<?php
define('EXPECTED_CONFIG_VERSION', 26);
- define('SCHEMA_VERSION', 97);
+ define('SCHEMA_VERSION', 99);
$fetch_last_error = false;
if (file_exists($file)) {
require $file;
}
+
}
mb_internal_encoding("UTF-8");
$lang = _TRANSLATION_OVERRIDE_DEFAULT;
}
- if ($_COOKIE["ttrss_lang"] && $_COOKIE["ttrss_lang"] != "auto") {
- $lang = $_COOKIE["ttrss_lang"];
- }
-
/* In login action of mobile version */
if ($_POST["language"] && defined('MOBILE_VERSION')) {
$lang = $_POST["language"];
- $_COOKIE["ttrss_lang"] = $lang;
+ } else {
+ $lang = $_SESSION["language"];
}
if ($lang) {
ini_set('user_agent', SELF_USER_AGENT);
require_once 'lib/pubsubhubbub/publisher.php';
-
- $purifier = false;
+ require_once 'lib/htmLawed.php';
$tz_offset = -1;
$utc_tz = new DateTimeZone('UTC');
print "</select>";
}
- function get_article_filters($filters, $title, $content, $link, $timestamp, $author, $tags) {
- $matches = array();
-
- foreach ($filters as $filter) {
- $match_any_rule = $filter["match_any_rule"];
- $filter_match = false;
-
- foreach ($filter["rules"] as $rule) {
- $match = false;
- $reg_exp = $rule["reg_exp"];
-
- if (!$reg_exp)
- continue;
-
- switch ($rule["type"]) {
- case "title":
- $match = @preg_match("/$reg_exp/i", $title);
- break;
- case "content":
- $match = @preg_match("/$reg_exp/i", $content);
- break;
- case "both":
- $match = (@preg_match("/$reg_exp/i", $title) || @preg_match("/$reg_exp/i", $title));
- break;
- case "link":
- $match = @preg_match("/$reg_exp/i", $link);
- break;
- case "author":
- $match = @preg_match("/$reg_exp/i", $author);
- break;
- case "tag":
- $tag_string = join(",", $tags);
- $match = @preg_match("/$reg_exp/i", $tag_string);
- break;
- }
-
- if ($match_any_rule) {
- if ($match) {
- $filter_match = true;
- break;
- }
- } else {
- $filter_match = $match;
- if (!$match) {
- break;
- }
- }
- }
-
- if ($filter_match) {
- foreach ($filter["actions"] AS $action) {
- array_push($matches, $action);
- }
- }
- }
-
- return $matches;
- }
-
- function find_article_filter($filters, $filter_name) {
- foreach ($filters as $f) {
- if ($f["type"] == $filter_name) {
- return $f;
- };
- }
- return false;
- }
-
- function find_article_filters($filters, $filter_name) {
- $results = array();
-
- foreach ($filters as $f) {
- if ($f["type"] == $filter_name) {
- array_push($results, $f);
- };
- }
- return $results;
- }
-
- function calculate_article_score($filters) {
- $score = 0;
-
- foreach ($filters as $f) {
- if ($f["type"] == "score") {
- $score += $f["param"];
- };
- }
- return $score;
- }
-
- function assign_article_to_labels($link, $id, $filters, $owner_uid) {
- foreach ($filters as $f) {
- if ($f["type"] == "label") {
- label_add_article($link, $id, $f["param"], $owner_uid);
- };
- }
- }
-
function getmicrotime() {
list($usec, $sec) = explode(" ",microtime());
return ((float)$usec + (float)$sec);
/* bump login timestamp */
db_query($link, "UPDATE ttrss_users SET last_login = NOW() WHERE id = " .
$_SESSION["uid"]);
-
- if ($_SESSION["language"] && SESSION_COOKIE_LIFETIME > 0) {
- setcookie("ttrss_lang", $_SESSION["language"],
- time() + SESSION_COOKIE_LIFETIME);
- }
- }
- }
- }
-
-
- /* function login_sequence($link, $mobile = false) {
- $_SESSION["prefs_cache"] = array();
-
- if (!SINGLE_USER_MODE) {
-
- $login_action = $_POST["login_action"];
-
- # try to authenticate user if called from login form
- if ($login_action == "do_login") {
- $login = db_escape_string($_POST["login"]);
- $password = $_POST["password"];
- $remember_me = $_POST["remember_me"];
-
- if (authenticate_user($link, $login, $password)) {
- $_POST["password"] = "";
-
- $_SESSION["language"] = $_POST["language"];
- $_SESSION["ref_schema_version"] = get_schema_version($link, true);
- $_SESSION["bw_limit"] = !!$_POST["bw_limit"];
-
- if ($_POST["profile"]) {
-
- $profile = db_escape_string($_POST["profile"]);
-
- $result = db_query($link, "SELECT id FROM ttrss_settings_profiles
- WHERE id = '$profile' AND owner_uid = " . $_SESSION["uid"]);
-
- if (db_num_rows($result) != 0) {
- $_SESSION["profile"] = $profile;
- $_SESSION["prefs_cache"] = array();
- }
- }
-
- if ($_REQUEST['return']) {
- header("Location: " . $_REQUEST['return']);
- } else {
- header("Location: " . $_SERVER["REQUEST_URI"]);
- }
-
- exit;
-
- return;
- } else {
- $_SESSION["login_error_msg"] = __("Incorrect username or password");
- }
}
- if (!$_SESSION["uid"] || !validate_session($link)) {
-
- if (AUTH_AUTO_LOGIN && authenticate_user($link, null, null)) {
- $_SESSION["ref_schema_version"] = get_schema_version($link, true);
- } else {
- authenticate_user($link, null, null, true);
- render_login_form($link, $mobile);
- exit;
- }
- } else {
- // bump login timestamp
- db_query($link, "UPDATE ttrss_users SET last_login = NOW() WHERE id = " .
- $_SESSION["uid"]);
-
- if ($_SESSION["language"] && SESSION_COOKIE_LIFETIME > 0) {
- setcookie("ttrss_lang", $_SESSION["language"],
- time() + SESSION_COOKIE_LIFETIME);
- }
-
- // try to remove possible duplicates from feed counter cache
-// ccache_cleanup($link, $_SESSION["uid"]);
+ if ($_SESSION["uid"] && $_SESSION["language"] && SESSION_COOKIE_LIFETIME > 0) {
+ setcookie("ttrss_lang", $_SESSION["language"],
+ time() + SESSION_COOKIE_LIFETIME);
}
-
- } else {
- return authenticate_user($link, "admin", null);
}
- } */
+ }
function truncate_string($str, $max_len, $suffix = '…') {
if (mb_strlen($str, "utf-8") > $max_len - 3) {
if ($feed >= 0) {
if ($feed > 0) {
- $cat_qpart = "cat_id = '$feed'";
+ $children = getChildCategories($link, $feed, $owner_uid);
+ array_push($children, $feed);
+
+ $children = join(",", $children);
+
+ $cat_qpart = "cat_id IN ($children)";
} else {
$cat_qpart = "cat_id IS NULL";
}
- $tmp_result = db_query($link, "SELECT id
- FROM ttrss_feeds WHERE $cat_qpart AND owner_uid = $owner_uid");
-
- while ($tmp_line = db_fetch_assoc($tmp_result)) {
-
- $tmp_feed = $tmp_line["id"];
+ db_query($link, "UPDATE ttrss_user_entries
+ SET unread = false,last_read = NOW()
+ WHERE feed_id IN (SELECT id FROM ttrss_feeds WHERE $cat_qpart)
+ AND $ref_check_qpart
+ AND owner_uid = $owner_uid");
- db_query($link, "UPDATE ttrss_user_entries
- SET unread = false,last_read = NOW()
- WHERE feed_id = '$tmp_feed'
- AND $ref_check_qpart
- AND owner_uid = $owner_uid");
- }
} else if ($feed == -2) {
db_query($link, "UPDATE ttrss_user_entries
$override_order = "updated DESC";
- $filter_query_part = filter_to_sql($filter) . " AND";
+ $filter_query_part = filter_to_sql($link, $filter, $owner_uid);
+
+ // Try to check if SQL regexp implementation chokes on a valid regexp
+ $result = db_query($link, "SELECT true AS true FROM ttrss_entries,
+ ttrss_user_entries, ttrss_feeds, ttrss_feed_categories
+ WHERE $filter_query_part LIMIT 1", false);
+
+ $test = db_fetch_result($result, 0, "true");
+
+ if (!$test) {
+ $filter_query_part = "false AND";
+ } else {
+ $filter_query_part .= " AND";
+ }
+
} else {
$filter_query_part = "";
}
}
}
- $content_query_part = "content as content_preview,";
+ $content_query_part = "content as content_preview, cached_content, ";
if (is_numeric($feed)) {
$offset_query_part = "OFFSET $offset";
}
+ // proper override_order applied above
if ($vfeed_query_part && get_pref($link, 'VFEED_GROUP_BY_FEED', $owner_uid)) {
if (!$override_order) {
$order_by = "ttrss_feeds.title, $order_by";
+ } else {
+ $order_by = "ttrss_feeds.title, $override_order";
}
}
}
function sanitize($link, $str, $force_strip_tags = false, $owner = false, $site_url = false) {
- global $purifier;
-
if (!$owner) $owner = $_SESSION["uid"];
$res = trim($str); if (!$res) return '';
- // create global Purifier object if needed
- if (!$purifier) {
- require_once 'lib/htmlpurifier/library/HTMLPurifier.auto.php';
-
- $config = HTMLPurifier_Config::createDefault();
-
- $allowed = "p,a[href],i,em,b,strong,code,pre,blockquote,br,img[src|alt|title|align|hspace],ul,ol,li,h1,h2,h3,h4,s,object[classid|type|id|name|width|height|codebase],param[name|value],table,tr,td,span[class]";
-
- $config->set('HTML.SafeObject', true);
- @$config->set('HTML', 'Allowed', $allowed);
- $config->set('Output.FlashCompat', true);
- $config->set('Attr.EnableID', true);
- if (!defined('MOBILE_VERSION')) {
- @$config->set('Cache', 'SerializerPath', CACHE_DIR . "/htmlpurifier");
- } else {
- @$config->set('Cache', 'SerializerPath', "../" . CACHE_DIR . "/htmlpurifier");
- }
-
- $config->set('Filter.YouTube', true);
-
- $purifier = new HTMLPurifier($config);
- }
-
- $res = $purifier->purify($res);
+ $config = array('safe' => 1, 'deny_attribute' => 'style, width, height, class, id', 'comment' => 1, 'cdata' => 1);
+ $res = htmLawed($res, $config);
if (get_pref($link, "STRIP_IMAGES", $owner)) {
$res = preg_replace('/<img[^>]+>/is', '', $res);
//if (!$zoom_mode) { print "<article id='$id'><![CDATA["; };
- $result = db_query($link, "SELECT rtl_content, always_display_enclosures FROM ttrss_feeds
+ $result = db_query($link, "SELECT rtl_content, always_display_enclosures, cache_content FROM ttrss_feeds
WHERE id = '$feed_id' AND owner_uid = $owner_uid");
if (db_num_rows($result) == 1) {
$rtl_content = sql_bool_to_bool(db_fetch_result($result, 0, "rtl_content"));
$always_display_enclosures = sql_bool_to_bool(db_fetch_result($result, 0, "always_display_enclosures"));
+ $cache_content = sql_bool_to_bool(db_fetch_result($result, 0, "cache_content"));
} else {
$rtl_content = false;
$always_display_enclosures = false;
+ $cache_content = false;
}
if ($rtl_content) {
tag_cache,
author,
orig_feed_id,
- note
+ note,
+ cached_content
FROM ttrss_entries,ttrss_user_entries
WHERE id = '$id' AND ref_id = id AND owner_uid = $owner_uid");
if ($num_comments > 0) {
if ($line["comments"]) {
- $comments_url = $line["comments"];
+ $comments_url = htmlspecialchars($line["comments"]);
} else {
- $comments_url = $line["link"];
+ $comments_url = htmlspecialchars($line["link"]);
}
$entry_comments = "<a target='_blank' href=\"$comments_url\">$num_comments comments</a>";
} else {
if ($line["comments"] && $line["link"] != $line["comments"]) {
- $entry_comments = "<a target='_blank' href=\"".$line["comments"]."\">comments</a>";
+ $entry_comments = "<a target='_blank' href=\"".htmlspecialchars($line["comments"])."\">comments</a>";
}
}
</head><body>";
}
- $title_escaped = db_escape_string($line['title']);
+ $title_escaped = htmlspecialchars($line['title']);
$rv['content'] .= "<div id=\"PTITLE-$id\" style=\"display : none\">" .
truncate_string(strip_tags($line['title']), 15) . "</div>";
$rv['content'] .= "<div class='postTitle'><a target='_blank'
title=\"".htmlspecialchars($line['title'])."\"
href=\"" .
- $line["link"] . "\">" .
+ htmlspecialchars($line["link"]) . "\">" .
$line["title"] .
"<span class='author'>$entry_author</span></a></div>";
} else {
onclick=\"postOpenInNewTab(event, $id)\"
alt='Zoom' title='".__('Open article in new tab')."'>";
- $button_plugins = explode(",", ARTICLE_BUTTON_PLUGINS);
-
- foreach ($button_plugins as $p) {
- $pclass = trim("button_${p}");
+ global $pluginhost;
- if (class_exists($pclass)) {
- $plugin = new $pclass($link);
- $rv['content'] .= $plugin->render($id, $line);
- }
+ foreach ($pluginhost->get_hooks($pluginhost::HOOK_ARTICLE_BUTTON) as $p) {
+ $rv['content'] .= $p->hook_article_button($line);
}
$rv['content'] .= "<img src=\"".theme_image($link, 'images/digest_checkbox.png')."\"
}
}
+ if ($cache_content && $line["cached_content"] != "") {
+ $line["content"] =& $line["cached_content"];
+ }
+
$article_content = sanitize($link, $line["content"], false, $owner_uid,
$feed_site_url);
}
function get_self_url_prefix() {
- return SELF_URL_PATH;
+ if (strrpos(SELF_URL_PATH, "/") === strlen(SELF_URL_PATH)-1) {
+ return substr(SELF_URL_PATH, 0, strlen(SELF_URL_PATH)-1);
+ } else {
+ return SELF_URL_PATH;
+ }
}
function opml_publish_url($link){
}
} // function encrypt_password
- function sanitize_article_content($text) {
- # we don't support CDATA sections in articles, they break our own escaping
- $text = preg_replace("/\[\[CDATA/", "", $text);
- $text = preg_replace("/\]\]\>/", "", $text);
- return $text;
- }
-
function load_filters($link, $feed_id, $owner_uid, $action_id = false) {
$filters = array();
db_query($link, "SET NAMES " . MYSQL_CHARSET);
}
}
+
+ global $pluginhost;
+
+ $pluginhost = new PluginHost($link);
+ $pluginhost->load(PLUGINS);
+
return true;
} else {
print "Unable to connect to database:" . db_last_error();
}
}
- function get_article_labels($link, $id) {
+ function get_article_labels($link, $id, $owner_uid = false) {
$rv = array();
+ if (!$owner_uid) $owner_uid = $_SESSION["uid"];
$result = db_query($link, "SELECT label_cache FROM
ttrss_user_entries WHERE ref_id = '$id' AND owner_uid = " .
- $_SESSION["uid"]);
+ $owner_uid);
- $label_cache = db_fetch_result($result, 0, "label_cache");
-
- if ($label_cache) {
+ if (db_num_rows($result) > 0) {
+ $label_cache = db_fetch_result($result, 0, "label_cache");
- $label_cache = json_decode($label_cache, true);
+ if ($label_cache) {
+ $label_cache = json_decode($label_cache, true);
- if ($label_cache["no-labels"] == 1)
- return $rv;
- else
- return $label_cache;
+ if ($label_cache["no-labels"] == 1)
+ return $rv;
+ else
+ return $label_cache;
+ }
}
$result = db_query($link,
FROM ttrss_labels2, ttrss_user_labels2
WHERE id = label_id
AND article_id = '$id'
- AND owner_uid = ".$_SESSION["uid"] . "
+ AND owner_uid = ". $owner_uid . "
ORDER BY caption");
while ($line = db_fetch_assoc($result)) {
}
if (count($rv) > 0)
- label_update_cache($link, $id, $rv);
+ label_update_cache($link, $owner_uid, $id, $rv);
else
- label_update_cache($link, $id, array("no-labels" => 1));
+ label_update_cache($link, $owner_uid, $id, array("no-labels" => 1));
return $rv;
}
}
}
- function label_update_cache($link, $id, $labels = false, $force = false) {
+ function get_all_labels($link, $owner_uid) {
+ $rv = array();
+
+ $result = db_query($link, "SELECT fg_color, bg_color, caption FROM ttrss_labels2 WHERE owner_uid = " . $owner_uid);
+
+ while ($line = db_fetch_assoc($result)) {
+ array_push($rv, $line);
+ }
+
+ return $rv;
+ }
+
+ function label_update_cache($link, $owner_uid, $id, $labels = false, $force = false) {
if ($force)
label_clear_cache($link, $id);
$labels = db_escape_string(json_encode($labels));
db_query($link, "UPDATE ttrss_user_entries SET
- label_cache = '$labels' WHERE ref_id = '$id'");
+ label_cache = '$labels' WHERE ref_id = '$id' AND owner_uid = '$owner_uid'");
}
function api_get_headlines($link, $feed_id, $limit, $offset,
$filter, $is_cat, $show_excerpt, $show_content, $view_mode, $order,
$include_attachments, $since_id,
- $search = "", $search_mode = "", $match_on = "", $include_nested = false) {
+ $search = "", $search_mode = "", $match_on = "",
+ $include_nested = false, $sanitize_content = true) {
$qfh_ret = queryFeedHeadlines($link, $feed_id, $limit,
$view_mode, $is_cat, $search, $search_mode, $match_on,
}
if ($show_content) {
- $headline_row["content"] = $line["content_preview"];
+
+ if ($line["cached_content"] != "") {
+ $line["content_preview"] =& $line["cached_content"];
+ }
+
+ if ($sanitize_content) {
+ $headline_row["content"] = sanitize($link,
+ $line["content_preview"], false, false, $line["site_url"]);
+ } else {
+ $headline_row["content"] = $line["content_preview"];
+ }
}
// unify label output to ease parsing
}
function is_html($content) {
- return preg_match("/<html|DOCTYPE html/i", $content) !== 0;
+ return preg_match("/<html|DOCTYPE html/i", substr($content, 0, 20)) !== 0;
}
function url_is_html($url, $login = false, $pass = false) {
return $html;
}
- function filter_to_sql($filter) {
+ function filter_to_sql($link, $filter, $owner_uid) {
$query = array();
if (DB_TYPE == "pgsql")
}
if (isset($rule["cat_id"])) {
- $qpart .= " AND cat_id " . ($rule["cat_id"] ? '= ' . $rule["cat_id"] : 'IS NULL');
+
+ if ($rule["cat_id"] > 0) {
+ $children = getChildCategories($link, $rule["cat_id"], $owner_uid);
+ array_push($children, $rule["cat_id"]);
+
+ $children = join(",", $children);
+
+ $cat_qpart = "cat_id IN ($children)";
+ } else {
+ $cat_qpart = "cat_id IS NULL";
+ }
+
+ $qpart .= " AND $cat_qpart";
}
array_push($query, "($qpart)");
if ($feeds) {
if ($feeds['error']) {
$status = $feeds['error']['code'] + 10;
+
+ // access denied
+ if ($status == 16) {
+ db_query($link, "DELETE FROM ttrss_linked_feeds
+ WHERE instance_id = '$id'");
+ }
} else {
$status = 1;
}
- function create_published_article($link, $title, $url, $content, $owner_uid) {
- $guid = sha1($url);
+ function create_published_article($link, $title, $url, $content, $labels_str,
+ $owner_uid) {
+
+ $guid = sha1($url . $owner_uid); // include owner_uid to prevent global GUID clash
$content_hash = sha1($content);
+ if ($labels_str != "") {
+ $labels = explode(",", $labels_str);
+ } else {
+ $labels = array();
+ }
+
$rc = false;
if (!$title) $title = $url;
('$ref_id', '', NULL, NULL, $owner_uid, true, '', '', NOW(), '', false)");
}
+ if (count($labels) != 0) {
+ foreach ($labels as $label) {
+ label_add_article($link, $ref_id, trim($label), $owner_uid);
+ }
+ }
+
$rc = true;
} else {
VALUES
('$ref_id', '', NULL, NULL, $owner_uid, true, '', '', NOW(), '', false)");
+ if (count($labels) != 0) {
+ foreach ($labels as $label) {
+ label_add_article($link, $ref_id, trim($label), $owner_uid);
+ }
+ }
+
$rc = true;
}
}