sanitize: allow <hr> elements

[tt-rss.git] / include / functions2.php

diff --git a/include/functions2.php b/include/functions2.php
index 278c0f3eeba2d56e55b252ed7ac08823a6938932..8046deb55bc9bfa1691e6427497310e210be31db 100644 (file)
--- a/include/functions2.php
+++ b/include/functions2.php
@@ -665,10 +665,6 @@
 
                        $order_by = "score DESC, date_entered DESC, updated DESC";
 
-                       if ($view_mode == "unread_first") {
-                               $order_by = "unread DESC, $order_by";
-                       }
-
                        if ($override_order) {
                                $order_by = $override_order;
                        }
@@ -961,7 +957,7 @@
                        'caption', 'cite', 'center', 'code', 'col', 'colgroup',
                        'data', 'dd', 'del', 'details', 'div', 'dl', 'font',
                        'dt', 'em', 'footer', 'figure', 'figcaption',
-                       'h1', 'h2', 'h3', 'h4', 'h5', 'h6', 'header', 'html', 'i',
+                       'h1', 'h2', 'h3', 'h4', 'h5', 'h6', 'header', 'html', 'hr', 'i',
                        'img', 'ins', 'kbd', 'li', 'main', 'mark', 'nav', 'noscript',
                        'ol', 'p', 'pre', 'q', 'ruby', 'rp', 'rt', 's', 'samp', 'section',
                        'small', 'source', 'span', 'strike', 'strong', 'sub', 'summary',
@@ -1487,9 +1483,9 @@
 
                $tag = preg_replace('/[\'\"\+\>\<]/', "", $tag);
 
-//             $tag = str_replace('"', "", $tag);
-//             $tag = str_replace("+", " ", $tag);
-               $tag = str_replace("technorati tag: ", "", $tag);
+               if (DB_TYPE == "mysql") {
+                       $tag = preg_replace('/[\x{10000}-\x{10FFFF}]/u', "\xEF\xBF\xBD", $tag);
+               }
 
                return $tag;
        }
@@ -1743,6 +1739,12 @@
         * @return string Fixed URL.
         */
        function fix_url($url) {
+
+               // support schema-less urls
+               if (strpos($url, '//') === 0) {
+                       $url = 'https:' . $url;
+               }
+
                if (strpos($url, '://') === false) {
                        $url = 'http://' . $url;
                } else if (substr($url, 0, 5) == 'feed:') {
@@ -1944,28 +1946,37 @@
 
                                        foreach ($entries as $entry) {
 
-                                               if (preg_match("/image/", $entry["type"]) ||
-                                                               preg_match("/\.(jpg|png|gif|bmp)/i", $entry["filename"])) {
-
-                                                               if (!$hide_images) {
-                                                                       $encsize = '';
-                                                                       if ($entry['height'] > 0)
-                                                                               $encsize .= ' height="' . intval($entry['width']) . '"';
-                                                                       if ($entry['width'] > 0)
-                                                                               $encsize .= ' width="' . intval($entry['height']) . '"';
-                                                                       $rv .= "<p><img
-                                                                       alt=\"".htmlspecialchars($entry["filename"])."\"
-                                                                       src=\"" .htmlspecialchars($entry["url"]) . "\"
-                                                                       " . $encsize . " /></p>";
-                                                               } else {
-                                                                       $rv .= "<p><a target=\"_blank\"
-                                                                       href=\"".htmlspecialchars($entry["url"])."\"
-                                                                       >" .htmlspecialchars($entry["url"]) . "</a></p>";
-                                                               }
+                                       foreach (PluginHost::getInstance()->get_hooks(PluginHost::HOOK_RENDER_ENCLOSURE) as $plugin)
+                                               $retval = $plugin->hook_render_enclosure($entry, $hide_images);
 
-                                                               if ($entry['title']) {
-                                                                       $rv.= "<div class=\"enclosure_title\">${entry['title']}</div>";
-                                                               }
+
+                                               if ($retval) {
+                                                       $rv .= $retval;
+                                               } else {
+
+                                                       if (preg_match("/image/", $entry["type"]) ||
+                                                                       preg_match("/\.(jpg|png|gif|bmp)/i", $entry["filename"])) {
+
+                                                                       if (!$hide_images) {
+                                                                               $encsize = '';
+                                                                               if ($entry['height'] > 0)
+                                                                                       $encsize .= ' height="' . intval($entry['width']) . '"';
+                                                                               if ($entry['width'] > 0)
+                                                                                       $encsize .= ' width="' . intval($entry['height']) . '"';
+                                                                               $rv .= "<p><img
+                                                                               alt=\"".htmlspecialchars($entry["filename"])."\"
+                                                                               src=\"" .htmlspecialchars($entry["url"]) . "\"
+                                                                               " . $encsize . " /></p>";
+                                                                       } else {
+                                                                               $rv .= "<p><a target=\"_blank\"
+                                                                               href=\"".htmlspecialchars($entry["url"])."\"
+                                                                               >" .htmlspecialchars($entry["url"]) . "</a></p>";
+                                                                       }
+
+                                                                       if ($entry['title']) {
+                                                                               $rv.= "<div class=\"enclosure_title\">${entry['title']}</div>";
+                                                                       }
+                                                       }
                                                }
                                        }
                                }
@@ -2439,9 +2450,19 @@
                return LABEL_BASE_INDEX - 1 + abs($feed);
        }
 
-       function theme_valid($file) {
-               if ($file == "default.css" || $file == "night.css") return true; // needed for array_filter
-               $file = "themes/" . basename($file);
+       function get_theme_path($theme) {
+               $check = "themes/$theme";
+               if (file_exists($check)) return $check;
+
+               $check = "themes.local/$theme";
+               if (file_exists($check)) return $check;
+       }
+
+       function theme_valid($theme) {
+               if ($theme == "default.css" || $theme == "night.css") return true; // needed for array_filter
+               $file = "themes/" . basename($theme);
+
+               if (!file_exists($file)) $file = "themes.local/" . basename($theme);
 
                if (file_exists($file) && is_readable($file)) {
                        $fh = fopen($file, "r");
@@ -2456,4 +2477,22 @@
 
                return false;
        }
+
+       function error_json($code) {
+               require_once "errors.php";
+
+               @$message = $ERRORS[$code];
+
+               return json_encode(array("error" =>
+                       array("code" => $code, "message" => $message)));
+
+       }
+
+       function abs_to_rel_path($dir) {
+               $tmp = str_replace(dirname(__DIR__), "", $dir);
+
+               if (strlen($tmp) > 0 && substr($tmp, 0, 1) == "/") $tmp = substr($tmp, 1);
+
+               return $tmp;
+       }
 ?>