]> git.wh0rd.org - tt-rss.git/blobdiff - include/functions2.php
Remove href attribute if it executes JavaScript.
[tt-rss.git] / include / functions2.php
index 0207c1240a9829074548bda1a528ffd9a1d63b09..dceea507ee882ccbc6f15935c1a959ad7795ad26 100644 (file)
@@ -64,8 +64,6 @@
                                "toggle_publ" => __("Toggle published"),
                                "toggle_unread" => __("Toggle unread"),
                                "edit_tags" => __("Edit tags"),
-                               "dismiss_selected" => __("Dismiss selected"),
-                               "dismiss_read" => __("Dismiss read"),
                                "open_in_new_window" => __("Open in new window"),
                                "catchup_below" => __("Mark below as read"),
                                "catchup_above" => __("Mark above as read"),
@@ -91,7 +89,9 @@
                                "feed_edit" => __("Edit feed"),
                                "feed_catchup" => __("Mark as read"),
                                "feed_reverse" => __("Reverse headlines"),
+                               "feed_toggle_vgroup" => __("Toggle headline grouping"),
                                "feed_debug_update" => __("Debug feed update"),
+                               "feed_debug_viewfeed" => __("Debug viewfeed()"),
                                "catchup_all" => __("Mark all feeds as read"),
                                "cat_toggle_collapse" => __("Un/collapse current category"),
                                "toggle_combined_mode" => __("Toggle combined mode"),
                                "*s" => "toggle_publ",
                                "u" => "toggle_unread",
                                "*t" => "edit_tags",
-                               "*d" => "dismiss_selected",
-                               "*x" => "dismiss_read",
                                "o" => "open_in_new_window",
                                "c p" => "catchup_below",
                                "c n" => "catchup_above",
                                "f e" => "feed_edit",
                                "f q" => "feed_catchup",
                                "f x" => "feed_reverse",
+                               "f g" => "feed_toggle_vgroup",
                                "f *d" => "feed_debug_update",
+                               "f *g" => "feed_debug_viewfeed",
                                "f *c" => "toggle_combined_mode",
                                "f c" => "toggle_cdm_expanded",
                                "*q" => "catchup_all",
 
        function check_for_update() {
                if (defined("GIT_VERSION_TIMESTAMP")) {
-                       $content = @fetch_file_contents("http://tt-rss.org/version.json");
+                       $content = @fetch_file_contents(array("url" => "http://tt-rss.org/version.json", "timeout" => 5));
 
                        if ($content) {
                                $content = json_decode($content, true);
                        }
                }
 
-               return false;
+               return "";
        }
 
-       function make_runtime_info() {
+       function make_runtime_info($disable_update_check = false) {
                $data = array();
 
                $result = db_query("SELECT MAX(id) AS mid, COUNT(*) AS nf FROM
                $data['reload_on_ts_change'] = !defined('_NO_RELOAD_ON_TS_CHANGE');
 
 
-               if (true || $_SESSION["last_version_check"] + 86400 + rand(-1000, 1000) < time()) {
+               if (CHECK_FOR_UPDATES && !$disable_update_check && $_SESSION["last_version_check"] + 86400 + rand(-1000, 1000) < time()) {
                        $update_result = @check_for_update();
 
                        $data["update_result"] = $update_result;
                return $data;
        }
 
-       function search_to_sql($search) {
-
-               $search_query_part = "";
+       function search_to_sql($search, $search_language) {
 
-               $keywords = str_getcsv($search, " ");
+               $keywords = str_getcsv(trim($search), " ");
                $query_keywords = array();
                $search_words = array();
+               $search_query_leftover = array();
+
+               if ($search_language)
+                       $search_language = db_escape_string(mb_strtolower($search_language));
+               else
+                       $search_language = "english";
 
                foreach ($keywords as $k) {
                        if (strpos($k, "-") === 0) {
                                        else
                                                array_push($query_keywords, "($not (published = false))");
 
+                               } else {
+                                       array_push($query_keywords, "(UPPER(ttrss_entries.title) $not LIKE UPPER('%$k%')
+                                                       OR UPPER(ttrss_entries.content) $not LIKE UPPER('%$k%'))");
+                                       if (!$not) array_push($search_words, $k);
+                               }
+                               break;
+                       case "unread":
+                               if ($commandpair[1]) {
+                                       if ($commandpair[1] == "true")
+                                               array_push($query_keywords, "($not (unread = true))");
+                                       else
+                                               array_push($query_keywords, "($not (unread = false))");
+
                                } else {
                                        array_push($query_keywords, "(UPPER(ttrss_entries.title) $not LIKE UPPER('%$k%')
                                                        OR UPPER(ttrss_entries.content) $not LIKE UPPER('%$k%'))");
 
                                        array_push($query_keywords, "(".SUBSTRING_FOR_DATE."(updated,1,LENGTH('$k')) $not = '$k')");
                                } else {
-                                       array_push($query_keywords, "(UPPER(ttrss_entries.title) $not LIKE UPPER('%$k%')
+
+                                       if (DB_TYPE == "pgsql") {
+                                               $k = mb_strtolower($k);
+                                               array_push($search_query_leftover, $not ? "!$k" : $k);
+                                       } else {
+                                               array_push($query_keywords, "(UPPER(ttrss_entries.title) $not LIKE UPPER('%$k%')
                                                        OR UPPER(ttrss_entries.content) $not LIKE UPPER('%$k%'))");
+                                       }
 
                                        if (!$not) array_push($search_words, $k);
                                }
                        }
                }
 
+               if (count($search_query_leftover) > 0) {
+                       $search_query_leftover = db_escape_string(implode(" & ", $search_query_leftover));
+
+                       if (DB_TYPE == "pgsql") {
+                               array_push($query_keywords,
+                                       "(tsvector_combined @@ to_tsquery('$search_language', '$search_query_leftover'))");
+                       }
+
+               }
+
                $search_query_part = implode("AND", $query_keywords);
 
                return array($search_query_part, $search_words);
                return $rv;
        }
 
-       function queryFeedHeadlines($feed, $limit, $view_mode, $cat_view, $search, $search_mode, $override_order = false, $offset = 0, $owner_uid = 0, $filter = false, $since_id = 0, $include_children = false, $ignore_vfeed_group = false, $override_strategy = false, $override_vfeed = false, $start_ts = false) {
-
-               if (!$owner_uid) $owner_uid = $_SESSION["uid"];
+       function queryFeedHeadlines($params) {
+
+               $feed = $params["feed"];
+               $limit = isset($params["limit"]) ? $params["limit"] : 30;
+               $view_mode = $params["view_mode"];
+               $cat_view = isset($params["cat_view"]) ? $params["cat_view"] : false;
+               $search = isset($params["search"]) ? $params["search"] : false;
+               $search_language = isset($params["search_language"]) ? $params["search_language"] : "";
+               $override_order = isset($params["override_order"]) ? $params["override_order"] : false;
+               $offset = isset($params["offset"]) ? $params["offset"] : 0;
+               $owner_uid = isset($params["owner_uid"]) ? $params["owner_uid"] : $_SESSION["uid"];
+               $since_id = isset($params["since_id"]) ? $params["since_id"] : 0;
+               $include_children = isset($params["include_children"]) ? $params["include_children"] : false;
+               $ignore_vfeed_group = isset($params["ignore_vfeed_group"]) ? $params["ignore_vfeed_group"] : false;
+               $override_strategy = isset($params["override_strategy"]) ? $params["override_strategy"] : false;
+               $override_vfeed = isset($params["override_vfeed"]) ? $params["override_vfeed"] : false;
+               $start_ts = isset($params["start_ts"]) ? $params["start_ts"] : false;
+               $check_first_id = isset($params["check_first_id"]) ? $params["check_first_id"] : false;
+               $skip_first_id_check = isset($params["skip_first_id_check"]) ? $params["skip_first_id_check"] : false;
 
                $ext_tables_part = "";
+               $query_strategy_part = "";
+
                $search_words = array();
 
                        if ($search) {
 
                                // fall back in case of no plugins
                                if (!$search_query_part) {
-                                       list($search_query_part, $search_words) = search_to_sql($search);
+                                       list($search_query_part, $search_words) = search_to_sql($search, $search_language);
                                }
                                $search_query_part .= " AND ";
                        } else {
                                $search_query_part = "";
                        }
 
-                       if ($filter) {
-
-                               if (DB_TYPE == "pgsql") {
-                                       $query_strategy_part .= " AND updated > NOW() - INTERVAL '14 days' ";
-                               } else {
-                                       $query_strategy_part .= " AND updated > DATE_SUB(NOW(), INTERVAL 14 DAY) ";
-                               }
-
-                               $override_order = "updated DESC";
-
-                               $filter_query_part = filter_to_sql($filter, $owner_uid);
-
-                               // Try to check if SQL regexp implementation chokes on a valid regexp
-
-
-                               $result = db_query("SELECT true AS true_val
-                                        FROM ttrss_entries
-                                        JOIN ttrss_user_entries ON ttrss_entries.id = ttrss_user_entries.ref_id
-                                        JOIN ttrss_feeds ON ttrss_feeds.id = ttrss_user_entries.feed_id
-                                       WHERE $filter_query_part LIMIT 1", false);
-
-                               if ($result) {
-                                       $test = db_fetch_result($result, 0, "true_val");
-
-                                       if (!$test) {
-                                               $filter_query_part = "false AND";
-                                       } else {
-                                               $filter_query_part .= " AND";
-                                       }
-                               } else {
-                                       $filter_query_part = "false AND";
-                               }
-
-                       } else {
-                               $filter_query_part = "";
-                       }
-
                        if ($since_id) {
                                $since_id_part = "ttrss_entries.id > $since_id AND ";
                        } else {
                                        if ($cat_view && $feed > 0 && $include_children)
                                                $unread += getCategoryChildrenUnread($feed);
 
-                                       if ($unread > 0)
-                               $view_query_part = " unread = true AND ";
-
+                                       if ($unread > 0) {
+                                               $view_query_part = " unread = true AND ";
+                                       }
                                }
                        }
 
 
                        $vfeed_query_part = "";
 
-                       // override query strategy and enable feed display when searching globally
-                       if ($search && $search_mode == "all_feeds") {
-                               $query_strategy_part = "true";
-                               $vfeed_query_part = "ttrss_feeds.title AS feed_title,";
                        /* tags */
-                       } else if (!is_numeric($feed)) {
+                       if (!is_numeric($feed)) {
                                $query_strategy_part = "true";
                                $vfeed_query_part = "(SELECT title FROM ttrss_feeds WHERE
                                        id = feed_id) as feed_title,";
-                       } else if ($search && $search_mode == "this_cat") {
-                               $vfeed_query_part = "ttrss_feeds.title AS feed_title,";
-
-                               if ($feed > 0) {
-                                       if ($include_children) {
-                                               $subcats = getChildCategories($feed, $owner_uid);
-                                               array_push($subcats, $feed);
-                                               $cats_qpart = join(",", $subcats);
-                                       } else {
-                                               $cats_qpart = $feed;
-                                       }
-
-                                       $query_strategy_part = "ttrss_feeds.cat_id IN ($cats_qpart)";
-
-                               } else {
-                                       $query_strategy_part = "ttrss_feeds.cat_id IS NULL";
-                               }
-
                        } else if ($feed > 0) {
 
                                if ($cat_view) {
                                } else {
                                        $vfeed_query_part = "ttrss_feeds.title AS feed_title,";
 
-                                       $ext_tables_part = ",ttrss_labels2,ttrss_user_labels2";
+                                       $ext_tables_part = "ttrss_labels2,ttrss_user_labels2,";
 
                                        $query_strategy_part = "ttrss_labels2.id = ttrss_user_labels2.label_id AND
                                                ttrss_user_labels2.article_id = ref_id";
                                }
                        } else if ($feed == -6) { // recently read
                                $query_strategy_part = "unread = false AND last_read IS NOT NULL";
+
+                               if (DB_TYPE == "pgsql") {
+                                       $query_strategy_part .= " AND last_read > NOW() - INTERVAL '1 DAY' ";
+                               } else {
+                                       $query_strategy_part .= " AND last_read > DATE_SUB(NOW(), INTERVAL 1 DAY) ";
+                               }
+
                                $vfeed_query_part = "ttrss_feeds.title AS feed_title,";
                                $allow_archived = true;
                                $ignore_vfeed_group = true;
 
                                if (!$override_order) $override_order = "last_read DESC";
 
-/*                     } else if ($feed == -7) { // shared
-                               $query_strategy_part = "uuid != ''";
-                               $vfeed_query_part = "ttrss_feeds.title AS feed_title,";
-                               $allow_archived = true; */
                        } else if ($feed == -3) { // fresh virtual feed
                                $query_strategy_part = "unread = true AND score >= 0";
 
                                        ttrss_user_labels2.article_id = ref_id";
 
                                $vfeed_query_part = "ttrss_feeds.title AS feed_title,";
-                               $ext_tables_part = ",ttrss_labels2,ttrss_user_labels2";
+                               $ext_tables_part = "ttrss_labels2,ttrss_user_labels2,";
                                $allow_archived = true;
 
                        } else {
 
                        $order_by = "score DESC, date_entered DESC, updated DESC";
 
-                       if ($view_mode == "unread_first") {
-                               $order_by = "unread DESC, $order_by";
-                       }
-
                        if ($override_order) {
                                $order_by = $override_order;
                        }
 
                        $content_query_part = "content, ";
 
+                       if ($limit_query_part) {
+                               $offset_query_part = "OFFSET $offset";
+                       } else {
+                               $offset_query_part = "";
+                       }
 
                        if (is_numeric($feed)) {
-
-                               if ($feed >= 0) {
-                                       $feed_kind = "Feeds";
-                               } else {
-                                       $feed_kind = "Labels";
-                               }
-
-                               if ($limit_query_part) {
-                                       $offset_query_part = "OFFSET $offset";
-                               }
-
                                // proper override_order applied above
                                if ($vfeed_query_part && !$ignore_vfeed_group && get_pref('VFEED_GROUP_BY_FEED', $owner_uid)) {
                                        if (!$override_order) {
                                }
 
                                if (!$allow_archived) {
-                                       $from_qpart = "ttrss_entries,ttrss_user_entries,ttrss_feeds$ext_tables_part";
+                                       $from_qpart = "${ext_tables_part}ttrss_entries LEFT JOIN ttrss_user_entries ON (ref_id = ttrss_entries.id),ttrss_feeds";
                                        $feed_check_qpart = "ttrss_user_entries.feed_id = ttrss_feeds.id AND";
 
                                } else {
-                                       $from_qpart = "ttrss_entries$ext_tables_part,ttrss_user_entries
+                                       $from_qpart = "${ext_tables_part}ttrss_entries LEFT JOIN ttrss_user_entries ON (ref_id = ttrss_entries.id)
                                                LEFT JOIN ttrss_feeds ON (feed_id = ttrss_feeds.id)";
                                }
 
-                               if ($vfeed_query_part)
-                                       $vfeed_query_part .= "favicon_avg_color,";
+                               if ($vfeed_query_part) $vfeed_query_part .= "favicon_avg_color,";
 
                                if ($start_ts) {
                                        $start_ts_formatted = date("Y/m/d H:i:s", strtotime($start_ts));
                                        $start_ts_query_part = "";
                                }
 
+                               $first_id = 0;
+                               $first_id_query_strategy_part = $query_strategy_part;
+
+                               if ($feed == -3)
+                                       $first_id_query_strategy_part = "true";
+
+                               if (DB_TYPE == "pgsql") {
+                                       $sanity_interval_qpart = "date_entered >= NOW() - INTERVAL '1 hour' AND";
+                               } else {
+                                       $sanity_interval_qpart = "date_entered >= DATE_SUB(NOW(), INTERVAL 1 hour) AND";
+                               }
+
+                               if (!$search && !$skip_first_id_check) {
+                                       // if previous topmost article id changed that means our current pagination is no longer valid
+                                       $query = "SELECT DISTINCT
+                                                       ttrss_feeds.title,
+                                                       date_entered,
+                                                       guid,
+                                                       ttrss_entries.id,
+                                                       ttrss_entries.title,
+                                                       updated,
+                                                       score,
+                                                       marked,
+                                                       published,
+                                                       last_marked,
+                                                       last_published,
+                                                       last_read
+                                               FROM
+                                                       $from_qpart
+                                               WHERE
+                                               $feed_check_qpart
+                                               ttrss_user_entries.owner_uid = '$owner_uid' AND
+                                               $search_query_part
+                                               $start_ts_query_part
+                                               $since_id_part
+                                               $sanity_interval_qpart
+                                               $first_id_query_strategy_part ORDER BY $order_by LIMIT 1";
+
+                                       if ($_REQUEST["debug"]) {
+                                               print $query;
+                                       }
+
+                                       $result = db_query($query);
+                                       if ($result && db_num_rows($result) > 0) {
+                                               $first_id = (int)db_fetch_result($result, 0, "id");
+
+                                               if ($offset > 0 && $first_id && $check_first_id && $first_id != $check_first_id) {
+                                                       return array(-1, $feed_title, $feed_site_url, $last_error, $last_updated, $search_words, $first_id);
+                                               }
+                                       }
+                               }
+
                                $query = "SELECT DISTINCT
                                                date_entered,
                                                guid,
                                                $from_qpart
                                        WHERE
                                        $feed_check_qpart
-                                       ttrss_user_entries.ref_id = ttrss_entries.id AND
                                        ttrss_user_entries.owner_uid = '$owner_uid' AND
                                        $search_query_part
                                        $start_ts_query_part
-                                       $filter_query_part
                                        $view_query_part
                                        $since_id_part
                                        $query_strategy_part ORDER BY $order_by
                        } else {
                                // browsing by tag
 
-                               $select_qpart = "SELECT DISTINCT " .
-                                                               "date_entered," .
-                                                               "guid," .
-                                                               "note," .
-                                                               "ttrss_entries.id as id," .
-                                                               "title," .
-                                                               "updated," .
-                                                               "unread," .
-                                                               "feed_id," .
-                                                               "orig_feed_id," .
-                                                               "marked," .
-                                                               "num_comments, " .
-                                                               "comments, " .
-                                                               "tag_cache," .
-                                                               "label_cache," .
-                                                               "link," .
-                                                               "lang," .
-                                                               "uuid," .
-                                                               "last_read," .
-                                                               "(SELECT hide_images FROM ttrss_feeds WHERE id = feed_id) AS hide_images," .
-                                                               "last_marked, last_published, " .
-                                                               $since_id_part .
-                                                               $vfeed_query_part .
-                                                               $content_query_part .
-                                                               "score ";
-
-                               $feed_kind = "Tags";
-                               $all_tags = explode(",", $feed);
-                               if ($search_mode == 'any') {
-                                       $tag_sql = "tag_name in (" . implode(", ", array_map("db_quote", $all_tags)) . ")";
-                                       $from_qpart = " FROM ttrss_entries,ttrss_user_entries,ttrss_tags ";
-                                       $where_qpart = " WHERE " .
-                                                                  "ref_id = ttrss_entries.id AND " .
-                                                                  "ttrss_user_entries.owner_uid = $owner_uid AND " .
-                                                                  "post_int_id = int_id AND $tag_sql AND " .
-                                                                  $view_query_part .
-                                                                  $search_query_part .
-                                                                  $query_strategy_part . " ORDER BY $order_by " .
-                                                                  $limit_query_part;
+                               $query = "SELECT DISTINCT
+                                                       date_entered,
+                                                       guid,
+                                                       note,
+                                                       ttrss_entries.id as id,
+                                                       title,
+                                                       updated,
+                                                       unread,
+                                                       feed_id,
+                                                       orig_feed_id,
+                                                       marked,
+                                                       num_comments,
+                                                       comments,
+                                                       int_id,
+                                                       tag_cache,
+                                                       label_cache,
+                                                       link,
+                                                       lang,
+                                                       uuid,
+                                                       last_read,
+                                                       (SELECT hide_images FROM ttrss_feeds WHERE id = feed_id) AS hide_images,
+                                                       last_marked, last_published,
+                                                       $since_id_part
+                                                       $vfeed_query_part
+                                                       $content_query_part
+                                                       author, score
+                                               FROM ttrss_entries, ttrss_user_entries, ttrss_tags
+                                               WHERE
+                                                       ref_id = ttrss_entries.id AND
+                                                       ttrss_user_entries.owner_uid = $owner_uid AND
+                                                       post_int_id = int_id AND
+                                                       tag_name = '$feed' AND
+                                                       $view_query_part
+                                                       $search_query_part
+                                                       $query_strategy_part ORDER BY $order_by
+                                                       $limit_query_part $offset_query_part";
 
-                               } else {
-                                       $i = 1;
-                                       $sub_selects = array();
-                                       $sub_ands = array();
-                                       foreach ($all_tags as $term) {
-                                               array_push($sub_selects, "(SELECT post_int_id from ttrss_tags WHERE tag_name = " . db_quote($term) . " AND owner_uid = $owner_uid) as A$i");
-                                               $i++;
-                                       }
-                                       if ($i > 2) {
-                                               $x = 1;
-                                               $y = 2;
-                                               do {
-                                                       array_push($sub_ands, "A$x.post_int_id = A$y.post_int_id");
-                                                       $x++;
-                                                       $y++;
-                                               } while ($y < $i);
-                                       }
-                                       array_push($sub_ands, "A1.post_int_id = ttrss_user_entries.int_id and ttrss_user_entries.owner_uid = $owner_uid");
-                                       array_push($sub_ands, "ttrss_user_entries.ref_id = ttrss_entries.id");
-                                       $from_qpart = " FROM " . implode(", ", $sub_selects) . ", ttrss_user_entries, ttrss_entries";
-                                       $where_qpart = " WHERE " . implode(" AND ", $sub_ands);
-                               }
-                               //                              error_log("TAG SQL: " . $tag_sql);
-                               // $tag_sql = "tag_name = '$feed'";   DEFAULT way
+                               if ($_REQUEST["debug"]) print $query;
 
-                               //                              error_log("[". $select_qpart . "][" . $from_qpart . "][" .$where_qpart . "]");
-                               $result = db_query($select_qpart . $from_qpart . $where_qpart);
+                               $result = db_query($query);
                        }
 
-                       return array($result, $feed_title, $feed_site_url, $last_error, $last_updated, $search_words);
+                       return array($result, $feed_title, $feed_site_url, $last_error, $last_updated, $search_words, $first_id);
 
        }
 
        function iframe_whitelisted($entry) {
-               $whitelist = array("youtube.com", "youtu.be", "vimeo.com");
+               $whitelist = array("youtube.com", "youtu.be", "vimeo.com", "player.vimeo.com");
 
                @$src = parse_url($entry->getAttribute("src"), PHP_URL_HOST);
 
 
                $entries = $xpath->query('(//a[@href]|//img[@src])');
 
+               $ttrss_uses_https = parse_url(get_self_url_prefix(), PHP_URL_SCHEME) === 'https';
+
                foreach ($entries as $entry) {
 
                        if ($site_url) {
                                        $cached_filename = CACHE_DIR . '/images/' . sha1($src) . '.png';
 
                                        if (file_exists($cached_filename)) {
-                                               $src = SELF_URL_PATH . '/image.php?hash=' . sha1($src);
+                                               $src = SELF_URL_PATH . '/public.php?op=cached_image&hash=' . sha1($src);
+
+                                               if ($entry->hasAttribute('srcset')) {
+                                                       $entry->removeAttribute('srcset');
+                                               }
+
+                                               if ($entry->hasAttribute('sizes')) {
+                                                       $entry->removeAttribute('sizes');
+                                               }
                                        }
 
                                        $entry->setAttribute('src', $src);
                                }
 
                                if ($entry->nodeName == 'img') {
+                                       if ($entry->hasAttribute('src')) {
+                                               $is_https_url = parse_url($entry->getAttribute('src'), PHP_URL_SCHEME) === 'https';
+
+                                               if ($ttrss_uses_https && !$is_https_url) {
+
+                                                       if ($entry->hasAttribute('srcset')) {
+                                                               $entry->removeAttribute('srcset');
+                                                       }
+
+                                                       if ($entry->hasAttribute('sizes')) {
+                                                               $entry->removeAttribute('sizes');
+                                                       }
+                                               }
+                                       }
+
                                        if (($owner && get_pref("STRIP_IMAGES", $owner)) ||
                                                        $force_remove_images || $_SESSION["bw_limit"]) {
 
                $allowed_elements = array('a', 'address', 'audio', 'article', 'aside',
                        'b', 'bdi', 'bdo', 'big', 'blockquote', 'body', 'br',
                        'caption', 'cite', 'center', 'code', 'col', 'colgroup',
-                       'data', 'dd', 'del', 'details', 'div', 'dl', 'font',
+                       'data', 'dd', 'del', 'details', 'description', 'div', 'dl', 'font',
                        'dt', 'em', 'footer', 'figure', 'figcaption',
                        'h1', 'h2', 'h3', 'h4', 'h5', 'h6', 'header', 'html', 'i',
                        'img', 'ins', 'kbd', 'li', 'main', 'mark', 'nav', 'noscript',
                        'ol', 'p', 'pre', 'q', 'ruby', 'rp', 'rt', 's', 'samp', 'section',
                        'small', 'source', 'span', 'strike', 'strong', 'sub', 'summary',
                        'sup', 'table', 'tbody', 'td', 'tfoot', 'th', 'thead', 'time',
-                       'tr', 'track', 'tt', 'u', 'ul', 'var', 'wbr', 'video' );
+                       'tr', 'track', 'tt', 'u', 'ul', 'var', 'wbr', 'video', 'xml:namespace' );
 
                if ($_SESSION['hasSandbox']) $allowed_elements[] = 'iframe';
 
 
                $res = $doc->saveHTML();
 
-               return $res;
+               /* strip everything outside of <body>...</body> */
+
+               $res_frag = array();
+               if (preg_match('/<body>(.*)<\/body>/is', $res, $res_frag)) {
+                       return $res_frag[1];
+               } else {
+                       return $res;
+               }
        }
 
        function strip_harmful_tags($doc, $allowed_elements, $disallowed_attributes) {
                                                array_push($attrs_to_remove, $attr);
                                        }
 
+                                       if ($attr->nodeName == 'href' && stripos($attr->value, 'javascript:') === 0) {
+                                               array_push($attrs_to_remove, $attr);
+                                       }
+
                                        if (in_array($attr->nodeName, $disallowed_attributes)) {
                                                array_push($attrs_to_remove, $attr);
                                        }
                        $result = db_query("SELECT tag_cache FROM ttrss_user_entries
                                WHERE ref_id = '$id' AND owner_uid = $owner_uid");
 
-                       $tag_cache = db_fetch_result($result, 0, "tag_cache");
+                       if (db_num_rows($result) != 0)
+                               $tag_cache = db_fetch_result($result, 0, "tag_cache");
                }
 
                if ($tag_cache) {
 
        function tag_is_valid($tag) {
                if ($tag == '') return false;
-               if (preg_match("/^[0-9]*$/", $tag)) return false;
+               if (is_numeric($tag)) return false;
                if (mb_strlen($tag) > 250) return false;
 
                if (!$tag) return false;
        }
 
        function format_warning($msg, $id = "") {
-               return "<div class=\"warning\" id=\"$id\">
-                       <span><img src=\"images/alert.png\"></span><span>$msg</span></div>";
+               return "<div class=\"alert\" id=\"$id\">$msg</div>";
        }
 
        function format_notice($msg, $id = "") {
-               return "<div class=\"notice\" id=\"$id\">
-                       <span><img src=\"images/information.png\"></span><span>$msg</span></div>";
+               return "<div class=\"alert alert-info\" id=\"$id\">$msg</div>";
        }
 
        function format_error($msg, $id = "") {
-               return "<div class=\"error\" id=\"$id\">
-                       <span><img src=\"images/alert.png\"></span><span>$msg</span></div>";
+               return "<div class=\"alert alert-danger\" id=\"$id\">$msg</div>";
        }
 
        function print_notice($msg) {
                                $_SESSION["hasMp3"])) {
 
                                $entry .= "<audio preload=\"none\" controls>
-                                       <source type=\"$ctype\" src=\"$url\"></source>
+                                       <source type=\"$ctype\" src=\"$url\"/>
                                        </audio>";
 
                        } else {
                                                <link rel=\"shortcut icon\" type=\"image/png\" href=\"images/favicon.png\">
                                                <link rel=\"icon\" type=\"image/png\" sizes=\"72x72\" href=\"images/favicon-72px.png\">
 
-                                               <script type=\"text/javascript\">
-                                               function openSelectedAttachment(elem) {
-                                                       try {
-                                                               var url = elem[elem.selectedIndex].value;
-
-                                                               if (url) {
-                                                                       window.open(url);
-                                                                       elem.selectedIndex = 0;
-                                                               }
-
-                                                       } catch (e) {
-                                                               exception_error(\"openSelectedAttachment\", e);
-                                                       }
-                                               }
-                                       </script>
                                        </head><body id=\"ttrssZoom\">";
                        }
 
                        if ($line["orig_feed_id"]) {
 
                                $tmp_result = db_query("SELECT * FROM ttrss_archived_feeds
-                                       WHERE id = ".$line["orig_feed_id"]);
+                                       WHERE id = ".$line["orig_feed_id"] . " AND owner_uid = " . $_SESSION["uid"]);
 
                                if (db_num_rows($tmp_result) != 0) {
 
                        $rv['content'] .= "<div class=\"postContent\" lang=\"".$line['lang']."\">";
 
                        $rv['content'] .= $line["content"];
-                       $rv['content'] .= format_article_enclosures($id,
-                               sql_bool_to_bool($line["always_display_enclosures"]),
-                               $line["content"],
-                               sql_bool_to_bool($line["hide_images"]));
+
+                       if (!$zoom_mode) {
+                               $rv['content'] .= format_article_enclosures($id,
+                                       sql_bool_to_bool($line["always_display_enclosures"]),
+                                       $line["content"],
+                                       sql_bool_to_bool($line["hide_images"]));
+                       }
 
                        $rv['content'] .= "</div>";
 
 
                $tag = mb_strtolower($tag, 'utf-8');
 
-               $tag = preg_replace('/[\'\"\+\>\<]/', "", $tag);
+               $tag = preg_replace('/[,\'\"\+\>\<]/', "", $tag);
 
-//             $tag = str_replace('"', "", $tag);
-//             $tag = str_replace("+", " ", $tag);
-               $tag = str_replace("technorati tag: ", "", $tag);
+               if (DB_TYPE == "mysql") {
+                       $tag = preg_replace('/[\x{10000}-\x{10FFFF}]/u', "\xEF\xBF\xBD", $tag);
+               }
 
                return $tag;
        }
                        return __("no tags");
                } else {
                        $maxtags = min(5, count($tags));
+                       $tags_str = "";
 
                        for ($i = 0; $i < $maxtags; $i++) {
-                               $tags_str .= "<a class=\"tag\" href=\"#\" onclick=\"viewfeed('".$tags[$i]."')\">" . $tags[$i] . "</a>, ";
+                               $tags_str .= "<a class=\"tag\" href=\"#\" onclick=\"viewfeed({feed:'".$tags[$i]."'})\">" . $tags[$i] . "</a>, ";
                        }
 
                        $tags_str = mb_substr($tags_str, 0, mb_strlen($tags_str)-2);
         * @return string Fixed URL.
         */
        function fix_url($url) {
+
+               // support schema-less urls
+               if (strpos($url, '//') === 0) {
+                       $url = 'https:' . $url;
+               }
+
                if (strpos($url, '://') === false) {
                        $url = 'http://' . $url;
                } else if (substr($url, 0, 5) == 'feed:') {
                if (db_num_rows($result) == 1) {
                        return db_fetch_result($result, 0, "access_key");
                } else {
-                       $key = db_escape_string(uniqid(base_convert(rand(), 10, 36)));
+                       $key = db_escape_string(uniqid_short());
 
                        $result = db_query("INSERT INTO ttrss_access_keys
                                (access_key, feed_id, is_cat, owner_uid)
        }
 
        function is_html($content) {
-               return preg_match("/<html|DOCTYPE html/i", substr($content, 0, 20)) !== 0;
+               return preg_match("/<html|DOCTYPE html/i", substr($content, 0, 100)) !== 0;
        }
 
        function url_is_html($url, $login = false, $pass = false) {
                                $rv = $retval;
                        }
                }
+               unset($retval); // Unset to prevent breaking render if there are no HOOK_RENDER_ENCLOSURE hooks below.
 
                if ($rv === '' && !empty($result)) {
                        $entries_html = array();
 
                                        foreach ($entries as $entry) {
 
-                                               if (preg_match("/image/", $entry["type"]) ||
-                                                               preg_match("/\.(jpg|png|gif|bmp)/i", $entry["filename"])) {
-
-                                                               if (!$hide_images) {
-                                                                       $encsize = '';
-                                                                       if ($entry['height'] > 0)
-                                                                               $encsize .= ' height="' . intval($entry['width']) . '"';
-                                                                       if ($entry['width'] > 0)
-                                                                               $encsize .= ' width="' . intval($entry['height']) . '"';
-                                                                       $rv .= "<p><img
-                                                                       alt=\"".htmlspecialchars($entry["filename"])."\"
-                                                                       src=\"" .htmlspecialchars($entry["url"]) . "\"
-                                                                       " . $encsize . " /></p>";
-                                                               } else {
-                                                                       $rv .= "<p><a target=\"_blank\"
-                                                                       href=\"".htmlspecialchars($entry["url"])."\"
-                                                                       >" .htmlspecialchars($entry["url"]) . "</a></p>";
-                                                               }
-
-                                                               if ($entry['title']) {
-                                                                       $rv.= "<div class=\"enclosure_title\">${entry['title']}</div>";
-                                                               }
+                                       foreach (PluginHost::getInstance()->get_hooks(PluginHost::HOOK_RENDER_ENCLOSURE) as $plugin)
+                                               $retval = $plugin->hook_render_enclosure($entry, $hide_images);
+
+
+                                               if ($retval) {
+                                                       $rv .= $retval;
+                                               } else {
+
+                                                       if (preg_match("/image/", $entry["type"]) ||
+                                                                       preg_match("/\.(jpg|png|gif|bmp)/i", $entry["filename"])) {
+
+                                                                       if (!$hide_images) {
+                                                                               $encsize = '';
+                                                                               if ($entry['height'] > 0)
+                                                                                       $encsize .= ' height="' . intval($entry['height']) . '"';
+                                                                               if ($entry['width'] > 0)
+                                                                                       $encsize .= ' width="' . intval($entry['width']) . '"';
+                                                                               $rv .= "<p><img
+                                                                               alt=\"".htmlspecialchars($entry["filename"])."\"
+                                                                               src=\"" .htmlspecialchars($entry["url"]) . "\"
+                                                                               " . $encsize . " /></p>";
+                                                                       } else {
+                                                                               $rv .= "<p><a target=\"_blank\"
+                                                                               href=\"".htmlspecialchars($entry["url"])."\"
+                                                                               >" .htmlspecialchars($entry["url"]) . "</a></p>";
+                                                                       }
+
+                                                                       if ($entry['title']) {
+                                                                               $rv.= "<div class=\"enclosure_title\">${entry['title']}</div>";
+                                                                       }
+                                                       }
                                                }
                                        }
                                }
                                $rv .= "<hr clear='both'/>";
                        }
 
-                       $rv .= "<select class=\"attachments\" onchange=\"openSelectedAttachment(this)\">".
-                               "<option value=''>" . __('Attachments')."</option>";
+                       $rv .= "<div class=\"attachments\" dojoType=\"dijit.form.DropDownButton\">".
+                               "<span>" . __('Attachments')."</span>";
+
+                       $rv .= "<div dojoType=\"dijit.Menu\" style=\"display: none;\">";
 
                        foreach ($entries as $entry) {
                                if ($entry["title"])
                                else
                                        $title = "";
 
-                               $rv .= "<option value=\"".htmlspecialchars($entry["url"])."\">" . htmlspecialchars($entry["filename"]) . "$title</option>";
+                               $rv .= "<div onclick='window.open(\"".htmlspecialchars($entry["url"])."\")'
+                                       dojoType=\"dijit.MenuItem\">".htmlspecialchars($entry["filename"])."$title</div>";
 
                        };
 
-                       $rv .= "</select>";
+                       $rv .= "</div>";
+                       $rv .= "</div>";
                }
 
                return $rv;
         * @return string Absolute URL
         */
        function rewrite_relative_url($url, $rel_url) {
-               if (strpos($rel_url, ":") !== false) {
-                       return $rel_url;
-               } else if (strpos($rel_url, "://") !== false) {
+               if (strpos($rel_url, "://") !== false) {
                        return $rel_url;
                } else if (strpos($rel_url, "//") === 0) {
                        # protocol-relative URL (rare but they exist)
                        return $rel_url;
-               } else if (strpos($rel_url, "/") === 0)
-               {
+               } else if (preg_match("/^[a-z]+:/i", $rel_url)) {
+                       # magnet:, feed:, etc
+                       return $rel_url;
+               } else if (strpos($rel_url, "/") === 0) {
                        $parts = parse_url($url);
                        $parts['path'] = $rel_url;
 
                return in_array($interface, class_implements($class));
        }
 
-       function geturl($url, $depth = 0, $nobody = true){
-
-               if ($depth == 20) return $url;
-
-               if (!function_exists('curl_init'))
-                       return user_error('CURL Must be installed for geturl function to work. Ask your host to enable it or uncomment extension=php_curl.dll in php.ini', E_USER_ERROR);
-
-               $curl = curl_init();
-               $header[0] = "Accept: text/xml,application/xml,application/xhtml+xml,";
-               $header[0] .= "text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5";
-               $header[] = "Cache-Control: max-age=0";
-               $header[] = "Connection: keep-alive";
-               $header[] = "Keep-Alive: 300";
-               $header[] = "Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7";
-               $header[] = "Accept-Language: en-us,en;q=0.5";
-               $header[] = "Pragma: ";
-
-               curl_setopt($curl, CURLOPT_URL, $url);
-               curl_setopt($curl, CURLOPT_USERAGENT, 'Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 Firefox/5.0');
-               curl_setopt($curl, CURLOPT_HTTPHEADER, $header);
-               curl_setopt($curl, CURLOPT_HEADER, true);
-               curl_setopt($curl, CURLOPT_NOBODY, $nobody);
-               curl_setopt($curl, CURLOPT_REFERER, $url);
-               curl_setopt($curl, CURLOPT_ENCODING, 'gzip,deflate');
-               curl_setopt($curl, CURLOPT_AUTOREFERER, true);
-               curl_setopt($curl, CURLOPT_RETURNTRANSFER, true);
-               //curl_setopt($curl, CURLOPT_FOLLOWLOCATION, true); //CURLOPT_FOLLOWLOCATION Disabled...
-               curl_setopt($curl, CURLOPT_TIMEOUT, 60);
-               curl_setopt($curl, CURLOPT_SSL_VERIFYPEER, false);
-
-               if (defined('_CURL_HTTP_PROXY')) {
-                       curl_setopt($curl, CURLOPT_PROXY, _CURL_HTTP_PROXY);
-               }
-
-               $html = curl_exec($curl);
-
-               $status = curl_getinfo($curl);
-
-               if($status['http_code']!=200){
-
-                       // idiot site not allowing http head
-                       if($status['http_code'] == 405) {
-                               curl_close($curl);
-                               return geturl($url, $depth +1, false);
-                       }
-
-                       if($status['http_code'] == 301 || $status['http_code'] == 302) {
-                               curl_close($curl);
-                               list($header) = explode("\r\n\r\n", $html, 2);
-                               $matches = array();
-                               preg_match("/(Location:|URI:)[^(\n)]*/", $header, $matches);
-                               $url = trim(str_replace($matches[1],"",$matches[0]));
-                               $url_parsed = parse_url($url);
-                               return (isset($url_parsed))? geturl($url, $depth + 1):'';
-                       }
-
-                       global $fetch_last_error;
-
-                       $fetch_last_error = curl_errno($curl) . " " . curl_error($curl);
-                       curl_close($curl);
-
-#                      $oline='';
-#                      foreach($status as $key=>$eline){$oline.='['.$key.']'.$eline.' ';}
-#                      $line =$oline." \r\n ".$url."\r\n-----------------\r\n";
-#                      $handle = @fopen('./curl.error.log', 'a');
-#                      fwrite($handle, $line);
-                       return FALSE;
-               }
-               curl_close($curl);
-               return $url;
-       }
-
        function get_minified_js($files) {
                require_once 'lib/jshrink/Minifier.php';
 
                return LABEL_BASE_INDEX - 1 + abs($feed);
        }
 
-       function theme_valid($file) {
-               if ($file == "default.css" || $file == "night.css") return true; // needed for array_filter
-               $file = "themes/" . basename($file);
+       function get_theme_path($theme) {
+               $check = "themes/$theme";
+               if (file_exists($check)) return $check;
+
+               $check = "themes.local/$theme";
+               if (file_exists($check)) return $check;
+       }
+
+       function theme_valid($theme) {
+               if ($theme == "default.css" || $theme == "night.css") return true; // needed for array_filter
+               $file = "themes/" . basename($theme);
+
+               if (!file_exists($file)) $file = "themes.local/" . basename($theme);
 
                if (file_exists($file) && is_readable($file)) {
                        $fh = fopen($file, "r");
 
                return false;
        }
+
+       function error_json($code) {
+               require_once "errors.php";
+
+               @$message = $ERRORS[$code];
+
+               return json_encode(array("error" =>
+                       array("code" => $code, "message" => $message)));
+
+       }
+
+       function abs_to_rel_path($dir) {
+               $tmp = str_replace(dirname(__DIR__), "", $dir);
+
+               if (strlen($tmp) > 0 && substr($tmp, 0, 1) == "/") $tmp = substr($tmp, 1);
+
+               return $tmp;
+       }
 ?>