<?php
define('EXPECTED_CONFIG_VERSION', 26);
- define('SCHEMA_VERSION', 97);
+ define('SCHEMA_VERSION', 98);
$fetch_last_error = false;
"it_IT" => "Italiano",
"ja_JP" => "日本語 (Japanese)",
"nb_NO" => "Norwegian bokmål",
+ "pl_PL" => "Polski",
"ru_RU" => "Русский",
"pt_BR" => "Portuguese/Brazil",
"zh_CN" => "Simplified Chinese");
ini_set('user_agent', SELF_USER_AGENT);
require_once 'lib/pubsubhubbub/publisher.php';
-
- $purifier = false;
+ require_once 'lib/htmLawed.php';
$tz_offset = -1;
$utc_tz = new DateTimeZone('UTC');
print "</select>";
}
- function get_article_filters($filters, $title, $content, $link, $timestamp, $author, $tags) {
- $matches = array();
-
- foreach ($filters as $filter) {
- $match_any_rule = $filter["match_any_rule"];
- $filter_match = false;
-
- foreach ($filter["rules"] as $rule) {
- $match = false;
- $reg_exp = $rule["reg_exp"];
-
- if (!$reg_exp)
- continue;
-
- switch ($rule["type"]) {
- case "title":
- $match = @preg_match("/$reg_exp/i", $title);
- break;
- case "content":
- $match = @preg_match("/$reg_exp/i", $content);
- break;
- case "both":
- $match = (@preg_match("/$reg_exp/i", $title) || @preg_match("/$reg_exp/i", $title));
- break;
- case "link":
- $match = @preg_match("/$reg_exp/i", $link);
- break;
- case "author":
- $match = @preg_match("/$reg_exp/i", $author);
- break;
- case "tag":
- $tag_string = join(",", $tags);
- $match = @preg_match("/$reg_exp/i", $tag_string);
- break;
- }
-
- if ($match_any_rule) {
- if ($match) {
- $filter_match = true;
- break;
- }
- } else {
- $filter_match = $match;
- if (!$match) {
- break;
- }
- }
- }
-
- if ($filter_match) {
- foreach ($filter["actions"] AS $action) {
- array_push($matches, $action);
- }
- }
- }
-
- return $matches;
- }
-
- function find_article_filter($filters, $filter_name) {
- foreach ($filters as $f) {
- if ($f["type"] == $filter_name) {
- return $f;
- };
- }
- return false;
- }
-
- function find_article_filters($filters, $filter_name) {
- $results = array();
-
- foreach ($filters as $f) {
- if ($f["type"] == $filter_name) {
- array_push($results, $f);
- };
- }
- return $results;
- }
-
- function calculate_article_score($filters) {
- $score = 0;
-
- foreach ($filters as $f) {
- if ($f["type"] == "score") {
- $score += $f["param"];
- };
- }
- return $score;
- }
-
- function assign_article_to_labels($link, $id, $filters, $owner_uid) {
- foreach ($filters as $f) {
- if ($f["type"] == "label") {
- label_add_article($link, $id, $f["param"], $owner_uid);
- };
- }
- }
-
function getmicrotime() {
list($usec, $sec) = explode(" ",microtime());
return ((float)$usec + (float)$sec);
if ($feed >= 0) {
if ($feed > 0) {
- $cat_qpart = "cat_id = '$feed'";
+ $children = getChildCategories($link, $feed, $owner_uid);
+ array_push($children, $feed);
+
+ $children = join(",", $children);
+
+ $cat_qpart = "cat_id IN ($children)";
} else {
$cat_qpart = "cat_id IS NULL";
}
- $tmp_result = db_query($link, "SELECT id
- FROM ttrss_feeds WHERE $cat_qpart AND owner_uid = $owner_uid");
-
- while ($tmp_line = db_fetch_assoc($tmp_result)) {
-
- $tmp_feed = $tmp_line["id"];
+ db_query($link, "UPDATE ttrss_user_entries
+ SET unread = false,last_read = NOW()
+ WHERE feed_id IN (SELECT id FROM ttrss_feeds WHERE $cat_qpart)
+ AND $ref_check_qpart
+ AND owner_uid = $owner_uid");
- db_query($link, "UPDATE ttrss_user_entries
- SET unread = false,last_read = NOW()
- WHERE feed_id = '$tmp_feed'
- AND $ref_check_qpart
- AND owner_uid = $owner_uid");
- }
} else if ($feed == -2) {
db_query($link, "UPDATE ttrss_user_entries
if (db_num_rows($result) == 1) {
return db_fetch_result($result, 0, "title");
} else {
- return "Uncategorized";
+ return __("Uncategorized");
}
}
}
}
$cv = array("id" => $line["cat_id"], "kind" => "cat",
- "child_counter" => $child_counter,
- "counter" => $line["unread"]);
+ "counter" => $line["unread"] + $child_counter);
array_push($ret_arr, $cv);
}
/* Special case: NULL category doesn't actually exist in the DB */
$cv = array("id" => 0, "kind" => "cat",
- "counter" => ccache_find($link, 0, $_SESSION["uid"], true));
+ "counter" => (int) ccache_find($link, 0, $_SESSION["uid"], true));
array_push($ret_arr, $cv);
}
$cv = array("id" => "global-unread",
- "counter" => $global_unread);
+ "counter" => (int) $global_unread);
array_push($ret_arr, $cv);
$subscribed_feeds = db_fetch_result($result, 0, "fn");
$cv = array("id" => "subscribed-feeds",
- "counter" => $subscribed_feeds);
+ "counter" => (int) $subscribed_feeds);
array_push($ret_arr, $cv);
$count = getFeedUnread($link, $i);
$cv = array("id" => $i,
- "counter" => $count);
+ "counter" => (int) $count);
// if (get_pref($link, 'EXTENDED_FEEDLIST'))
// $cv["xmsg"] = getFeedArticles($link, $i)." ".__("total");
$count = getFeedUnread($link, $id);
$cv = array("id" => $id,
- "counter" => $count);
+ "counter" => (int) $count);
if ($descriptions)
$cv["description"] = $label_name;
$cv = array("id" => $id,
"updated" => $last_updated,
- "counter" => $count,
+ "counter" => (int) $count,
"has_img" => (int) $has_img);
if ($last_error)
$params["icons_url"] = ICONS_URL;
$params["cookie_lifetime"] = SESSION_COOKIE_LIFETIME;
- $params["default_include_children"] = get_pref($link, "_DEFAULT_INCLUDE_CHILDREN");
$params["default_view_mode"] = get_pref($link, "_DEFAULT_VIEW_MODE");
$params["default_view_limit"] = (int) get_pref($link, "_DEFAULT_VIEW_LIMIT");
$params["default_view_order_by"] = get_pref($link, "_DEFAULT_VIEW_ORDER_BY");
return $search_query_part;
}
+ function getParentCategories($link, $cat, $owner_uid) {
+ $rv = array();
+
+ $result = db_query($link, "SELECT parent_cat FROM ttrss_feed_categories
+ WHERE id = '$cat' AND parent_cat IS NOT NULL AND owner_uid = $owner_uid");
+
+ while ($line = db_fetch_assoc($result)) {
+ array_push($rv, $line["parent_cat"]);
+ $rv = array_merge($rv, getParentCategories($link, $line["parent_cat"], $owner_uid));
+ }
+
+ return $rv;
+ }
+
function getChildCategories($link, $cat, $owner_uid) {
$rv = array();
$override_order = "updated DESC";
- $filter_query_part = filter_to_sql($filter) . " AND";
+ $filter_query_part = filter_to_sql($link, $filter, $owner_uid);
+
+ // Try to check if SQL regexp implementation chokes on a valid regexp
+ $result = db_query($link, "SELECT true AS true FROM ttrss_entries,
+ ttrss_user_entries, ttrss_feeds, ttrss_feed_categories
+ WHERE $filter_query_part LIMIT 1", false);
+
+ $test = db_fetch_result($result, 0, "true");
+
+ if (!$test) {
+ $filter_query_part = "false AND";
+ } else {
+ $filter_query_part .= " AND";
+ }
+
} else {
$filter_query_part = "";
}
// override query strategy and enable feed display when searching globally
if ($search && $search_mode == "all_feeds") {
- $query_strategy_part = "ttrss_entries.id > 0";
+ $query_strategy_part = "true";
$vfeed_query_part = "ttrss_feeds.title AS feed_title,";
/* tags */
} else if (!is_numeric($feed)) {
- $query_strategy_part = "ttrss_entries.id > 0";
+ $query_strategy_part = "true";
$vfeed_query_part = "(SELECT title FROM ttrss_feeds WHERE
id = feed_id) as feed_title,";
- } else if ($feed > 0 && $search && $search_mode == "this_cat") {
-
+ } else if ($search && $search_mode == "this_cat") {
$vfeed_query_part = "ttrss_feeds.title AS feed_title,";
- $tmp_result = false;
-
- if ($cat_view) {
- $tmp_result = db_query($link, "SELECT id
- FROM ttrss_feeds WHERE cat_id = '$feed'");
- } else {
- $tmp_result = db_query($link, "SELECT id
- FROM ttrss_feeds WHERE cat_id = (SELECT cat_id FROM ttrss_feeds
- WHERE id = '$feed') AND id != '$feed'");
- }
-
- $cat_siblings = array();
-
- if (db_num_rows($tmp_result) > 0) {
- while ($p = db_fetch_assoc($tmp_result)) {
- array_push($cat_siblings, "feed_id = " . $p["id"]);
+ if ($feed > 0) {
+ if ($include_children) {
+ $subcats = getChildCategories($link, $feed, $owner_uid);
+ array_push($subcats, $feed);
+ $cats_qpart = join(",", $subcats);
+ } else {
+ $cats_qpart = $feed;
}
- $query_strategy_part = sprintf("(feed_id = %d OR %s)",
- $feed, implode(" OR ", $cat_siblings));
+ $query_strategy_part = "ttrss_feeds.cat_id IN ($cats_qpart)";
} else {
- $query_strategy_part = "ttrss_entries.id > 0";
+ $query_strategy_part = "ttrss_feeds.cat_id IS NULL";
}
} else if ($feed > 0) {
# sub-cats
$subcats = getChildCategories($link, $feed, $owner_uid);
- if (count($subcats) == 0) {
- $query_strategy_part = "cat_id = '$feed'";
- } else {
- array_push($subcats, $feed);
- $query_strategy_part = "cat_id IN (".
+ array_push($subcats, $feed);
+ $query_strategy_part = "cat_id IN (".
implode(",", $subcats).")";
- }
+
} else {
$query_strategy_part = "cat_id = '$feed'";
}
} else if ($feed == -1) { // starred virtual feed
$query_strategy_part = "marked = true";
$vfeed_query_part = "ttrss_feeds.title AS feed_title,";
+ $allow_archived = true;
+
} else if ($feed == -2) { // published virtual feed OR labels category
if (!$cat_view) {
} else if ($feed == -6) { // recently read
$query_strategy_part = "unread = false AND last_read IS NOT NULL";
$vfeed_query_part = "ttrss_feeds.title AS feed_title,";
+ $allow_archived = true;
if (!$override_order) $override_order = "last_read DESC";
} else if ($feed == -3) { // fresh virtual feed
$vfeed_query_part = "ttrss_feeds.title AS feed_title,";
$ext_tables_part = ",ttrss_labels2,ttrss_user_labels2";
+ $allow_archived = true;
} else {
- $query_strategy_part = "id > 0"; // dumb
+ $query_strategy_part = "true";
}
if (get_pref($link, "SORT_HEADLINES_BY_FEED_DATE", $owner_uid)) {
$feed_title = "";
if ($search) {
- $feed_title = "Search results";
+ $feed_title = T_sprintf("Search results: %s", $search);
} else {
if ($cat_view) {
$feed_title = getCategoryTitle($link, $feed);
$offset_query_part = "OFFSET $offset";
}
+ // proper override_order applied above
if ($vfeed_query_part && get_pref($link, 'VFEED_GROUP_BY_FEED', $owner_uid)) {
if (!$override_order) {
$order_by = "ttrss_feeds.title, $order_by";
+ } else {
+ $order_by = "ttrss_feeds.title, $override_order";
}
}
$feed_check_qpart = "ttrss_user_entries.feed_id = ttrss_feeds.id AND";
} else {
- $from_qpart = "ttrss_entries,ttrss_user_entries$ext_tables_part
+ $from_qpart = "ttrss_entries$ext_tables_part,ttrss_user_entries
LEFT JOIN ttrss_feeds ON (feed_id = ttrss_feeds.id)";
}
}
function sanitize($link, $str, $force_strip_tags = false, $owner = false, $site_url = false) {
- global $purifier;
-
if (!$owner) $owner = $_SESSION["uid"];
$res = trim($str); if (!$res) return '';
- // create global Purifier object if needed
- if (!$purifier) {
- require_once 'lib/htmlpurifier/library/HTMLPurifier.auto.php';
-
- $config = HTMLPurifier_Config::createDefault();
-
- $allowed = "p,a[href],i,em,b,strong,code,pre,blockquote,br,img[src|alt|title|align|hspace],ul,ol,li,h1,h2,h3,h4,s,object[classid|type|id|name|width|height|codebase],param[name|value],table,tr,td,span[class]";
-
- $config->set('HTML.SafeObject', true);
- @$config->set('HTML', 'Allowed', $allowed);
- $config->set('Output.FlashCompat', true);
- $config->set('Attr.EnableID', true);
- if (!defined('MOBILE_VERSION')) {
- @$config->set('Cache', 'SerializerPath', CACHE_DIR . "/htmlpurifier");
- } else {
- @$config->set('Cache', 'SerializerPath', "../" . CACHE_DIR . "/htmlpurifier");
- }
-
- $config->set('Filter.YouTube', true);
-
- $purifier = new HTMLPurifier($config);
- }
-
- $res = $purifier->purify($res);
+ $config = array('safe' => 1, 'deny_attribute' => 'style', 'comment' => 1, 'cdata' => 1);
+ $res = htmLawed($res, $config);
if (get_pref($link, "STRIP_IMAGES", $owner)) {
$res = preg_replace('/<img[^>]+>/is', '', $res);
if ($num_comments > 0) {
if ($line["comments"]) {
- $comments_url = $line["comments"];
+ $comments_url = htmlspecialchars($line["comments"]);
} else {
- $comments_url = $line["link"];
+ $comments_url = htmlspecialchars($line["link"]);
}
$entry_comments = "<a target='_blank' href=\"$comments_url\">$num_comments comments</a>";
} else {
if ($line["comments"] && $line["link"] != $line["comments"]) {
- $entry_comments = "<a target='_blank' href=\"".$line["comments"]."\">comments</a>";
+ $entry_comments = "<a target='_blank' href=\"".htmlspecialchars($line["comments"])."\">comments</a>";
}
}
</head><body>";
}
- $title_escaped = db_escape_string($line['title']);
+ $title_escaped = htmlspecialchars($line['title']);
$rv['content'] .= "<div id=\"PTITLE-$id\" style=\"display : none\">" .
truncate_string(strip_tags($line['title']), 15) . "</div>";
$rv['content'] .= "<div class='postTitle'><a target='_blank'
title=\"".htmlspecialchars($line['title'])."\"
href=\"" .
- $line["link"] . "\">" .
+ htmlspecialchars($line["link"]) . "\">" .
$line["title"] .
"<span class='author'>$entry_author</span></a></div>";
} else {
$button_plugins = explode(",", ARTICLE_BUTTON_PLUGINS);
foreach ($button_plugins as $p) {
- $pclass = trim("button_${p}");
+ $pclass = "button_" . trim($p);
if (class_exists($pclass)) {
$plugin = new $pclass($link);
}
} // function encrypt_password
- function sanitize_article_content($text) {
- # we don't support CDATA sections in articles, they break our own escaping
- $text = preg_replace("/\[\[CDATA/", "", $text);
- $text = preg_replace("/\]\]\>/", "", $text);
- return $text;
- }
-
function load_filters($link, $feed_id, $owner_uid, $action_id = false) {
$filters = array();
$result = db_query($link, "SELECT * FROM ttrss_filters2 WHERE
owner_uid = $owner_uid AND enabled = true");
+ $check_cats = join(",", array_merge(
+ getParentCategories($link, $cat_id, $owner_uid),
+ array($cat_id)));
+
while ($line = db_fetch_assoc($result)) {
$filter_id = $line["id"];
FROM ttrss_filters2_rules AS r,
ttrss_filter_types AS t
WHERE
- (cat_id IS NULL OR cat_id = '$cat_id') AND
+ (cat_id IS NULL OR cat_id IN ($check_cats)) AND
(feed_id IS NULL OR feed_id = '$feed_id') AND
filter_type = t.id AND filter_id = '$filter_id'");
}
}
+ function get_all_labels($link, $owner_uid) {
+ $rv = array();
+
+ $result = db_query($link, "SELECT fg_color, bg_color, caption FROM ttrss_labels2 WHERE owner_uid = " . $owner_uid);
+
+ while ($line = db_fetch_assoc($result)) {
+ array_push($rv, $line);
+ }
+
+ return $rv;
+ }
+
function label_update_cache($link, $id, $labels = false, $force = false) {
if ($force)
$result = db_query($link, "SELECT
id, title FROM ttrss_feed_categories
WHERE parent_cat = '$cat_id' AND owner_uid = " . $_SESSION["uid"] .
- "ORDER BY id, title");
+ " ORDER BY id, title");
while ($line = db_fetch_assoc($result)) {
$unread = getFeedUnread($link, $line["id"], true) +
function api_get_headlines($link, $feed_id, $limit, $offset,
$filter, $is_cat, $show_excerpt, $show_content, $view_mode, $order,
$include_attachments, $since_id,
- $search = "", $search_mode = "", $match_on = "", $include_nested = false) {
+ $search = "", $search_mode = "", $match_on = "",
+ $include_nested = false, $sanitize_content = true) {
$qfh_ret = queryFeedHeadlines($link, $feed_id, $limit,
$view_mode, $is_cat, $search, $search_mode, $match_on,
}
if ($show_content) {
- $headline_row["content"] = $line["content_preview"];
+ if ($sanitize_content) {
+ $headline_row["content"] = sanitize($link,
+ $line["content_preview"], false, false, $line["site_url"]);
+ } else {
+ $headline_row["content"] = $line["content_preview"];
+ }
}
// unify label output to ease parsing
$headline_row["feed_title"] = $line["feed_title"];
+ $headline_row["comments_count"] = (int)$line["num_comments"];
+ $headline_row["comments_link"] = $line["comments"];
+
+ $headline_row["always_display_attachments"] = sql_bool_to_bool($line["always_display_enclosures"]);
+
array_push($headlines, $headline_row);
}
return $html;
}
- function filter_to_sql($filter) {
+ function filter_to_sql($link, $filter, $owner_uid) {
$query = array();
if (DB_TYPE == "pgsql")
}
if (isset($rule["cat_id"])) {
- $qpart .= " AND cat_id " . ($rule["cat_id"] ? '= ' . $rule["cat_id"] : 'IS NULL');
+
+ if ($rule["cat_id"] > 0) {
+ $children = getChildCategories($link, $rule["cat_id"], $owner_uid);
+ array_push($children, $rule["cat_id"]);
+
+ $children = join(",", $children);
+
+ $cat_qpart = "cat_id IN ($children)";
+ } else {
+ $cat_qpart = "cat_id IS NULL";
+ }
+
+ $qpart .= " AND $cat_qpart";
}
array_push($query, "($qpart)");