Remove href attribute if it executes JavaScript.

[tt-rss.git] / include / functions2.php

diff --git a/include/functions2.php b/include/functions2.php
old mode 100755 (executable)
new mode 100644 (file)
index fb2fff2..dceea50
--- a/include/functions2.php
+++ b/include/functions2.php
@@ -64,8 +64,6 @@
                                "toggle_publ" => __("Toggle published"),
                                "toggle_unread" => __("Toggle unread"),
                                "edit_tags" => __("Edit tags"),
-                               "dismiss_selected" => __("Dismiss selected"),
-                               "dismiss_read" => __("Dismiss read"),
                                "open_in_new_window" => __("Open in new window"),
                                "catchup_below" => __("Mark below as read"),
                                "catchup_above" => __("Mark above as read"),
@@ -91,6 +89,7 @@
                                "feed_edit" => __("Edit feed"),
                                "feed_catchup" => __("Mark as read"),
                                "feed_reverse" => __("Reverse headlines"),
+                               "feed_toggle_vgroup" => __("Toggle headline grouping"),
                                "feed_debug_update" => __("Debug feed update"),
                                "feed_debug_viewfeed" => __("Debug viewfeed()"),
                                "catchup_all" => __("Mark all feeds as read"),
@@ -135,8 +134,6 @@
                                "*s" => "toggle_publ",
                                "u" => "toggle_unread",
                                "*t" => "edit_tags",
-                               "*d" => "dismiss_selected",
-                               "*x" => "dismiss_read",
                                "o" => "open_in_new_window",
                                "c p" => "catchup_below",
                                "c n" => "catchup_above",
@@ -162,6 +159,7 @@
                                "f e" => "feed_edit",
                                "f q" => "feed_catchup",
                                "f x" => "feed_reverse",
+                               "f g" => "feed_toggle_vgroup",
                                "f *d" => "feed_debug_update",
                                "f *g" => "feed_debug_viewfeed",
                                "f *c" => "toggle_combined_mode",
@@ -207,7 +205,7 @@
 
        function check_for_update() {
                if (defined("GIT_VERSION_TIMESTAMP")) {
-                       $content = @fetch_file_contents("http://tt-rss.org/version.json");
+                       $content = @fetch_file_contents(array("url" => "http://tt-rss.org/version.json", "timeout" => 5));
 
                        if ($content) {
                                $content = json_decode($content, true);
@@ -225,7 +223,7 @@
                return "";
        }
 
-       function make_runtime_info() {
+       function make_runtime_info($disable_update_check = false) {
                $data = array();
 
                $result = db_query("SELECT MAX(id) AS mid, COUNT(*) AS nf FROM
@@ -244,7 +242,7 @@
                $data['reload_on_ts_change'] = !defined('_NO_RELOAD_ON_TS_CHANGE');
 
 
-               if (CHECK_FOR_UPDATES && $_SESSION["last_version_check"] + 86400 + rand(-1000, 1000) < time()) {
+               if (CHECK_FOR_UPDATES && !$disable_update_check && $_SESSION["last_version_check"] + 86400 + rand(-1000, 1000) < time()) {
                        $update_result = @check_for_update();
 
                        $data["update_result"] = $update_result;
@@ -912,6 +910,14 @@
 
                                        if (file_exists($cached_filename)) {
                                                $src = SELF_URL_PATH . '/public.php?op=cached_image&hash=' . sha1($src);
+
+                                               if ($entry->hasAttribute('srcset')) {
+                                                       $entry->removeAttribute('srcset');
+                                               }
+
+                                               if ($entry->hasAttribute('sizes')) {
+                                                       $entry->removeAttribute('sizes');
+                                               }
                                        }
 
                                        $entry->setAttribute('src', $src);
@@ -979,7 +985,7 @@
                        'ol', 'p', 'pre', 'q', 'ruby', 'rp', 'rt', 's', 'samp', 'section',
                        'small', 'source', 'span', 'strike', 'strong', 'sub', 'summary',
                        'sup', 'table', 'tbody', 'td', 'tfoot', 'th', 'thead', 'time',
-                       'tr', 'track', 'tt', 'u', 'ul', 'var', 'wbr', 'video' );
+                       'tr', 'track', 'tt', 'u', 'ul', 'var', 'wbr', 'video', 'xml:namespace' );
 
                if ($_SESSION['hasSandbox']) $allowed_elements[] = 'iframe';
 
@@ -1030,7 +1036,14 @@
 
                $res = $doc->saveHTML();
 
-               return $res;
+               /* strip everything outside of <body>...</body> */
+
+               $res_frag = array();
+               if (preg_match('/<body>(.*)<\/body>/is', $res, $res_frag)) {
+                       return $res_frag[1];
+               } else {
+                       return $res;
+               }
        }
 
        function strip_harmful_tags($doc, $allowed_elements, $disallowed_attributes) {
@@ -1051,6 +1064,10 @@
                                                array_push($attrs_to_remove, $attr);
                                        }
 
+                                       if ($attr->nodeName == 'href' && stripos($attr->value, 'javascript:') === 0) {
+                                               array_push($attrs_to_remove, $attr);
+                                       }
+
                                        if (in_array($attr->nodeName, $disallowed_attributes)) {
                                                array_push($attrs_to_remove, $attr);
                                        }
@@ -1410,7 +1427,7 @@
                        if ($line["orig_feed_id"]) {
 
                                $tmp_result = db_query("SELECT * FROM ttrss_archived_feeds
-                                       WHERE id = ".$line["orig_feed_id"]);
+                                       WHERE id = ".$line["orig_feed_id"] . " AND owner_uid = " . $_SESSION["uid"]);
 
                                if (db_num_rows($tmp_result) != 0) {
 
@@ -2040,15 +2057,15 @@
         * @return string Absolute URL
         */
        function rewrite_relative_url($url, $rel_url) {
-               if (strpos($rel_url, ":") !== false) {
-                       return $rel_url;
-               } else if (strpos($rel_url, "://") !== false) {
+               if (strpos($rel_url, "://") !== false) {
                        return $rel_url;
                } else if (strpos($rel_url, "//") === 0) {
                        # protocol-relative URL (rare but they exist)
                        return $rel_url;
-               } else if (strpos($rel_url, "/") === 0)
-               {
+               } else if (preg_match("/^[a-z]+:/i", $rel_url)) {
+                       # magnet:, feed:, etc
+                       return $rel_url;
+               } else if (strpos($rel_url, "/") === 0) {
                        $parts = parse_url($url);
                        $parts['path'] = $rel_url;