Remove href attribute if it executes JavaScript.

[tt-rss.git] / include / functions2.php
diff --git a/include/functions2.php b/include/functions2.php

index 811c72ee3d5eadc3fc578550d6b8158a882a6a64..dceea507ee882ccbc6f15935c1a959ad7795ad26 100644 (file)
--- a/include/functions2.php
+++ b/include/functions2.php
@@ -64,8 +64,6 @@
                                 "toggle_publ" => __("Toggle published"),
                                 "toggle_unread" => __("Toggle unread"),
                                 "edit_tags" => __("Edit tags"),
-                               "dismiss_selected" => __("Dismiss selected"),
-                               "dismiss_read" => __("Dismiss read"),
                                 "open_in_new_window" => __("Open in new window"),
                                 "catchup_below" => __("Mark below as read"),
                                 "catchup_above" => __("Mark above as read"),
@@ -91,6 +89,7 @@
                                 "feed_edit" => __("Edit feed"),
                                 "feed_catchup" => __("Mark as read"),
                                 "feed_reverse" => __("Reverse headlines"),
+                               "feed_toggle_vgroup" => __("Toggle headline grouping"),
                                 "feed_debug_update" => __("Debug feed update"),
                                 "feed_debug_viewfeed" => __("Debug viewfeed()"),
                                 "catchup_all" => __("Mark all feeds as read"),
@@ -135,8 +134,6 @@
                                 "*s" => "toggle_publ",
                                 "u" => "toggle_unread",
                                 "*t" => "edit_tags",
-                               "*d" => "dismiss_selected",
-                               "*x" => "dismiss_read",
                                 "o" => "open_in_new_window",
                                 "c p" => "catchup_below",
                                 "c n" => "catchup_above",
@@ -162,6 +159,7 @@
                                 "f e" => "feed_edit",
                                 "f q" => "feed_catchup",
                                 "f x" => "feed_reverse",
+                               "f g" => "feed_toggle_vgroup",
                                 "f *d" => "feed_debug_update",
                                 "f *g" => "feed_debug_viewfeed",
                                 "f *c" => "toggle_combined_mode",
@@ -207,7 +205,7 @@
  
         function check_for_update() {
                 if (defined("GIT_VERSION_TIMESTAMP")) {
-                       $content = @fetch_file_contents("http://tt-rss.org/version.json");
+                       $content = @fetch_file_contents(array("url" => "http://tt-rss.org/version.json", "timeout" => 5));
  
                         if ($content) {
                                 $content = json_decode($content, true);
@@ -225,7 +223,7 @@
                 return "";
         }
  
-       function make_runtime_info() {
+       function make_runtime_info($disable_update_check = false) {
                 $data = array();
  
                 $result = db_query("SELECT MAX(id) AS mid, COUNT(*) AS nf FROM
@@ -244,7 +242,7 @@
                 $data['reload_on_ts_change'] = !defined('_NO_RELOAD_ON_TS_CHANGE');
  
  
-               if (CHECK_FOR_UPDATES && $_SESSION["last_version_check"] + 86400 + rand(-1000, 1000) < time()) {
+               if (CHECK_FOR_UPDATES && !$disable_update_check && $_SESSION["last_version_check"] + 86400 + rand(-1000, 1000) < time()) {
                         $update_result = @check_for_update();
  
                         $data["update_result"] = $update_result;
@@ -1038,7 +1036,14 @@
  
                 $res = $doc->saveHTML();
  
-               return $res;
+               /* strip everything outside of <body>...</body> */
+
+               $res_frag = array();
+               if (preg_match('/<body>(.*)<\/body>/is', $res, $res_frag)) {
+                       return $res_frag[1];
+               } else {
+                       return $res;
+               }
         }
  
         function strip_harmful_tags($doc, $allowed_elements, $disallowed_attributes) {
@@ -1059,6 +1064,10 @@
                                                 array_push($attrs_to_remove, $attr);
                                         }
  
+                                       if ($attr->nodeName == 'href' && stripos($attr->value, 'javascript:') === 0) {
+                                               array_push($attrs_to_remove, $attr);
+                                       }
+
                                         if (in_array($attr->nodeName, $disallowed_attributes)) {
                                                 array_push($attrs_to_remove, $attr);
                                         }