]> git.wh0rd.org - tt-rss.git/blobdiff - include/functions.php
set csrf and access_level in single user mode session
[tt-rss.git] / include / functions.php
index 90acc103abab2463ae81a6d5c3df291c5b5f94d8..c19915bb7bfccd2b786630d1d00f92b55b49566e 100644 (file)
 
                                        // First login ?
                                        if (db_num_rows($result) == 0) {
+                                               $salt = substr(bin2hex(get_random_bytes(125)), 0, 250);
+                                               $pwd_hash = encrypt_password($password, $salt, true);
+
                                                $query2 = "INSERT INTO ttrss_users
-                                                               (login,access_level,last_login,created)
-                                                               VALUES ('$login', 0, null, NOW())";
+                                                               (login,access_level,last_login,created,pwd_hash,salt)
+                                                               VALUES ('$login', 0, null, NOW(), '$pwd_hash','$salt')";
                                                db_query($link, $query2);
                                        }
                                }
 
+                       } else if (get_schema_version($link) > 87) {
+                               $result = db_query($link, "SELECT salt FROM ttrss_users WHERE
+                                       login = '$login'");
+
+                               if (db_num_rows($result) != 1) {
+                                       return false;
+                               }
+
+                               $salt = db_fetch_result($result, 0, "salt");
+
+                               if ($salt == "") {
+
+                                       $query = "SELECT id,login,access_level,pwd_hash
+                           FROM ttrss_users WHERE
+                                               login = '$login' AND (pwd_hash = '$pwd_hash1' OR
+                                               pwd_hash = '$pwd_hash2')";
+
+                                       // verify and upgrade password to new salt base
+
+                                       $result = db_query($link, $query);
+
+                                       if (db_num_rows($result) == 1) {
+                                               // upgrade password to MODE2
+
+                                               $salt = substr(bin2hex(get_random_bytes(125)), 0, 250);
+                                               $pwd_hash = encrypt_password($password, $salt, true);
+
+                                               db_query($link, "UPDATE ttrss_users SET
+                                                       pwd_hash = '$pwd_hash', salt = '$salt' WHERE login = '$login'");
+
+                                               $query = "SELECT id,login,access_level,pwd_hash
+                                   FROM ttrss_users WHERE
+                                                       login = '$login' AND pwd_hash = '$pwd_hash'";
+
+                                       } else {
+                                               return false;
+                                       }
+
+                               } else {
+
+                                       $pwd_hash = encrypt_password($password, $salt, true);
+
+                                       $query = "SELECT id,login,access_level,pwd_hash
+                                FROM ttrss_users WHERE
+                                               login = '$login' AND pwd_hash = '$pwd_hash'";
+
+                               }
                        } else {
                                $query = "SELECT id,login,access_level,pwd_hash
-                   FROM ttrss_users WHERE
+                        FROM ttrss_users WHERE
                                        login = '$login' AND (pwd_hash = '$pwd_hash1' OR
                                                pwd_hash = '$pwd_hash2')";
                        }
                                $_SESSION["uid"] = db_fetch_result($result, 0, "id");
                                $_SESSION["name"] = db_fetch_result($result, 0, "login");
                                $_SESSION["access_level"] = db_fetch_result($result, 0, "access_level");
+                               $_SESSION["csrf_token"] = sha1(uniqid(rand(), true));
 
                                db_query($link, "UPDATE ttrss_users SET last_login = NOW() WHERE id = " .
                                        $_SESSION["uid"]);
 
                        $_SESSION["uid"] = 1;
                        $_SESSION["name"] = "admin";
+                       $_SESSION["access_level"] = 10;
+                       $_SESSION["csrf_token"] = sha1(uniqid(rand(), true));
 
                        $_SESSION["ip_address"] = $_SERVER["REMOTE_ADDR"];
 
                }
        }
 
+       function validate_csrf($csrf_token) {
+               return $csrf_token == $_SESSION['csrf_token'];
+       }
+
        function validate_session($link) {
                if (SINGLE_USER_MODE) return true;
 
        }
 
        /**
-        * Subscribes the user to the given feed
-        *
-        * @param resource $link       Database connection
-        * @param string   $url        Feed URL to subscribe to
-        * @param integer  $cat_id     Category ID the feed shall be added to
-        * @param string   $auth_login (optional) Feed username
-        * @param string   $auth_pass  (optional) Feed password
-        *
         * @return integer Status code:
         *                 0 - OK, Feed already exists
         *                 1 - OK, Feed added
         *                 5 - Couldn't download the URL content.
         */
        function subscribe_to_feed($link, $url, $cat_id = 0,
-                       $auth_login = '', $auth_pass = '') {
+                       $auth_login = '', $auth_pass = '', $need_auth = false) {
 
                require_once "include/rssfuncs.php";
 
 
                $has_oauth = db_fetch_result($result, 0, 'twitter_oauth');
 
-               if (!$has_oauth || strpos($url, '://api.twitter.com') === false) {
+               if (!$need_auth || !$has_oauth || strpos($url, '://api.twitter.com') === false) {
                        if (!fetch_file_contents($url, false, $auth_login, $auth_pass)) return 5;
 
                        if (url_is_html($url, $auth_login, $auth_pass)) {
 
                $params["collapsed_feedlist"] = (int) get_pref($link, "_COLLAPSED_FEEDLIST");
 
+               $params["csrf_token"] = $_SESSION["csrf_token"];
+
                return $params;
        }
 
 
                        $config = HTMLPurifier_Config::createDefault();
 
-                       $allowed = "p,a[href],i,em,b,strong,code,pre,blockquote,br,img[src|alt|title],ul,ol,li,h1,h2,h3,h4,s,object[classid|type|id|name|width|height|codebase],param[name|value],table,tr,td";
+                       $allowed = "p,a[href],i,em,b,strong,code,pre,blockquote,br,img[src|alt|title|align|hspace],ul,ol,li,h1,h2,h3,h4,s,object[classid|type|id|name|width|height|codebase],param[name|value],table,tr,td,span[class]";
 
                        $config->set('HTML.SafeObject', true);
                        @$config->set('HTML', 'Allowed', $allowed);
                                @$config->set('Cache', 'SerializerPath', "../" . CACHE_DIR . "/htmlpurifier");
                        }
 
+                       $config->set('Filter.YouTube', true);
+
                        $purifier = new HTMLPurifier($config);
                }
 
 
                $node = $doc->getElementsByTagName('body')->item(0);
 
-               return $doc->saveXML($node);
+               return $doc->saveXML($node, LIBXML_NOEMPTYTAG);
        }
 
        /**
         * @param integer $limit The maximum number of articles by digest.
         * @return boolean Return false if digests are not enabled.
         */
-       function send_headlines_digests($link, $limit = 100) {
+       function send_headlines_digests($link, $debug = false) {
 
                require_once 'lib/phpmailer/class.phpmailer.php';
 
                $user_limit = 15; // amount of users to process (e.g. emails to send out)
-               $days = 1;
+               $limit = 1000; // maximum amount of headlines to include
 
-               print "Sending digests, batch of max $user_limit users, days = $days, headline limit = $limit\n\n";
+               if ($debug) _debug("Sending digests, batch of max $user_limit users, headline limit = $limit");
 
                if (DB_TYPE == "pgsql") {
-                       $interval_query = "last_digest_sent < NOW() - INTERVAL '$days days'";
+                       $interval_query = "last_digest_sent < NOW() - INTERVAL '1 days'";
                } else if (DB_TYPE == "mysql") {
-                       $interval_query = "last_digest_sent < DATE_SUB(NOW(), INTERVAL $days DAY)";
+                       $interval_query = "last_digest_sent < DATE_SUB(NOW(), INTERVAL 1 DAY)";
                }
 
                $result = db_query($link, "SELECT id,email FROM ttrss_users
                while ($line = db_fetch_assoc($result)) {
 
                        if (get_pref($link, 'DIGEST_ENABLE', $line['id'], false)) {
-                               print "Sending digest for UID:" . $line['id'] . " - " . $line["email"] . " ... ";
+                               $preferred_ts = strtotime(get_pref($link, 'DIGEST_PREFERRED_TIME', $line['id'], '00:00'));
 
-                               $do_catchup = get_pref($link, 'DIGEST_CATCHUP', $line['id'], false);
+                               // try to send digests within 2 hours of preferred time
+                               if ($preferred_ts && time() >= $preferred_ts &&
+                                               time() - $preferred_ts <= 7200) {
 
-                               $tuple = prepare_headlines_digest($link, $line["id"], $days, $limit);
-                               $digest = $tuple[0];
-                               $headlines_count = $tuple[1];
-                               $affected_ids = $tuple[2];
-                               $digest_text = $tuple[3];
+                                       if ($debug) print "Sending digest for UID:" . $line['id'] . " - " . $line["email"] . " ... ";
 
-                               if ($headlines_count > 0) {
+                                       $do_catchup = get_pref($link, 'DIGEST_CATCHUP', $line['id'], false);
 
-                                       $mail = new PHPMailer();
+                                       global $tz_offset;
 
-                                       $mail->PluginDir = "lib/phpmailer/";
-                                       $mail->SetLanguage("en", "lib/phpmailer/language/");
+                                       // reset tz_offset global to prevent tz cache clash between users
+                                       $tz_offset = -1;
 
-                                       $mail->CharSet = "UTF-8";
+                                       $tuple = prepare_headlines_digest($link, $line["id"], 1, $limit);
+                                       $digest = $tuple[0];
+                                       $headlines_count = $tuple[1];
+                                       $affected_ids = $tuple[2];
+                                       $digest_text = $tuple[3];
 
-                                       $mail->From = SMTP_FROM_ADDRESS;
-                                       $mail->FromName = SMTP_FROM_NAME;
-                                       $mail->AddAddress($line["email"], $line["login"]);
+                                       if ($headlines_count > 0) {
 
-                                       if (SMTP_HOST) {
-                                               $mail->Host = SMTP_HOST;
-                                               $mail->Mailer = "smtp";
-                                               $mail->SMTPAuth = SMTP_LOGIN != '';
-                                               $mail->Username = SMTP_LOGIN;
-                                               $mail->Password = SMTP_PASSWORD;
-                                       }
+                                               $mail = new PHPMailer();
 
-                                       $mail->IsHTML(true);
-                                       $mail->Subject = DIGEST_SUBJECT;
-                                       $mail->Body = $digest;
-                                       $mail->AltBody = $digest_text;
+                                               $mail->PluginDir = "lib/phpmailer/";
+                                               $mail->SetLanguage("en", "lib/phpmailer/language/");
 
-                                       $rc = $mail->Send();
+                                               $mail->CharSet = "UTF-8";
 
-                                       if (!$rc) print "ERROR: " . $mail->ErrorInfo;
+                                               $mail->From = SMTP_FROM_ADDRESS;
+                                               $mail->FromName = SMTP_FROM_NAME;
+                                               $mail->AddAddress($line["email"], $line["login"]);
 
-                                       print "RC=$rc\n";
+                                               if (SMTP_HOST) {
+                                                       $mail->Host = SMTP_HOST;
+                                                       $mail->Mailer = "smtp";
+                                                       $mail->SMTPAuth = SMTP_LOGIN != '';
+                                                       $mail->Username = SMTP_LOGIN;
+                                                       $mail->Password = SMTP_PASSWORD;
+                                               }
 
-                                       if ($rc && $do_catchup) {
-                                               print "Marking affected articles as read...\n";
-                                               catchupArticlesById($link, $affected_ids, 0, $line["id"]);
+                                               $mail->IsHTML(true);
+                                               $mail->Subject = DIGEST_SUBJECT;
+                                               $mail->Body = $digest;
+                                               $mail->AltBody = $digest_text;
+
+                                               $rc = $mail->Send();
+
+                                               if (!$rc && $debug) print "ERROR: " . $mail->ErrorInfo;
+
+                                               if ($debug) print "RC=$rc\n";
+
+                                               if ($rc && $do_catchup) {
+                                                       if ($debug) print "Marking affected articles as read...\n";
+                                                       catchupArticlesById($link, $affected_ids, 0, $line["id"]);
+                                               }
+                                       } else {
+                                               if ($debug) print "No headlines\n";
                                        }
-                               } else {
-                                       print "No headlines\n";
-                               }
 
-                               db_query($link, "UPDATE ttrss_users SET last_digest_sent = NOW()
-                                       WHERE id = " . $line["id"]);
+                                       db_query($link, "UPDATE ttrss_users SET last_digest_sent = NOW()
+                                               WHERE id = " . $line["id"]);
+
+                               }
                        }
                }
 
-               print "All done.\n";
+               if ($debug) _debug("All done.");
 
        }
 
-       function prepare_headlines_digest($link, $user_id, $days = 1, $limit = 100) {
+       function prepare_headlines_digest($link, $user_id, $days = 1, $limit = 1000) {
 
                require_once "lib/MiniTemplator.class.php";
 
                $tpl->readTemplateFromFile("templates/digest_template_html.txt");
                $tpl_t->readTemplateFromFile("templates/digest_template.txt");
 
-               $tpl->setVariable('CUR_DATE', date('Y/m/d'));
-               $tpl->setVariable('CUR_TIME', date('G:i'));
+               $user_tz_string = get_pref($link, 'USER_TIMEZONE', $user_id);
+               $local_ts = convert_timestamp(time(), 'UTC', $user_tz_string);
+
+               $tpl->setVariable('CUR_DATE', date('Y/m/d', $local_ts));
+               $tpl->setVariable('CUR_TIME', date('G:i', $local_ts));
 
-               $tpl_t->setVariable('CUR_DATE', date('Y/m/d'));
-               $tpl_t->setVariable('CUR_TIME', date('G:i'));
+               $tpl_t->setVariable('CUR_DATE', date('Y/m/d', $local_ts));
+               $tpl_t->setVariable('CUR_TIME', date('G:i', $local_ts));
 
                $affected_ids = array();
 
 
                $result = db_query($link, "SELECT ttrss_entries.title,
                                ttrss_feeds.title AS feed_title,
+                               ttrss_feed_categories.title AS cat_title,
                                date_updated,
                                ttrss_user_entries.ref_id,
                                link,
-                               SUBSTRING(content, 1, 120) AS excerpt,
+                               score,
+                               content,
                                ".SUBSTRING_FOR_DATE."(last_updated,1,19) AS last_updated
                        FROM
                                ttrss_user_entries,ttrss_entries,ttrss_feeds
+                       LEFT JOIN
+                               ttrss_feed_categories ON (cat_id = ttrss_feed_categories.id)
                        WHERE
                                ref_id = ttrss_entries.id AND feed_id = ttrss_feeds.id
                                AND include_in_digest = true
                                AND $interval_query
                                AND ttrss_user_entries.owner_uid = $user_id
                                AND unread = true
-                       ORDER BY ttrss_feeds.title, date_updated DESC
+                               AND score >= 0
+                       ORDER BY ttrss_feed_categories.title, ttrss_feeds.title, score DESC, date_updated DESC
                        LIMIT $limit");
 
                $cur_feed_title = "";
                        $updated = make_local_datetime($link, $line['last_updated'], false,
                                $user_id);
 
+/*                     if ($line["score"] != 0) {
+                               if ($line["score"] > 0) $line["score"] = '+' . $line["score"];
+
+                               $line["title"] .= " (".$line['score'].")";
+                       } */
+
+                       if (get_pref($link, 'ENABLE_FEED_CATS', $user_id)) {
+                               if (!$line['cat_title']) $line['cat_title'] = __("Uncategorized");
+
+                               $line['feed_title'] = $line['cat_title'] . " / " . $line['feed_title'];
+                       }
+
                        $tpl->setVariable('FEED_TITLE', $line["feed_title"]);
                        $tpl->setVariable('ARTICLE_TITLE', $line["title"]);
                        $tpl->setVariable('ARTICLE_LINK', $line["link"]);
                        $tpl->setVariable('ARTICLE_UPDATED', $updated);
                        $tpl->setVariable('ARTICLE_EXCERPT',
-                               truncate_string(strip_tags($line["excerpt"]), 100));
+                               truncate_string(strip_tags($line["content"]), 300));
+//                     $tpl->setVariable('ARTICLE_CONTENT',
+//                             strip_tags($article_content));
 
                        $tpl->addBlock('article');
 
                                $rv['content'] .= "<img src=\"".theme_image($link, 'images/digest_checkbox.png')."\"
                                                class='tagsPic' style=\"cursor : pointer\"
                                                onclick=\"closeArticlePanel($id)\"
-                                               alt='Zoom' title='".__('Close this panel')."'>";
+                                               title='".__('Close article')."'>";
 
                        } else {
                                $tags_str = strip_tags($tags_str);
                                        $rv['content'] .= "&nbsp;";
 
                                        $rv['content'] .= "<a target='_blank' href='" . htmlspecialchars($tmp_line['feed_url']) . "'>";
-                                       $rv['content'] .= "<img title='".__('Feed URL')."'class='tinyFeedIcon' src='images/pub_set.gif'></a>";
+                                       $rv['content'] .= "<img title='".__('Feed URL')."'class='tinyFeedIcon' src='images/pub_set.png'></a>";
 
                                        $rv['content'] .= "</div>";
                                }
                return $url_path;
        } // function add_feed_url
 
-       /**
-        * Encrypt a password in SHA1.
-        *
-        * @param string $pass The password to encrypt.
-        * @param string $login A optionnal login.
-        * @return string The encrypted password.
-        */
-       function encrypt_password($pass, $login = '') {
-               if ($login) {
-                       return "SHA1X:" . sha1("$login:$pass");
+       function encrypt_password($pass, $salt = '', $mode2 = false) {
+               if ($salt && $mode2) {
+                       return "MODE2:" . hash('sha256', $salt . $pass);
+               } else if ($salt) {
+                       return "SHA1X:" . sha1("$salt:$pass");
                } else {
                        return "SHA1:" . sha1($pass);
                }
        } // function encrypt_password
 
-
        function sanitize_article_content($text) {
                # we don't support CDATA sections in articles, they break our own escaping
                $text = preg_replace("/\[\[CDATA/", "", $text);
                                inverse,
                                action_param,
                                filter_param
-                               FROM ttrss_filters,ttrss_filter_types,ttrss_filter_actions WHERE
+                               FROM ttrss_filters
+                                       LEFT JOIN ttrss_feeds ON (ttrss_feeds.id = '$feed'),
+                                       ttrss_filter_types,ttrss_filter_actions
+                               WHERE
                                        enabled = true AND
                                        $ftype_query_part
-                                       owner_uid = $owner_uid AND
+                                       ttrss_filters.owner_uid = $owner_uid AND
                                        ttrss_filter_types.id = filter_type AND
                                        ttrss_filter_actions.id = action_id AND
-                                       (feed_id IS NULL OR feed_id = '$feed') ORDER BY reg_exp");
+                                       ((cat_filter = true AND ttrss_feeds.cat_id = ttrss_filters.cat_id) OR
+                                       (cat_filter = true AND ttrss_feeds.cat_id IS NULL AND
+                                               ttrss_filters.cat_id IS NULL) OR
+                                       (cat_filter = false AND (feed_id IS NULL OR feed_id = '$feed')))
+                               ORDER BY reg_exp");
 
                        while ($line = db_fetch_assoc($result)) {
+
                                if (!$filters[$line["name"]]) $filters[$line["name"]] = array();
                                        $filter["reg_exp"] = $line["reg_exp"];
                                        $filter["action"] = $line["action"];
                db_query($link, "COMMIT");
        }
 
-       function label_create($link, $caption) {
+       function label_create($link, $caption, $fg_color = '', $bg_color = '', $owner_uid) {
+
+               if (!$owner_uid) $owner_uid = $_SESSION['uid'];
 
                db_query($link, "BEGIN");
 
                $result = false;
 
                $result = db_query($link, "SELECT id FROM ttrss_labels2
-                       WHERE caption = '$caption' AND owner_uid =  ". $_SESSION["uid"]);
+                       WHERE caption = '$caption' AND owner_uid = $owner_uid");
 
                if (db_num_rows($result) == 0) {
                        $result = db_query($link,
-                               "INSERT INTO ttrss_labels2 (caption,owner_uid)
-                                       VALUES ('$caption', '".$_SESSION["uid"]."')");
+                               "INSERT INTO ttrss_labels2 (caption,owner_uid,fg_color,bg_color)
+                                       VALUES ('$caption', '$owner_uid', '$fg_color', '$bg_color')");
 
                        $result = db_affected_rows($link, $result) != 0;
                }
 
                        if ($cat_id == -4 || $cat_id == -3) {
                                $result = db_query($link, "SELECT
-                                       id, feed_url, cat_id, title, ".
+                                       id, feed_url, cat_id, title, order_id, ".
                                                SUBSTRING_FOR_DATE."(last_updated,1,19) AS last_updated
                                                FROM ttrss_feeds WHERE owner_uid = " . $_SESSION["uid"] .
                                                " ORDER BY cat_id, title " . $limit_qpart);
                                        $cat_qpart = "cat_id IS NULL";
 
                                $result = db_query($link, "SELECT
-                                       id, feed_url, cat_id, title, ".
+                                       id, feed_url, cat_id, title, order_id, ".
                                                SUBSTRING_FOR_DATE."(last_updated,1,19) AS last_updated
                                                FROM ttrss_feeds WHERE
                                                $cat_qpart AND owner_uid = " . $_SESSION["uid"] .
                                                        "unread" => (int)$unread,
                                                        "has_icon" => $has_icon,
                                                        "cat_id" => (int)$line["cat_id"],
-                                                       "last_updated" => strtotime($line["last_updated"])
+                                                       "last_updated" => strtotime($line["last_updated"]),
+                                                       "order_id" => (int) $line["order_id"],
                                                );
 
                                        array_push($feeds, $row);
 
        function api_get_headlines($link, $feed_id, $limit, $offset,
                                $filter, $is_cat, $show_excerpt, $show_content, $view_mode, $order,
-                               $include_attachments, $since_id) {
-
-                       /* do not rely on params below */
-
-                       $search = db_escape_string($_REQUEST["search"]);
-                       $search_mode = db_escape_string($_REQUEST["search_mode"]);
-                       $match_on = db_escape_string($_REQUEST["match_on"]);
+                               $include_attachments, $since_id,
+                               $search = "", $search_mode = "", $match_on = "") {
 
                        $qfh_ret = queryFeedHeadlines($link, $feed_id, $limit,
                                $view_mode, $is_cat, $search, $search_mode, $match_on,
 
                                $headline_row["labels"] = $labels;
 
+                               $headline_row["feed_title"] = $line["feed_title"];
+
                                array_push($headlines, $headline_row);
                        }
 
         * @return string Absolute URL
         */
        function rewrite_relative_url($url, $rel_url) {
-               if (strpos($rel_url, "://") !== false) {
+               if (strpos($rel_url, "magnet:") === 0) {
+                       return $rel_url;
+               } else if (strpos($rel_url, "://") !== false) {
                        return $rel_url;
                } else if (strpos($rel_url, "/") === 0)
                {
 
        }
 
-       function rewrite_urls($line) {
+/*     function rewrite_urls($line) {
                global $url_regex;
 
                $urls = null;
                        "<a target=\"_blank\" href=\"\\1\">\\1</a>", $line);
 
                return $result;
+       } */
+
+       function rewrite_urls($html) {
+               libxml_use_internal_errors(true);
+
+               $charset_hack = '<head>
+                       <meta http-equiv="Content-Type" content="text/html; charset=utf-8"/>
+               </head>';
+
+               $doc = new DOMDocument();
+               $doc->loadHTML($charset_hack . $html);
+               $xpath = new DOMXPath($doc);
+
+               $entries = $xpath->query('//*/text()');
+
+               foreach ($entries as $entry) {
+                       if (strstr($entry->wholeText, "://") !== false) {
+                               $text = preg_replace("/((?<!=.)((http|https|ftp)+):\/\/[^ ,!]+)/i",
+                                       "<a target=\"_blank\" href=\"\\1\">\\1</a>", $entry->wholeText);
+
+                               if ($text != $entry->wholeText) {
+                                       $cdoc = new DOMDocument();
+                                       $cdoc->loadHTML($charset_hack . $text);
+
+
+                                       foreach ($cdoc->childNodes as $cnode) {
+                                               $cnode = $doc->importNode($cnode, true);
+
+                                               if ($cnode) {
+                                                       $entry->parentNode->insertBefore($cnode);
+                                               }
+                                       }
+
+                                       $entry->parentNode->removeChild($entry);
+
+                               }
+                       }
+               }
+
+               $node = $doc->getElementsByTagName('body')->item(0);
+
+               // http://tt-rss.org/forum/viewtopic.php?f=1&t=970
+               if ($node)
+                       return $doc->saveXML($node, LIBXML_NOEMPTYTAG);
+               else
+                       return $html;
        }
 
        function filter_to_sql($filter) {
                $query = "";
 
-               if (DB_TYPE == "pgsql")
-                       $reg_qpart = "~";
-               else
-                       $reg_qpart = "REGEXP";
+               $regexp_valid = preg_match('/' . $filter['reg_exp'] . '/',
+                       $filter['reg_exp']) !== FALSE;
 
-               switch ($filter["type"]) {
-                       case "title":
-                               $query = "LOWER(ttrss_entries.title) $reg_qpart LOWER('".
-                                       $filter['reg_exp'] . "')";
-                               break;
-                       case "content":
-                               $query = "LOWER(ttrss_entries.content) $reg_qpart LOWER('".
-                                       $filter['reg_exp'] . "')";
-                               break;
-                       case "both":
-                               $query = "LOWER(ttrss_entries.title) $reg_qpart LOWER('".
-                                       $filter['reg_exp'] . "') OR LOWER(" .
-                                       "ttrss_entries.content) $reg_qpart LOWER('" . $filter['reg_exp'] . "')";
-                               break;
-                       case "tag":
-                               $query = "LOWER(ttrss_user_entries.tag_cache) $reg_qpart LOWER('".
-                                       $filter['reg_exp'] . "')";
-                               break;
-                       case "link":
-                               $query = "LOWER(ttrss_entries.link) $reg_qpart LOWER('".
-                                       $filter['reg_exp'] . "')";
-                               break;
-                       case "date":
+               if ($regexp_valid) {
 
-                               if ($filter["filter_param"] == "before")
-                                       $cmp_qpart = "<";
-                               else
-                                       $cmp_qpart = ">=";
+                       if (DB_TYPE == "pgsql")
+                               $reg_qpart = "~";
+                       else
+                               $reg_qpart = "REGEXP";
 
-                               $timestamp = date("Y-m-d H:N:s", strtotime($filter["reg_exp"]));
-                               $query = "ttrss_entries.date_entered $cmp_qpart '$timestamp'";
-                               break;
-                       case "author":
-                               $query = "LOWER(ttrss_entries.author) $reg_qpart LOWER('".
-                                       $filter['reg_exp'] . "')";
-                               break;
-               }
+                       switch ($filter["type"]) {
+                               case "title":
+                                       $query = "LOWER(ttrss_entries.title) $reg_qpart LOWER('".
+                                               $filter['reg_exp'] . "')";
+                                       break;
+                               case "content":
+                                       $query = "LOWER(ttrss_entries.content) $reg_qpart LOWER('".
+                                               $filter['reg_exp'] . "')";
+                                       break;
+                               case "both":
+                                       $query = "LOWER(ttrss_entries.title) $reg_qpart LOWER('".
+                                               $filter['reg_exp'] . "') OR LOWER(" .
+                                               "ttrss_entries.content) $reg_qpart LOWER('" . $filter['reg_exp'] . "')";
+                                       break;
+                               case "tag":
+                                       $query = "LOWER(ttrss_user_entries.tag_cache) $reg_qpart LOWER('".
+                                               $filter['reg_exp'] . "')";
+                                       break;
+                               case "link":
+                                       $query = "LOWER(ttrss_entries.link) $reg_qpart LOWER('".
+                                               $filter['reg_exp'] . "')";
+                                       break;
+                               case "date":
 
-               if ($filter["inverse"])
-                       $query = "NOT ($query)";
+                                       if ($filter["filter_param"] == "before")
+                                               $cmp_qpart = "<";
+                                       else
+                                               $cmp_qpart = ">=";
 
-               if ($query) {
-                       if (DB_TYPE == "pgsql") {
-                               $query = " ($query) AND ttrss_entries.date_entered > NOW() - INTERVAL '14 days'";
-                       } else {
-                               $query = " ($query) AND ttrss_entries.date_entered > DATE_SUB(NOW(), INTERVAL 14 DAY)";
+                                       $timestamp = date("Y-m-d H:N:s", strtotime($filter["reg_exp"]));
+                                       $query = "ttrss_entries.date_entered $cmp_qpart '$timestamp'";
+                                       break;
+                               case "author":
+                                       $query = "LOWER(ttrss_entries.author) $reg_qpart LOWER('".
+                                               $filter['reg_exp'] . "')";
+                                       break;
                        }
-                       $query .= " AND ";
-               }
 
+                       if ($filter["inverse"])
+                               $query = "NOT ($query)";
+
+                       if ($query) {
+                               if (DB_TYPE == "pgsql") {
+                                       $query = " ($query) AND ttrss_entries.date_entered > NOW() - INTERVAL '14 days'";
+                               } else {
+                                       $query = " ($query) AND ttrss_entries.date_entered > DATE_SUB(NOW(), INTERVAL 14 DAY)";
+                               }
+                               $query .= " AND ";
+                       }
 
-               return $query;
+                       return $query;
+               } else {
+                       return false;
+               }
        }
 
        // Status codes:
                return $rv;
        }
 
+       if (!function_exists('gzdecode')) {
+               function gzdecode($string) { // no support for 2nd argument
+                       return file_get_contents('compress.zlib://data:who/cares;base64,'.
+                               base64_encode($string));
+               }
+       }
+
+       function perform_data_import($link, $filename, $owner_uid) {
+
+               $num_imported = 0;
+               $num_processed = 0;
+               $num_feeds_created = 0;
+
+               $doc = @DOMDocument::load($filename);
+
+               if (!$doc) {
+                       $contents = file_get_contents($filename);
+
+                       if ($contents) {
+                               $data = @gzuncompress($contents);
+                       }
+
+                       if (!$data) {
+                               $data = @gzdecode($contents);
+                       }
+
+                       if ($data)
+                               $doc = DOMDocument::loadXML($data);
+               }
+
+               if ($doc) {
+
+                       $xpath = new DOMXpath($doc);
+
+                       $container = $doc->firstChild;
+
+                       if ($container && $container->hasAttribute('schema-version')) {
+                               $schema_version = $container->getAttribute('schema-version');
+
+                               if ($schema_version != SCHEMA_VERSION) {
+                                       print "<p>" .__("Could not import: incorrect schema version.") . "</p>";
+                                       return;
+                               }
+
+                       } else {
+                               print "<p>" . __("Could not import: unrecognized document format.") . "</p>";
+                               return;
+                       }
+
+                       $articles = $xpath->query("//article");
+
+                       foreach ($articles as $article_node) {
+                               if ($article_node->childNodes) {
+
+                                       $ref_id = 0;
+
+                                       $article = array();
+
+                                       foreach ($article_node->childNodes as $child) {
+                                               if ($child->nodeName != 'label_cache')
+                                                       $article[$child->nodeName] = db_escape_string($child->nodeValue);
+                                               else
+                                                       $article[$child->nodeName] = $child->nodeValue;
+                                       }
+
+                                       //print_r($article);
+
+                                       if ($article['guid']) {
+
+                                               ++$num_processed;
+
+                                               //db_query($link, "BEGIN");
+
+                                               //print 'GUID:' . $article['guid'] . "\n";
+
+                                               $result = db_query($link, "SELECT id FROM ttrss_entries
+                                                       WHERE guid = '".$article['guid']."'");
+
+                                               if (db_num_rows($result) == 0) {
+
+                                                       $result = db_query($link,
+                                                               "INSERT INTO ttrss_entries
+                                                                       (title,
+                                                                       guid,
+                                                                       link,
+                                                                       updated,
+                                                                       content,
+                                                                       content_hash,
+                                                                       no_orig_date,
+                                                                       date_updated,
+                                                                       date_entered,
+                                                                       comments,
+                                                                       num_comments,
+                                                                       author)
+                                                               VALUES
+                                                                       ('".$article['title']."',
+                                                                       '".$article['guid']."',
+                                                                       '".$article['link']."',
+                                                                       '".$article['updated']."',
+                                                                       '".$article['content']."',
+                                                                       '".sha1($article['content'])."',
+                                                                       false,
+                                                                       NOW(),
+                                                                       NOW(),
+                                                                       '',
+                                                                       '0',
+                                                                       '')");
+
+                                                       $result = db_query($link, "SELECT id FROM ttrss_entries
+                                                               WHERE guid = '".$article['guid']."'");
+
+                                                       if (db_num_rows($result) != 0) {
+                                                               $ref_id = db_fetch_result($result, 0, "id");
+                                                       }
+
+                                               } else {
+                                                       $ref_id = db_fetch_result($result, 0, "id");
+                                               }
+
+                                               //print "Got ref ID: $ref_id\n";
+
+                                               if ($ref_id) {
+
+                                                       $feed_url = $article['feed_url'];
+                                                       $feed_title = $article['feed_title'];
+
+                                                       $feed = 'NULL';
+
+                                                       if ($feed_url && $feed_title) {
+                                                               $result = db_query($link, "SELECT id FROM ttrss_feeds
+                                                                       WHERE feed_url = '$feed_url' AND owner_uid = '$owner_uid'");
+
+                                                               if (db_num_rows($result) != 0) {
+                                                                       $feed = db_fetch_result($result, 0, "id");
+                                                               } else {
+                                                                       // try autocreating feed in Uncategorized...
+
+                                                                       $result = db_query($link, "INSERT INTO ttrss_feeds (owner_uid,
+                                                                               feed_url, title) VALUES ($owner_uid, '$feed_url', '$feed_title')");
+
+                                                                       $result = db_query($link, "SELECT id FROM ttrss_feeds
+                                                                               WHERE feed_url = '$feed_url' AND owner_uid = '$owner_uid'");
+
+                                                                       if (db_num_rows($result) != 0) {
+                                                                               ++$num_feeds_created;
+
+                                                                               $feed = db_fetch_result($result, 0, "id");
+                                                                       }
+                                                               }
+                                                       }
+
+                                                       if ($feed != 'NULL')
+                                                               $feed_qpart = "feed_id = $feed";
+                                                       else
+                                                               $feed_qpart = "feed_id IS NULL";
+
+                                                       //print "$ref_id / $feed / " . $article['title'] . "\n";
+
+                                                       $result = db_query($link, "SELECT int_id FROM ttrss_user_entries
+                                                               WHERE ref_id = '$ref_id' AND owner_uid = '$owner_uid' AND $feed_qpart");
+
+                                                       if (db_num_rows($result) == 0) {
+
+                                                               $marked = bool_to_sql_bool(sql_bool_to_bool($article['marked']));
+                                                               $published = bool_to_sql_bool(sql_bool_to_bool($article['published']));
+                                                               $score = (int) $article['score'];
+
+                                                               $tag_cache = $article['tag_cache'];
+                                                               $label_cache = db_escape_string($article['label_cache']);
+                                                               $note = $article['note'];
+
+                                                               //print "Importing " . $article['title'] . "<br/>";
+
+                                                               ++$num_imported;
+
+                                                               $result = db_query($link,
+                                                                       "INSERT INTO ttrss_user_entries
+                                                                       (ref_id, owner_uid, feed_id, unread, last_read, marked,
+                                                                               published, score, tag_cache, label_cache, uuid, note)
+                                                                       VALUES ($ref_id, $owner_uid, $feed, false,
+                                                                               NULL, $marked, $published, $score, '$tag_cache',
+                                                                                       '$label_cache', '', '$note')");
+
+                                                               $label_cache = json_decode($label_cache, true);
+
+                                                               if (is_array($label_cache) && $label_cache["no-labels"] != 1) {
+                                                                       foreach ($label_cache as $label) {
+
+                                                                               label_create($link, $label[1],
+                                                                                       $label[2], $label[3], $owner_uid);
+
+                                                                               label_add_article($link, $ref_id, $label[1], $owner_uid);
+
+                                                                       }
+                                                               }
+
+                                                               //db_query($link, "COMMIT");
+                                                       }
+                                               }
+                                       }
+                               }
+                       }
+
+                       print "<p>" .
+                               T_sprintf("Finished: %d articles processed, %d imported, %d feeds created.",
+                                       $num_processed, $num_imported, $num_feeds_created) .
+                                       "</p>";
+
+               } else {
+
+                       print "<p>" . __("Could not load XML document.") . "</p>";
+
+               }
+       }
+
+       function get_random_bytes($length) {
+               if (function_exists('openssl_random_pseudo_bytes')) {
+                       return openssl_random_pseudo_bytes($length);
+               } else {
+                       $output = "";
+
+                       for ($i = 0; $i < $length; $i++)
+                               $output .= chr(mt_rand(0, 255));
+
+                       return $output;
+               }
+       }
 ?>