feedbrowser: fix incorrect usage of LIMIT in prepared statement

[tt-rss.git] / include / functions.php

diff --git a/include/functions.php b/include/functions.php
index 1319520c675678c3b12baac50b64e8575c3c87ca..a6dbd43a89fb70280cf1d061cb604ec58951e027 100755 (executable)
--- a/include/functions.php
+++ b/include/functions.php
@@ -1,6 +1,6 @@
 <?php
        define('EXPECTED_CONFIG_VERSION', 26);
-       define('SCHEMA_VERSION', 133);
+       define('SCHEMA_VERSION', 134);
 
        define('LABEL_BASE_INDEX', -1024);
        define('PLUGIN_FEED_BASE_INDEX', -128);
@@ -56,6 +56,10 @@
        // default sleep interval between feed updates (sec)
        define_default('MIN_CACHE_FILE_SIZE', 1024);
        // do not cache files smaller than that (bytes)
+       define_default('MAX_CACHE_FILE_SIZE', 64*1024*1024);
+       // do not cache files larger than that (bytes)
+       define_default('MAX_DOWNLOAD_FILE_SIZE', 16*1024*1024);
+       // do not download general files larger than that (bytes)
        define_default('CACHE_MAX_DAYS', 7);
        // max age in days for various automatically cached (temporary) files
        define_default('MAX_CONDITIONAL_INTERVAL', 3600*12);
@@ -317,6 +321,7 @@
                }
        }
 
+       // TODO: max_size currently only works for CURL transfers
        // TODO: multiple-argument way is deprecated, first parameter is a hash now
        function fetch_file_contents($options /* previously: 0: $url , 1: $type = false, 2: $login = false, 3: $pass = false,
                                4: $post_query = false, 5: $timeout = false, 6: $timestamp = 0, 7: $useragent = false*/) {
@@ -370,6 +375,8 @@
                $last_modified = isset($options["last_modified"]) ? $options["last_modified"] : "";
                $useragent = isset($options["useragent"]) ? $options["useragent"] : false;
                $followlocation = isset($options["followlocation"]) ? $options["followlocation"] : true;
+               $max_size = isset($options["max_size"]) ? $options["max_size"] : MAX_DOWNLOAD_FILE_SIZE; // in bytes
+               $http_accept = isset($options["http_accept"]) ? $options["http_accept"] : false;
 
                $url = ltrim($url, ' ');
                $url = str_replace(' ', '%20', $url);
@@ -383,10 +390,16 @@
 
                        $ch = curl_init($url);
 
-                       if ($last_modified && !$post_query) {
-                               curl_setopt($ch, CURLOPT_HTTPHEADER,
-                                       array("If-Modified-Since: $last_modified"));
-                       }
+                       $curl_http_headers = [];
+
+                       if ($last_modified && !$post_query)
+                               array_push($curl_http_headers, "If-Modified-Since: $last_modified");
+
+                       if ($http_accept)
+                               array_push($curl_http_headers, "Accept: " . $http_accept);
+
+                       if (count($curl_http_headers) > 0)
+                               curl_setopt($ch, CURLOPT_HTTPHEADER, $curl_http_headers);
 
                        curl_setopt($ch, CURLOPT_CONNECTTIMEOUT, $timeout ? $timeout : FILE_FETCH_CONNECT_TIMEOUT);
                        curl_setopt($ch, CURLOPT_TIMEOUT, $timeout ? $timeout : FILE_FETCH_TIMEOUT);
@@ -401,6 +414,20 @@
                        curl_setopt($ch, CURLOPT_ENCODING, "");
                        //curl_setopt($ch, CURLOPT_REFERER, $url);
 
+                       if ($max_size) {
+                               curl_setopt($ch, CURLOPT_NOPROGRESS, false);
+                               curl_setopt($ch, CURLOPT_BUFFERSIZE, 16384); // needed to get 5 arguments in progress function?
+
+                               // holy shit closures in php
+                               // download & upload are *expected* sizes respectively, could be zero
+                               curl_setopt($ch, CURLOPT_PROGRESSFUNCTION, function($curl_handle, $download_size, $downloaded, $upload_size, $uploaded) use( &$max_size) {
+                                       //_debug("[curl progressfunction] $downloaded $max_size");
+
+                                       return ($downloaded > $max_size) ? 1 : 0; // if max size is set, abort when exceeding it
+                               });
+
+                       }
+
                        if (!ini_get("open_basedir")) {
                                curl_setopt($ch, CURLOPT_COOKIEJAR, "/dev/null");
                        }
@@ -499,9 +526,11 @@
                                                'protocol_version'=> 1.1)
                                  );
 
-                       if (!$post_query && $last_modified) {
+                       if (!$post_query && $last_modified)
                                array_push($context_options['http']['header'], "If-Modified-Since: $last_modified");
-                       }
+
+                       if ($http_accept)
+                               array_push($context_options['http']['header'], "Accept: $http_accept");
 
                        if (defined('_HTTP_PROXY')) {
                                $context_options['http']['request_fulluri'] = true;
@@ -617,7 +646,7 @@
                $profile = $profile ? $profile : null;
 
                $u_sth = $pdo->prepare("SELECT pref_name
-                       FROM ttrss_user_prefs WHERE owner_uid = :uid AND 
+                       FROM ttrss_user_prefs WHERE owner_uid = :uid AND
                                (profile = :profile OR (:profile IS NULL AND profile IS NULL))");
                $u_sth->execute([':uid' => $uid, ':profile' => $profile]);
 
@@ -848,14 +877,14 @@
 
                                /* cleanup ccache */
 
-                               $sth = $pdo->prepare("DELETE FROM ttrss_counters_cache WHERE owner_uid = ? 
+                               $sth = $pdo->prepare("DELETE FROM ttrss_counters_cache WHERE owner_uid = ?
                                        AND
                                                (SELECT COUNT(id) FROM ttrss_feeds WHERE
                                                        ttrss_feeds.id = feed_id) = 0");
 
                                $sth->execute([$_SESSION['uid']]);
 
-                               $sth = $pdo->prepare("DELETE FROM ttrss_cat_counters_cache WHERE owner_uid = ? 
+                               $sth = $pdo->prepare("DELETE FROM ttrss_cat_counters_cache WHERE owner_uid = ?
                                        AND
                                                (SELECT COUNT(id) FROM ttrss_feed_categories WHERE
                                                        ttrss_feed_categories.id = feed_id) = 0");
@@ -1389,7 +1418,7 @@
                $search_query_leftover = array();
 
                $pdo = Db::pdo();
-               
+
                if ($search_language)
                        $search_language = $pdo->quote(mb_strtolower($search_language));
                else
@@ -1654,7 +1683,7 @@
                        }
                }
 
-               $allowed_elements = array('a', 'address', 'acronym', 'audio', 'article', 'aside',
+               $allowed_elements = array('a', 'abbr', 'address', 'acronym', 'audio', 'article', 'aside',
                        'b', 'bdi', 'bdo', 'big', 'blockquote', 'body', 'br',
                        'caption', 'cite', 'center', 'code', 'col', 'colgroup',
                        'data', 'dd', 'del', 'details', 'description', 'dfn', 'div', 'dl', 'font',
@@ -1979,7 +2008,7 @@
                }
 
                $sth = $pdo->prepare("SELECT id FROM ttrss_feed_categories
-                               WHERE (parent_cat = :parent OR (:parent IS NULL AND parent_cat IS NULL)) 
+                               WHERE (parent_cat = :parent OR (:parent IS NULL AND parent_cat IS NULL))
                                AND title = :title AND owner_uid = :uid");
                $sth->execute([':parent' => $parent_cat_id, ':title' => $feed_cat, ':uid' => $_SESSION['uid']]);