rpc: addfeed: gets login and pass only if need_auth is checked.

[tt-rss.git] / classes / rssutils.php

diff --git a/classes/rssutils.php b/classes/rssutils.php
index 696b8604cce4b88b4811af07bab363af99b62acb..e5233b71ca8f8255df592b663bdf3037a22b3fe2 100644 (file)
--- a/classes/rssutils.php
+++ b/classes/rssutils.php
@@ -304,7 +304,7 @@ class RSSUtils {
         */
        static function update_rss_feed($feed, $no_cache = false) {
 
-               $debug_enabled = defined('DAEMON_EXTENDED_DEBUG') || $_REQUEST['xdebug'];
+               $debug_enabled = defined('DAEMON_EXTENDED_DEBUG') || clean($_REQUEST['xdebug']);
 
                _debug_suppress(!$debug_enabled);
                _debug("start", $debug_enabled);
@@ -369,7 +369,7 @@ class RSSUtils {
 
                $date_feed_processed = date('Y-m-d H:i');
 
-               $cache_filename = CACHE_DIR . "/simplepie/" . sha1($fetch_url) . ".xml";
+               $cache_filename = CACHE_DIR . "/feeds/" . sha1($fetch_url) . ".xml";
 
                $pluginhost = new PluginHost();
                $pluginhost->set_debug($debug_enabled);
@@ -454,7 +454,7 @@ class RSSUtils {
                        }
 
                        // cache vanilla feed data for re-use
-                       if ($feed_data && !$auth_pass && !$auth_login && is_writable(CACHE_DIR . "/simplepie")) {
+                       if ($feed_data && !$auth_pass && !$auth_login && is_writable(CACHE_DIR . "/feeds")) {
                                $new_rss_hash = sha1($feed_data);
 
                                if ($new_rss_hash != $rss_hash) {
@@ -492,8 +492,6 @@ class RSSUtils {
                $rss = new FeedParser($feed_data);
                $rss->init();
 
-               $feed = $feed;
-
                if (!$rss->error()) {
 
                        // We use local pluginhost here because we need to load different per-user feed plugins
@@ -593,7 +591,7 @@ class RSSUtils {
                        foreach ($items as $item) {
                                $pdo->beginTransaction();
 
-                               if ($_REQUEST['xdebug'] == 3) {
+                               if (clean($_REQUEST['xdebug']) == 3) {
                                        print_r($item);
                                }
 
@@ -642,7 +640,7 @@ class RSSUtils {
                                $entry_content = $item->get_content();
                                if (!$entry_content) $entry_content = $item->get_description();
 
-                               if ($_REQUEST["xdebug"] == 2) {
+                               if (clean($_REQUEST["xdebug"]) == 2) {
                                        print "content: ";
                                        print htmlspecialchars($entry_content);
                                        print "\n";
@@ -751,7 +749,7 @@ class RSSUtils {
                                        $entry_plugin_data .= mb_strtolower(get_class($plugin)) . ",";
                                }
 
-                               if ($_REQUEST["xdebug"] == 2) {
+                               if (clean($_REQUEST["xdebug"]) == 2) {
                                        print "processed content: ";
                                        print htmlspecialchars($article["content"]);
                                        print "\n";
@@ -879,14 +877,14 @@ class RSSUtils {
                                                        $entry_guid_hashed,
                                                        $entry_link,
                                                        $entry_timestamp_fmt,
-                                                       $entry_content,
+                                                       "$entry_content",
                                                        $entry_current_hash,
                                                        $date_feed_processed,
                                                        $entry_comments,
                                                        (int)$num_comments,
                                                        $entry_plugin_data,
-                                                       $entry_language,
-                                                       $entry_author]);
+                                                       "$entry_language",
+                                                       "$entry_author"]);
 
                                }
 
@@ -932,7 +930,7 @@ class RSSUtils {
                                                        $last_read_qpart = null;
                                                } else {
                                                        $unread = 0;
-                                                       $last_read_qpart = 'NOW()';
+                                                       $last_read_qpart = date("Y-m-d H:i"); // we can't use NOW() here because it gets quoted
                                                }
 
                                                if (RSSUtils::find_article_filter($article_filters, 'mark') || $score > 1000) {
@@ -955,10 +953,10 @@ class RSSUtils {
                                                                (ref_id, owner_uid, feed_id, unread, last_read, marked,
                                                                published, score, tag_cache, label_cache, uuid,
                                                                last_marked, last_published)
-                                                       VALUES (?, ?, ?, ?, ?, ?, ?, ?, '', '', '', ?, ?)");
+                                                       VALUES (?, ?, ?, ?, ?, ?, ?, ?, '', '', '', ".$last_marked.", ".$last_published.")");
 
                                                $sth->execute([$ref_id, $owner_uid, $feed, $unread, $last_read_qpart, $marked,
-                                                       $published, $score, $last_marked, $last_published]);
+                                                       $published, $score]);
 
                                                $sth = $pdo->prepare("SELECT int_id FROM ttrss_user_entries WHERE
                                                                ref_id = ? AND owner_uid = ? AND
@@ -973,29 +971,39 @@ class RSSUtils {
                                        _debug("resulting RID: $entry_ref_id, IID: $entry_int_id", $debug_enabled);
 
                                        if (DB_TYPE == "pgsql") {
-                                               $tsvector_combined = mb_substr($entry_title . ' ' . strip_tags(str_replace('<', ' <', $entry_content)),
+                                               $tsvector_combined = mb_substr($entry_title . ' ' .
+                                                       preg_replace('/[<\?\:]/', ' ', strip_tags($entry_content)),
                                                        0, 1000000);
 
-                                               $tsvector_qpart = "tsvector_combined = to_tsvector('$feed_language', ".$pdo->quote($tsvector_combined)."),";
+                                               $tsvector_qpart = "tsvector_combined = to_tsvector(".$pdo->quote($feed_language).", ".$pdo->quote($tsvector_combined)."),";
 
                                        } else {
                                                $tsvector_qpart = "";
                                        }
 
+                                       //_debug($tsvector_qpart);
+
                                        $sth = $pdo->prepare("UPDATE ttrss_entries
-                                               SET title = ?,
-                                                       content = ?,
-                                                       content_hash = ?,
-                                                       updated = ?,
+                                               SET title = :title,
                                                        $tsvector_qpart
-                                                       num_comments = ?,
-                                                       plugin_data = ?,
-                                                       author = ?,
-                                                       lang = ?
-                                               WHERE id = ?");
-
-                                       $sth->execute([$entry_title, $entry_content, $entry_current_hash, $entry_timestamp_fmt,
-                                               (int)$num_comments, $entry_plugin_data, $entry_author, $entry_language, $ref_id]);
+                                                       content = :content,
+                                                       content_hash = :content_hash,
+                                                       updated = :updated,
+                                                       num_comments = :num_comments,
+                                                       plugin_data = :plugin_data,
+                                                       author = :author,
+                                                       lang = :lang                                                                                                            
+                                               WHERE id = :id");
+
+                                       $sth->execute([":title" => $entry_title,
+                                               ":content" => "$entry_content",
+                                               ":content_hash" => $entry_current_hash,
+                                               ":updated" => $entry_timestamp_fmt,
+                                               ":num_comments" => (int)$num_comments,
+                                               ":plugin_data" => $entry_plugin_data,
+                                               ":author" => "$entry_author",
+                                               ":lang" => $entry_language,
+                                               ":id" => $ref_id]);
 
                                        // update aux data
                                        $sth = $pdo->prepare("UPDATE ttrss_user_entries
@@ -1278,7 +1286,7 @@ class RSSUtils {
        }
 
        static function expire_cached_files($debug) {
-               foreach (array("simplepie", "images", "export", "upload") as $dir) {
+               foreach (array("simplepie", "feeds", "images", "export", "upload") as $dir) {
                        $cache_dir = CACHE_DIR . "/$dir";
 
 //                     if ($debug) _debug("Expiring $cache_dir");