0) {
+                       print_error(T_sprintf("Upload failed with error code %d",
+                               $_FILES['opml_file']['error']));
+                       return;
+               }
+
+               $tmp_file = false;
+
+               if (is_uploaded_file($_FILES['opml_file']['tmp_name'])) {
+                       $tmp_file = tempnam(CACHE_DIR . '/upload', 'opml');
+
+                       $result = move_uploaded_file($_FILES['opml_file']['tmp_name'],
+                               $tmp_file);
+
+                       if (!$result) {
+                               print_error(__("Unable to move uploaded file."));
+                               return;
+                       }
+               } else {
+                       print_error(__('Error: please upload OPML file.'));
+                       return;
+               }
+
+               if (is_file($tmp_file)) {
                         $doc = new DOMDocument();
-                       $doc->load($_FILES['opml_file']['tmp_name']);
+                       $doc->load($tmp_file);
+                       unlink($tmp_file);
                 } else if (!$doc) {
-                       print_error(__('Error: please upload OPML file.'));
+                       print_error(__('Error: unable to find moved OPML file.'));
                         return;
                 }