fix various issues reported by static analysis

[tt-rss.git] / include / functions2.php

diff --git a/include/functions2.php b/include/functions2.php
index d490ae50c74c286e4e23cff3795a3847748eb7bc..f9ee8245f2bfd4df85eae76532420ea5836bfc82 100644 (file)
--- a/include/functions2.php
+++ b/include/functions2.php
@@ -896,7 +896,7 @@
                $ttrss_uses_https = parse_url(get_self_url_prefix(), PHP_URL_SCHEME) === 'https';
                $rewrite_base_url = $site_url ? $site_url : SELF_URL_PATH;
 
-               $entries = $xpath->query('(//a[@href]|//img[@src]|//video/source[@src])');
+               $entries = $xpath->query('(//a[@href]|//img[@src]|//video/source[@src]|//audio/source[@src])');
 
                foreach ($entries as $entry) {
 
@@ -909,12 +909,22 @@
 
                        if ($entry->hasAttribute('src')) {
                                $src = rewrite_relative_url($rewrite_base_url, $entry->getAttribute('src'));
-
-                               $extension = $entry->tagName == 'source' ? '.mp4' : '.png';
-                               $cached_filename = CACHE_DIR . '/images/' . sha1($src) . $extension;
+                               $cached_filename = CACHE_DIR . '/images/' . sha1($src);
 
                                if (file_exists($cached_filename)) {
-                                       $src = get_self_url_prefix() . '/public.php?op=cached_image&hash=' . sha1($src) . $extension;
+
+                                       // this is strictly cosmetic
+                                       if ($entry->tagName == 'img') {
+                                               $suffix = ".png";
+                                       } else if ($entry->parentNode && $entry->parentNode->tagName == "video") {
+                                               $suffix = ".mp4";
+                                       } else if ($entry->parentNode && $entry->parentNode->tagName == "audio") {
+                                               $suffix = ".ogg";
+                                       } else {
+                                               $suffix = "";
+                                       }
+
+                                       $src = get_self_url_prefix() . '/public.php?op=cached_url&hash=' . sha1($src) . $suffix;
 
                                        if ($entry->hasAttribute('srcset')) {
                                                $entry->removeAttribute('srcset');
@@ -955,6 +965,7 @@
 
                                        $a->appendChild(new DOMText($entry->getAttribute('src')));
                                        $a->setAttribute('target', '_blank');
+                                       $a->setAttribute('rel', 'noopener noreferrer');
 
                                        $p->appendChild($a);
 
@@ -964,6 +975,7 @@
 
                        if (strtolower($entry->nodeName) == "a") {
                                $entry->setAttribute("target", "_blank");
+                               $entry->setAttribute("rel", "noopener noreferrer");
                        }
                }
 
@@ -1249,7 +1261,7 @@
                                        </object>";
                        }
 
-                       if ($entry) $entry .= "&nbsp; <a target=\"_blank\"
+                       if ($entry) $entry .= "&nbsp; <a target=\"_blank\" rel=\"noopener noreferrer\"
                                href=\"$url\">" . basename($url) . "</a>";
 
                        return $entry;
@@ -1260,7 +1272,7 @@
 
 /*             $filename = substr($url, strrpos($url, "/")+1);
 
-               $entry .= " <a target=\"_blank\" href=\"" . htmlspecialchars($url) . "\">" .
+               $entry .= " <a target=\"_blank\" rel=\"noopener noreferrer\" href=\"" . htmlspecialchars($url) . "\">" .
                        $filename . " (" . $ctype . ")" . "</a>"; */
 
        }
@@ -1332,12 +1344,12 @@
                                        $comments_url = htmlspecialchars($line["link"]);
                                }
                                $entry_comments = "<a class=\"postComments\"
-                                       target='_blank' href=\"$comments_url\">$num_comments ".
+                                       target='_blank' rel=\"noopener noreferrer\" href=\"$comments_url\">$num_comments ".
                                        _ngettext("comment", "comments", $num_comments)."</a>";
 
                        } else {
                                if ($line["comments"] && $line["link"] != $line["comments"]) {
-                                       $entry_comments = "<a class=\"postComments\" target='_blank' href=\"".htmlspecialchars($line["comments"])."\">".__("comments")."</a>";
+                                       $entry_comments = "<a class=\"postComments\" target='_blank' rel=\"noopener noreferrer\" href=\"".htmlspecialchars($line["comments"])."\">".__("comments")."</a>";
                                }
                        }
 
@@ -1373,7 +1385,7 @@
                                $rv['content'] .= "<div class=\"postDate\">$parsed_updated</div>";
 
                        if ($line["link"]) {
-                               $rv['content'] .= "<div class='postTitle'><a target='_blank'
+                               $rv['content'] .= "<div class='postTitle'><a target='_blank' rel='noopener noreferrer'
                                        title=\"".htmlspecialchars($line['title'])."\"
                                        href=\"" .
                                        htmlspecialchars($line["link"]) . "\">" .
@@ -1442,13 +1454,13 @@
 
                                        $tmp_line = db_fetch_assoc($tmp_result);
 
-                                       $rv['content'] .= "<a target='_blank'
+                                       $rv['content'] .= "<a target='_blank' rel='noopener noreferrer'
                                                href=' " . htmlspecialchars($tmp_line['site_url']) . "'>" .
                                                $tmp_line['title'] . "</a>";
 
                                        $rv['content'] .= "&nbsp;";
 
-                                       $rv['content'] .= "<a target='_blank' href='" . htmlspecialchars($tmp_line['feed_url']) . "'>";
+                                       $rv['content'] .= "<a target='_blank' rel='noopener noreferrer' href='" . htmlspecialchars($tmp_line['feed_url']) . "'>";
                                        $rv['content'] .= "<img title='".__('Feed URL')."' class='tinyFeedIcon' src='images/pub_set.png'></a>";
 
                                        $rv['content'] .= "</div>";
@@ -1545,7 +1557,7 @@
                }
        } // function encrypt_password
 
-       function load_filters($feed_id, $owner_uid, $action_id = false) {
+       function load_filters($feed_id, $owner_uid) {
                $filters = array();
 
                $cat_id = (int)getFeedCategory($feed_id);
@@ -1643,7 +1655,7 @@
                return true;
        }
 
-       function format_tags_string($tags, $id) {
+       function format_tags_string($tags) {
                if (!is_array($tags) || count($tags) == 0) {
                        return __("no tags");
                } else {
@@ -1663,7 +1675,7 @@
                }
        }
 
-       function format_article_labels($labels, $id) {
+       function format_article_labels($labels) {
 
                if (!is_array($labels)) return '';
 
@@ -1816,6 +1828,11 @@
 
                if (db_num_rows($result) > 0) {
                        while ($line = db_fetch_assoc($result)) {
+
+                               if (file_exists(CACHE_DIR . '/images/' . sha1($line["content_url"]))) {
+                                       $line["content_url"] = get_self_url_prefix() . '/public.php?op=cached_url&hash=' . sha1($line["content_url"]);
+                               }
+
                                array_push($rv, $line);
                        }
                }
@@ -1900,7 +1917,7 @@
                        WHERE owner_uid = '".$_SESSION["uid"]."' ORDER BY caption");
 
                print "<select default=\"$value\" name=\"" . htmlspecialchars($name) .
-                       "\" $attributes onchange=\"labelSelectOnChange(this)\" >";
+                       "\" $attributes>";
 
                while ($line = db_fetch_assoc($result)) {
 
@@ -1942,6 +1959,10 @@
 
                        foreach ($result as $line) {
 
+                               foreach (PluginHost::getInstance()->get_hooks(PluginHost::HOOK_ENCLOSURE_ENTRY) as $plugin) {
+                                       $line = $plugin->hook_enclosure_entry($line);
+                               }
+                               
                                $url = $line["content_url"];
                                $ctype = $line["content_type"];
                                $title = $line["title"];
@@ -1957,7 +1978,7 @@
 
                                if ($player) array_push($entries_inline, $player);
 
-#                              $entry .= " <a target=\"_blank\" href=\"" . htmlspecialchars($url) . "\">" .
+#                              $entry .= " <a target=\"_blank\" href=\"" . htmlspecialchars($url) . "\" rel=\"noopener noreferrer\">" .
 #                                      $filename . " (" . $ctype . ")" . "</a>";
 
                                $entry = "<div onclick=\"openUrlPopup('".htmlspecialchars($url)."')\"
@@ -1991,8 +2012,7 @@
                                                        $rv .= $retval;
                                                } else {
 
-                                                       if (preg_match("/image/", $entry["type"]) ||
-                                                                       preg_match("/\.(jpg|png|gif|bmp)/i", $entry["filename"])) {
+                                                       if (preg_match("/image/", $entry["type"])) {
 
                                                                        if (!$hide_images) {
                                                                                $encsize = '';
@@ -2005,7 +2025,7 @@
                                                                                src=\"" .htmlspecialchars($entry["url"]) . "\"
                                                                                " . $encsize . " /></p>";
                                                                        } else {
-                                                                               $rv .= "<p><a target=\"_blank\"
+                                                                               $rv .= "<p><a target=\"_blank\" rel=\"noopener noreferrer\"
                                                                                href=\"".htmlspecialchars($entry["url"])."\"
                                                                                >" .htmlspecialchars($entry["url"]) . "</a></p>";
                                                                        }
@@ -2068,6 +2088,13 @@
                return $parts['scheme'] . "://" . $parts['host'] . $parts['path'];
        }
 
+       function cleanup_url_path($path) {
+               $path = str_replace("/./", "/", $path);
+               $path = str_replace("//", "/", $path);
+
+               return $path;
+       }
+
        /**
         * Converts a (possibly) relative URL to a absolute one.
         *
@@ -2088,6 +2115,7 @@
                } else if (strpos($rel_url, "/") === 0) {
                        $parts = parse_url($url);
                        $parts['path'] = $rel_url;
+                       $parts['path'] = cleanup_url_path($parts['path']);
 
                        return build_url($parts);
 
@@ -2102,6 +2130,7 @@
                                $dir !== '/' && $dir .= '/';
                        }
                        $parts['path'] = $dir . $rel_url;
+                       $parts['path'] = cleanup_url_path($parts['path']);
 
                        return build_url($parts);
                }
@@ -2455,6 +2484,9 @@
                return false;
        }
 
+       /**
+        * @SuppressWarnings(unused)
+        */
        function error_json($code) {
                require_once "errors.php";