implement upload-related support for open_basedir

[tt-rss.git] / classes / pref / feeds.php

diff --git a/classes/pref/feeds.php b/classes/pref/feeds.php
index eda03d126393d779da581af22da5bef827646cae..f57cc37d6fdebf2ea52cd88189679bafc114cfd1 100644 (file)
--- a/classes/pref/feeds.php
+++ b/classes/pref/feeds.php
@@ -463,7 +463,7 @@ class Pref_Feeds extends Handler_Protected {
                        WHERE id = '$feed_id' AND owner_uid = ". $_SESSION["uid"]);
 
                if (db_num_rows($result) != 0) {
-                       unlink(ICONS_DIR . "/$feed_id.ico");
+                       @unlink(ICONS_DIR . "/$feed_id.ico");
                }
 
                return;
@@ -472,7 +472,22 @@ class Pref_Feeds extends Handler_Protected {
        function uploadicon() {
                header("Content-type: text/html");
 
-               $icon_file = $_FILES['icon_file']['tmp_name'];
+               $tmp_file = false;
+
+               if (is_uploaded_file($_FILES['icon_file']['tmp_name'])) {
+                       $tmp_file = tempnam(CACHE_DIR . '/upload', 'icon');
+
+                       $result = move_uploaded_file($_FILES['icon_file']['tmp_name'],
+                               $tmp_file);
+
+                       if (!$result) {
+                               return;
+                       }
+               } else {
+                       return;
+               }
+
+               $icon_file = $tmp_file;
                $feed_id = db_escape_string($this->link, $_REQUEST["feed_id"]);
 
                if (is_file($icon_file) && $feed_id) {
@@ -482,8 +497,8 @@ class Pref_Feeds extends Handler_Protected {
                                        WHERE id = '$feed_id' AND owner_uid = ". $_SESSION["uid"]);
 
                                if (db_num_rows($result) != 0) {
-                                       unlink(ICONS_DIR . "/$feed_id.ico");
-                                       move_uploaded_file($icon_file, ICONS_DIR . "/$feed_id.ico");
+                                       @unlink(ICONS_DIR . "/$feed_id.ico");
+                                       rename($icon_file, ICONS_DIR . "/$feed_id.ico");
                                        $rc = 0;
                                } else {
                                        $rc = 2;
@@ -495,6 +510,8 @@ class Pref_Feeds extends Handler_Protected {
                        $rc = 2;
                }
 
+               @unlink($icon_file);
+
                print "<script type=\"text/javascript\">";
                print "parent.uploadIconHandler($rc);";
                print "</script>";
@@ -1712,12 +1729,15 @@ class Pref_Feeds extends Handler_Protected {
                                WHERE feed_url = '$feed_url' AND owner_uid = $owner_uid");
 
                        if (db_num_rows($result) == 0) {
+                               $result = db_query($link, "SELECT MAX(id) AS id FROM ttrss_archived_feeds");
+                               $new_feed_id = (int)db_fetch_result($result, 0, "id") + 1;
+
                                db_query($link, "INSERT INTO ttrss_archived_feeds
                                        (id, owner_uid, title, feed_url, site_url)
-                               SELECT id, owner_uid, title, feed_url, site_url from ttrss_feeds
+                               SELECT $new_feed_id, owner_uid, title, feed_url, site_url from ttrss_feeds
                                WHERE id = '$id'");
 
-                               $archive_id = $id;
+                               $archive_id = $new_feed_id;
                        } else {
                                $archive_id = db_fetch_result($result, 0, "id");
                        }
@@ -1751,7 +1771,7 @@ class Pref_Feeds extends Handler_Protected {
        }
 
        function batchSubscribe() {
-               print "<input dojoType=\"dijit.form.TextBox\" style=\"display : none\" name=\"op\" value=\"rpc\">";
+               print "<input dojoType=\"dijit.form.TextBox\" style=\"display : none\" name=\"op\" value=\"pref-feeds\">";
                print "<input dojoType=\"dijit.form.TextBox\" style=\"display : none\" name=\"method\" value=\"batchaddfeeds\">";
 
                print "<table width='100%'><tr><td>
@@ -1798,6 +1818,90 @@ class Pref_Feeds extends Handler_Protected {
                        </div>";
        }
 
+       function batchAddFeeds() {
+               $cat_id = db_escape_string($this->link, $_REQUEST['cat']);
+               $feeds = explode("\n", $_REQUEST['feeds']);
+               $login = db_escape_string($this->link, $_REQUEST['login']);
+               $pass = db_escape_string($this->link, $_REQUEST['pass']);
+
+               foreach ($feeds as $feed) {
+                       $feed = db_escape_string($this->link, trim($feed));
+
+                       if (validate_feed_url($feed)) {
+
+                               db_query($this->link, "BEGIN");
+
+                               if ($cat_id == "0" || !$cat_id) {
+                                       $cat_qpart = "NULL";
+                               } else {
+                                       $cat_qpart = "'$cat_id'";
+                               }
+
+                               $result = db_query($this->link,
+                                       "SELECT id FROM ttrss_feeds
+                                       WHERE feed_url = '$feed' AND owner_uid = ".$_SESSION["uid"]);
+
+                               if (db_num_rows($result) == 0) {
+                                       $result = db_query($this->link,
+                                               "INSERT INTO ttrss_feeds
+                                                       (owner_uid,feed_url,title,cat_id,auth_login,auth_pass,update_method)
+                                               VALUES ('".$_SESSION["uid"]."', '$feed',
+                                                       '[Unknown]', $cat_qpart, '$login', '$pass', 0)");
+                               }
+
+                               db_query($this->link, "COMMIT");
+                       }
+               }
+       }
+
+       function regenOPMLKey() {
+               $this->update_feed_access_key($this->link, 'OPML:Publish',
+               false, $_SESSION["uid"]);
+
+               $new_link = Opml::opml_publish_url($this->link);
+
+               print json_encode(array("link" => $new_link));
+       }
+
+       function regenFeedKey() {
+               $feed_id = db_escape_string($this->link, $_REQUEST['id']);
+               $is_cat = db_escape_string($this->link, $_REQUEST['is_cat']) == "true";
+
+               $new_key = $this->update_feed_access_key($this->link, $feed_id, $is_cat);
+
+               print json_encode(array("link" => $new_key));
+       }
+
+
+       private function update_feed_access_key($link, $feed_id, $is_cat, $owner_uid = false) {
+               if (!$owner_uid) $owner_uid = $_SESSION["uid"];
+
+               $sql_is_cat = bool_to_sql_bool($is_cat);
+
+               $result = db_query($link, "SELECT access_key FROM ttrss_access_keys
+                       WHERE feed_id = '$feed_id'      AND is_cat = $sql_is_cat
+                       AND owner_uid = " . $owner_uid);
+
+               if (db_num_rows($result) == 1) {
+                       $key = db_escape_string($this->link, sha1(uniqid(rand(), true)));
+
+                       db_query($link, "UPDATE ttrss_access_keys SET access_key = '$key'
+                               WHERE feed_id = '$feed_id' AND is_cat = $sql_is_cat
+                               AND owner_uid = " . $owner_uid);
+
+                       return $key;
+
+               } else {
+                       return get_feed_access_key($link, $feed_id, $is_cat, $owner_uid);
+               }
+       }
+
+       // Silent
+       function clearKeys() {
+               db_query($this->link, "DELETE FROM ttrss_access_keys WHERE
+                       owner_uid = " . $_SESSION["uid"]);
+       }
+
 
 }
 ?>