force-cast some variables used in queries to integer

[tt-rss.git] / include / functions.php

diff --git a/include/functions.php b/include/functions.php
index 7bf5460dbfb025813dcddfce896b463b94e1a6fa..a9786e49b2a08c70cf143c923efa00d98457f396 100644 (file)
--- a/include/functions.php
+++ b/include/functions.php
@@ -725,6 +725,17 @@
                }
        }
 
+       // this is used for user http parameters unless HTML code is actually needed
+       function clean($param) {
+               if (is_array($param)) {
+                       return array_map(strip_tags, $param);
+               } else if (is_string($param)) {
+                       return strip_tags($param);
+               } else {
+                       return $param;
+               }
+       }
+
        function make_password($length = 8) {
 
                $password = "";
@@ -945,7 +956,7 @@
        }
 
        function bool_to_sql_bool($s) {
-               return (bool)$s; //no-op for PDO
+               return $s ? 1 : 0;
        }
 
        // Session caching removed due to causing wrong redirects to upgrade
@@ -1053,7 +1064,7 @@
        }
 
        function checkbox_to_sql_bool($val) {
-               return ($val == "on") ? true : false;
+               return ($val == "on") ? 1 : 0;
        }
 
        function uniqid_short() {
@@ -1077,6 +1088,7 @@
                $params["default_view_limit"] = (int) get_pref("_DEFAULT_VIEW_LIMIT");
                $params["default_view_order_by"] = get_pref("_DEFAULT_VIEW_ORDER_BY");
                $params["bw_limit"] = (int) $_SESSION["bw_limit"];
+               $params["is_default_pw"] = Pref_Prefs::isdefaultpassword();
                $params["label_base_index"] = (int) LABEL_BASE_INDEX;
 
                $theme = get_pref( "USER_CSS_THEME", false, false);
@@ -1573,6 +1585,7 @@
                        }
 
                        if ($entry->nodeName == 'img') {
+                               $entry->setAttribute('referrerpolicy', 'no-referrer');
 
                                if ($entry->hasAttribute('src')) {
                                        $is_https_url = parse_url($entry->getAttribute('src'), PHP_URL_SCHEME) === 'https';
@@ -1931,10 +1944,6 @@
                }
        }
 
-       function feed_has_icon($id) {
-               return is_file(ICONS_DIR . "/$id.ico") && filesize(ICONS_DIR . "/$id.ico") > 0;
-       }
-
        function init_plugins() {
                PluginHost::getInstance()->load(PLUGINS, PluginHost::KIND_ALL);
 
@@ -2269,6 +2278,7 @@
                                        if ($rule["cat_id"] > 0) {
                                                $children = Feeds::getChildCategories($rule["cat_id"], $owner_uid);
                                                array_push($children, $rule["cat_id"]);
+                                               $children = array_map("intval", $children);
 
                                                $children = join(",", $children);
 
@@ -2341,9 +2351,9 @@
 
                foreach ($files as $js) {
                        if (!isset($_GET['debug'])) {
-                               $cached_file = CACHE_DIR . "/js/".basename($js).".js";
+                               $cached_file = CACHE_DIR . "/js/".basename($js);
 
-                               if (file_exists($cached_file) && is_readable($cached_file) && filemtime($cached_file) >= filemtime("js/$js.js")) {
+                               if (file_exists($cached_file) && is_readable($cached_file) && filemtime($cached_file) >= filemtime("js/$js")) {
 
                                        list($header, $contents) = explode("\n", file_get_contents($cached_file), 2);
 
@@ -2357,12 +2367,12 @@
                                        }
                                }
 
-                               $minified = JShrink\Minifier::minify(file_get_contents("js/$js.js"));
+                               $minified = JShrink\Minifier::minify(file_get_contents("js/$js"));
                                file_put_contents($cached_file, "tt-rss:" . VERSION . "\n" . $minified);
                                $rv .= $minified;
 
                        } else {
-                               $rv .= file_get_contents("js/$js.js"); // no cache in debug mode
+                               $rv .= file_get_contents("js/$js"); // no cache in debug mode
                        }
                }
 
@@ -2425,6 +2435,9 @@
        }
 
        function get_theme_path($theme) {
+               if ($theme == "default.php")
+                       return "css/default.css";
+
                $check = "themes/$theme";
                if (file_exists($check)) return $check;
 
@@ -2548,6 +2561,13 @@
                return $bad_tables;
        }
 
+       function validate_field($string, $allowed, $default = "") {
+               if (in_array($string, $allowed))
+                       return $string;
+               else
+                       return $default;
+       }
+
     function arr_qmarks($arr) {
         return str_repeat('?,', count($arr) - 1) . '?';
     }