force strip_tags() on all user input unless explicitly allowed

[tt-rss.git] / include / functions.php

diff --git a/include/functions.php b/include/functions.php
index 1d7033c899b46e773d4677a4df9c62947b3630b1..0fd8ef61ac05a9cfd82e75b4f9f2d2ca61834a0a 100644 (file)
--- a/include/functions.php
+++ b/include/functions.php
@@ -725,6 +725,17 @@
                }
        }
 
+       // this is used for user http parameters unless HTML code is actually needed
+       function clean($param) {
+               if (is_array($param)) {
+                       return array_map(strip_tags, $param);
+               } else if (is_string($param)) {
+                       return strip_tags($param);
+               } else {
+                       return $param;
+               }
+       }
+
        function make_password($length = 8) {
 
                $password = "";
@@ -1053,7 +1064,7 @@
        }
 
        function checkbox_to_sql_bool($val) {
-               return ($val == "on") ? true : false;
+               return ($val == "on") ? 1 : 0;
        }
 
        function uniqid_short() {
@@ -1077,6 +1088,7 @@
                $params["default_view_limit"] = (int) get_pref("_DEFAULT_VIEW_LIMIT");
                $params["default_view_order_by"] = get_pref("_DEFAULT_VIEW_ORDER_BY");
                $params["bw_limit"] = (int) $_SESSION["bw_limit"];
+               $params["is_default_pw"] = Pref_Prefs::isdefaultpassword();
                $params["label_base_index"] = (int) LABEL_BASE_INDEX;
 
                $theme = get_pref( "USER_CSS_THEME", false, false);
@@ -1931,10 +1943,6 @@
                }
        }
 
-       function feed_has_icon($id) {
-               return is_file(ICONS_DIR . "/$id.ico") && filesize(ICONS_DIR . "/$id.ico") > 0;
-       }
-
        function init_plugins() {
                PluginHost::getInstance()->load(PLUGINS, PluginHost::KIND_ALL);
 
@@ -2051,7 +2059,7 @@
                $sth = $pdo->prepare("SELECT access_key FROM ttrss_access_keys
                                WHERE feed_id = ? AND is_cat = ?
                                AND owner_uid = ?");
-               $sth->execute([$feed_id, $is_cat, $owner_uid]);
+               $sth->execute([$feed_id, (int)$is_cat, $owner_uid]);
 
                if ($row = $sth->fetch()) {
                        return $row["access_key"];
@@ -2062,7 +2070,7 @@
                                        (access_key, feed_id, is_cat, owner_uid)
                                        VALUES (?, ?, ?, ?)");
 
-                       $sth->execute([$key, $feed_id, $is_cat, $owner_uid]);
+                       $sth->execute([$key, $feed_id, (int)$is_cat, $owner_uid]);
 
                        return $key;
                }
@@ -2425,6 +2433,9 @@
        }
 
        function get_theme_path($theme) {
+               if ($theme == "default.php")
+                       return "css/default.css";
+
                $check = "themes/$theme";
                if (file_exists($check)) return $check;
 
@@ -2548,6 +2559,13 @@
                return $bad_tables;
        }
 
+       function validate_field($string, $allowed, $default = "") {
+               if (in_array($string, $allowed))
+                       return $string;
+               else
+                       return $default;
+       }
+
     function arr_qmarks($arr) {
         return str_repeat('?,', count($arr) - 1) . '?';
     }