X-Git-Url: https://git.wh0rd.org/?a=blobdiff_plain;f=classes%2Farticle.php;h=43bcb50494dbd4365e40629ecaf4f3091f3b17c1;hb=07fd4f8d9d4f301f5ad88ff9e80f042fc3eb0c36;hp=64c04e140e251aca402cc95152266823b9e946ef;hpb=a230bf88a9ce4589eeaf2d00226eafb78b4de01c;p=tt-rss.git diff --git a/classes/article.php b/classes/article.php old mode 100644 new mode 100755 index 64c04e14..43bcb504 --- a/classes/article.php +++ b/classes/article.php @@ -8,14 +8,15 @@ class Article extends Handler_Protected { } function redirect() { - $id = $this->dbh->escape_string($_REQUEST['id']); + $id = clean($_REQUEST['id']); - $result = $this->dbh->query("SELECT link FROM ttrss_entries, ttrss_user_entries - WHERE id = '$id' AND id = ref_id AND owner_uid = '".$_SESSION['uid']."' + $sth = $this->pdo->prepare("SELECT link FROM ttrss_entries, ttrss_user_entries + WHERE id = ? AND id = ref_id AND owner_uid = ? LIMIT 1"); + $sth->execute([$id, $_SESSION['uid']]); - if ($this->dbh->num_rows($result) == 1) { - $article_url = $this->dbh->fetch_result($result, 0, 'link'); + if ($row = $sth->fetch()) { + $article_url = $row['link']; $article_url = str_replace("\n", "", $article_url); header("Location: $article_url"); @@ -27,9 +28,9 @@ class Article extends Handler_Protected { } function view() { - $id = $this->dbh->escape_string($_REQUEST["id"]); - $cids = explode(",", $this->dbh->escape_string($_REQUEST["cids"])); - $mode = $this->dbh->escape_string($_REQUEST["mode"]); + $id = clean($_REQUEST["id"]); + $cids = explode(",", clean($_REQUEST["cids"])); + $mode = clean($_REQUEST["mode"]); // in prefetch mode we only output requested cids, main article // just gets marked as read (it already exists in client cache) @@ -43,7 +44,7 @@ class Article extends Handler_Protected { } else if ($mode == "raw") { if (isset($_REQUEST['html'])) { header("Content-Type: text/html"); - print ''; + print ''; } $article = $this->format_article($id, false, isset($_REQUEST["zoom"])); @@ -67,21 +68,23 @@ class Article extends Handler_Protected { private function catchupArticleById($id, $cmode) { if ($cmode == 0) { - $this->dbh->query("UPDATE ttrss_user_entries SET + $sth = $this->pdo->prepare("UPDATE ttrss_user_entries SET unread = false,last_read = NOW() - WHERE ref_id = '$id' AND owner_uid = " . $_SESSION["uid"]); + WHERE ref_id = ? AND owner_uid = ?"); } else if ($cmode == 1) { - $this->dbh->query("UPDATE ttrss_user_entries SET + $sth = $this->pdo->prepare("UPDATE ttrss_user_entries SET unread = true - WHERE ref_id = '$id' AND owner_uid = " . $_SESSION["uid"]); + WHERE ref_id = ? AND owner_uid = ?"); } else { - $this->dbh->query("UPDATE ttrss_user_entries SET + $sth = $this->pdo->prepare("UPDATE ttrss_user_entries SET unread = NOT unread,last_read = NOW() - WHERE ref_id = '$id' AND owner_uid = " . $_SESSION["uid"]); + WHERE ref_id = ? AND owner_uid = ?"); } + $sth->execute([$id, $_SESSION['uid']]); + $feed_id = $this->getArticleFeed($id); - ccache_update($feed_id, $_SESSION["uid"]); + CCache::update($feed_id, $_SESSION["uid"]); } static function create_published_article($title, $url, $content, $labels_str, @@ -102,7 +105,7 @@ class Article extends Handler_Protected { if ($enable_share_anything) { $extracted_content = $af_readability->extract_content($url); - if ($extracted_content) $content = db_escape_string($extracted_content); + if ($extracted_content) $content = $extracted_content; } } } @@ -122,64 +125,75 @@ class Article extends Handler_Protected { if (filter_var($url, FILTER_VALIDATE_URL) === FALSE) return false; - db_query("BEGIN"); + $pdo = Db::pdo(); + + $pdo->beginTransaction(); // only check for our user data here, others might have shared this with different content etc - $result = db_query("SELECT id FROM ttrss_entries, ttrss_user_entries WHERE - guid = '$guid' AND ref_id = id AND owner_uid = '$owner_uid' LIMIT 1"); + $sth = $pdo->prepare("SELECT id FROM ttrss_entries, ttrss_user_entries WHERE + guid = ? AND ref_id = id AND owner_uid = ? LIMIT 1"); + $sth->execute([$guid, $owner_uid]); - if (db_num_rows($result) != 0) { - $ref_id = db_fetch_result($result, 0, "id"); + if ($row = $sth->fetch()) { + $ref_id = $row['id']; - $result = db_query("SELECT int_id FROM ttrss_user_entries WHERE - ref_id = '$ref_id' AND owner_uid = '$owner_uid' LIMIT 1"); + $sth = $pdo->prepare("SELECT int_id FROM ttrss_user_entries WHERE + ref_id = ? AND owner_uid = ? LIMIT 1"); + $sth->execute([$ref_id, $owner_uid]); - if (db_num_rows($result) != 0) { - $int_id = db_fetch_result($result, 0, "int_id"); + if ($row = $sth->fetch()) { + $int_id = $row['int_id']; - db_query("UPDATE ttrss_entries SET - content = '$content', content_hash = '$content_hash' WHERE id = '$ref_id'"); + $sth = $pdo->prepare("UPDATE ttrss_entries SET + content = ?, content_hash = ? WHERE id = ?"); + $sth->execute([$content, $content_hash, $ref_id]); - db_query("UPDATE ttrss_user_entries SET published = true, + $sth = $pdo->prepare("UPDATE ttrss_user_entries SET published = true, last_published = NOW() WHERE - int_id = '$int_id' AND owner_uid = '$owner_uid'"); + int_id = ? AND owner_uid = ?"); + $sth->execute([$int_id, $owner_uid]); + } else { - db_query("INSERT INTO ttrss_user_entries + $sth = $pdo->prepare("INSERT INTO ttrss_user_entries (ref_id, uuid, feed_id, orig_feed_id, owner_uid, published, tag_cache, label_cache, last_read, note, unread, last_published) VALUES - ('$ref_id', '', NULL, NULL, $owner_uid, true, '', '', NOW(), '', false, NOW())"); + (?, '', NULL, NULL, ?, true, '', '', NOW(), '', false, NOW())"); + $sth->execute([$ref_id, $owner_uid]); } if (count($labels) != 0) { foreach ($labels as $label) { - label_add_article($ref_id, trim($label), $owner_uid); + Labels::add_article($ref_id, trim($label), $owner_uid); } } $rc = true; } else { - $result = db_query("INSERT INTO ttrss_entries + $sth = $pdo->prepare("INSERT INTO ttrss_entries (title, guid, link, updated, content, content_hash, date_entered, date_updated) VALUES - ('$title', '$guid', '$url', NOW(), '$content', '$content_hash', NOW(), NOW())"); + (?, ?, ?, NOW(), ?, ?, NOW(), NOW())"); + $sth->execute([$title, $guid, $url, $content, $content_hash]); - $result = db_query("SELECT id FROM ttrss_entries WHERE guid = '$guid'"); + $sth = $pdo->prepare("SELECT id FROM ttrss_entries WHERE guid = ?"); + $sth->execute([$guid]); - if (db_num_rows($result) != 0) { - $ref_id = db_fetch_result($result, 0, "id"); + if ($row = $sth->fetch()) { + $ref_id = $row["id"]; - db_query("INSERT INTO ttrss_user_entries + $sth = $pdo->prepare("INSERT INTO ttrss_user_entries (ref_id, uuid, feed_id, orig_feed_id, owner_uid, published, tag_cache, label_cache, last_read, note, unread, last_published) VALUES - ('$ref_id', '', NULL, NULL, $owner_uid, true, '', '', NOW(), '', false, NOW())"); + (?, '', NULL, NULL, ?, true, '', '', NOW(), '', false, NOW())"); + $sth->execute([$ref_id, $owner_uid]); if (count($labels) != 0) { foreach ($labels as $label) { - label_add_article($ref_id, trim($label), $owner_uid); + Labels::add_article($ref_id, trim($label), $owner_uid); } } @@ -187,7 +201,7 @@ class Article extends Handler_Protected { } } - db_query("COMMIT"); + $pdo->commit(); return $rc; } @@ -196,9 +210,9 @@ class Article extends Handler_Protected { print __("Tags for this article (separated by commas):")."
"; - $param = $this->dbh->escape_string($_REQUEST['param']); + $param = clean($_REQUEST['param']); - $tags = Article::get_article_tags($this->dbh->escape_string($param)); + $tags = Article::get_article_tags($param); $tags_str = join(", ", $tags); @@ -227,11 +241,15 @@ class Article extends Handler_Protected { } function setScore() { - $ids = $this->dbh->escape_string($_REQUEST['id']); - $score = (int)$this->dbh->escape_string($_REQUEST['score']); + $ids = explode(",", clean($_REQUEST['id'])); + $score = (int)clean($_REQUEST['score']); + + $ids_qmarks = arr_qmarks($ids); + + $sth = $this->pdo->prepare("UPDATE ttrss_user_entries SET + score = ? WHERE ref_id IN ($ids_qmarks) AND owner_uid = ?"); - $this->dbh->query("UPDATE ttrss_user_entries SET - score = '$score' WHERE ref_id IN ($ids) AND owner_uid = " . $_SESSION["uid"]); + $sth->execute(array_merge([$score], $ids, [$_SESSION['uid']])); print json_encode(array("id" => $ids, "score" => (int)$score, @@ -239,10 +257,13 @@ class Article extends Handler_Protected { } function getScore() { - $id = $this->dbh->escape_string($_REQUEST['id']); + $id = clean($_REQUEST['id']); - $result = $this->dbh->query("SELECT score FROM ttrss_user_entries WHERE ref_id = $id AND owner_uid = " . $_SESSION["uid"]); - $score = $this->dbh->fetch_result($result, 0, "score"); + $sth = $this->pdo->prepare("SELECT score FROM ttrss_user_entries WHERE ref_id = ? AND owner_uid = ?"); + $sth->execute([$id, $_SESSION['uid']]); + $row = $sth->fetch(); + + $score = $row['score']; print json_encode(array("id" => $id, "score" => (int)$score, @@ -252,24 +273,26 @@ class Article extends Handler_Protected { function setArticleTags() { - $id = $this->dbh->escape_string($_REQUEST["id"]); + $id = clean($_REQUEST["id"]); - $tags_str = $this->dbh->escape_string($_REQUEST["tags_str"]); + $tags_str = clean($_REQUEST["tags_str"]); $tags = array_unique(trim_array(explode(",", $tags_str))); - $this->dbh->query("BEGIN"); + $this->pdo->beginTransaction(); - $result = $this->dbh->query("SELECT int_id FROM ttrss_user_entries WHERE - ref_id = '$id' AND owner_uid = '".$_SESSION["uid"]."' LIMIT 1"); + $sth = $this->pdo->prepare("SELECT int_id FROM ttrss_user_entries WHERE + ref_id = ? AND owner_uid = ? LIMIT 1"); + $sth->execute([$id, $_SESSION['uid']]); - if ($this->dbh->num_rows($result) == 1) { + if ($row = $sth->fetch()) { $tags_to_cache = array(); - $int_id = $this->dbh->fetch_result($result, 0, "int_id"); + $int_id = $row['int_id']; - $this->dbh->query("DELETE FROM ttrss_tags WHERE - post_int_id = $int_id AND owner_uid = '".$_SESSION["uid"]."'"); + $sth = $this->pdo->prepare("DELETE FROM ttrss_tags WHERE + post_int_id = ? AND owner_uid = ?"); + $sth->execute([$int_id, $_SESSION['uid']]); foreach ($tags as $tag) { $tag = sanitize_tag($tag); @@ -285,8 +308,11 @@ class Article extends Handler_Protected { // print ""; if ($tag != '') { - $this->dbh->query("INSERT INTO ttrss_tags - (post_int_id, owner_uid, tag_name) VALUES ('$int_id', '".$_SESSION["uid"]."', '$tag')"); + $sth = $this->pdo->prepare("INSERT INTO ttrss_tags + (post_int_id, owner_uid, tag_name) + VALUES (?, ?, ?)"); + + $sth->execute([$int_id, $_SESSION['uid'], $tag]); } array_push($tags_to_cache, $tag); @@ -297,12 +323,12 @@ class Article extends Handler_Protected { sort($tags_to_cache); $tags_str = join(",", $tags_to_cache); - $this->dbh->query("UPDATE ttrss_user_entries - SET tag_cache = '$tags_str' WHERE ref_id = '$id' - AND owner_uid = " . $_SESSION["uid"]); + $sth = $this->pdo->prepare("UPDATE ttrss_user_entries + SET tag_cache = ? WHERE ref_id = ? AND owner_uid = ?"); + $sth->execute([$tags_str, $id, $_SESSION['uid']]); } - $this->dbh->query("COMMIT"); + $this->pdo->commit(); $tags = Article::get_article_tags($id); $tags_str = $this->format_tags_string($tags, $id); @@ -316,15 +342,17 @@ class Article extends Handler_Protected { function completeTags() { - $search = $this->dbh->escape_string($_REQUEST["search"]); + $search = clean($_REQUEST["search"]); - $result = $this->dbh->query("SELECT DISTINCT tag_name FROM ttrss_tags - WHERE owner_uid = '".$_SESSION["uid"]."' AND - tag_name LIKE '$search%' ORDER BY tag_name + $sth = $this->pdo->prepare("SELECT DISTINCT tag_name FROM ttrss_tags + WHERE owner_uid = ? AND + tag_name LIKE ? ORDER BY tag_name LIMIT 10"); + $sth->execute([$_SESSION['uid'], "$search%"]); + print ""; @@ -341,11 +369,10 @@ class Article extends Handler_Protected { private function labelops($assign) { $reply = array(); - $ids = explode(",", $this->dbh->escape_string($_REQUEST["ids"])); - $label_id = $this->dbh->escape_string($_REQUEST["lid"]); + $ids = explode(",", clean($_REQUEST["ids"])); + $label_id = clean($_REQUEST["lid"]); - $label = $this->dbh->escape_string(label_find_caption($label_id, - $_SESSION["uid"])); + $label = Labels::find_caption($label_id, $_SESSION["uid"]); $reply["info-for-headlines"] = array(); @@ -354,11 +381,11 @@ class Article extends Handler_Protected { foreach ($ids as $id) { if ($assign) - label_add_article($id, $label, $_SESSION["uid"]); + Labels::add_article($id, $label, $_SESSION["uid"]); else - label_remove_article($id, $label, $_SESSION["uid"]); + Labels::remove_article($id, $label, $_SESSION["uid"]); - $labels = get_article_labels($id, $_SESSION["uid"]); + $labels = $this->get_article_labels($id, $_SESSION["uid"]); array_push($reply["info-for-headlines"], array("id" => $id, "labels" => $this->format_article_labels($labels))); @@ -372,11 +399,12 @@ class Article extends Handler_Protected { } function getArticleFeed($id) { - $result = db_query("SELECT feed_id FROM ttrss_user_entries - WHERE ref_id = '$id' AND owner_uid = " . $_SESSION["uid"]); + $sth = $this->pdo->prepare("SELECT feed_id FROM ttrss_user_entries + WHERE ref_id = ? AND owner_uid = ?"); + $sth->execute([$id, $_SESSION['uid']]); - if (db_num_rows($result) != 0) { - return db_fetch_result($result, 0, "feed_id"); + if ($row = $sth->fetch()) { + return $row["feed_id"]; } else { return 0; } @@ -530,24 +558,29 @@ class Article extends Handler_Protected { /* we can figure out feed_id from article id anyway, why do we * pass feed_id here? let's ignore the argument :(*/ - $result = db_query("SELECT feed_id FROM ttrss_user_entries - WHERE ref_id = '$id'"); + $pdo = Db::pdo(); - $feed_id = (int) db_fetch_result($result, 0, "feed_id"); + $sth = $pdo->prepare("SELECT feed_id FROM ttrss_user_entries + WHERE ref_id = ?"); + $sth->execute([$id]); + $row = $sth->fetch(); + + $feed_id = (int) $row["feed_id"]; $rv['feed_id'] = $feed_id; //if (!$zoom_mode) { print "
prepare("UPDATE ttrss_user_entries SET unread = false,last_read = NOW() - WHERE ref_id = '$id' AND owner_uid = $owner_uid"); + WHERE ref_id = ? AND owner_uid = ?"); + $sth->execute([$id, $owner_uid]); - ccache_update($feed_id, $owner_uid); + CCache::update($feed_id, $owner_uid); } - $result = db_query("SELECT id,title,link,content,feed_id,comments,int_id,lang, + $sth = $pdo->prepare("SELECT id,title,link,content,feed_id,comments,int_id,lang, ".SUBSTRING_FOR_DATE."(updated,1,16) as updated, (SELECT site_url FROM ttrss_feeds WHERE id = feed_id) as site_url, (SELECT title FROM ttrss_feeds WHERE id = feed_id) as feed_title, @@ -560,23 +593,24 @@ class Article extends Handler_Protected { orig_feed_id, note FROM ttrss_entries,ttrss_user_entries - WHERE id = '$id' AND ref_id = id AND owner_uid = $owner_uid"); - - if ($result) { + WHERE id = ? AND ref_id = id AND owner_uid = ?"); + $sth->execute([$id, $owner_uid]); - $line = db_fetch_assoc($result); + if ($line = $sth->fetch()) { $line["tags"] = Article::get_article_tags($id, $owner_uid, $line["tag_cache"]); unset($line["tag_cache"]); $line["content"] = sanitize($line["content"], - sql_bool_to_bool($line['hide_images']), + $line['hide_images'], $owner_uid, $line["site_url"], false, $line["id"]); foreach (PluginHost::getInstance()->get_hooks(PluginHost::HOOK_RENDER_ARTICLE) as $p) { $line = $p->hook_render_article($line); } + $line['content'] = rewrite_cached_urls($line['content']); + $num_comments = (int) $line["num_comments"]; $entry_comments = ""; @@ -586,34 +620,67 @@ class Article extends Handler_Protected { } else { $comments_url = htmlspecialchars($line["link"]); } - $entry_comments = "$num_comments ". _ngettext("comment", "comments", $num_comments).""; } else { if ($line["comments"] && $line["link"] != $line["comments"]) { - $entry_comments = "".__("comments").""; + $entry_comments = "".__("comments").""; } } + $enclosures = self::get_article_enclosures($line["id"]); + if ($zoom_mode) { header("Content-Type: text/html"); - $rv['content'] .= " + $rv['content'] .= " + - Tiny Tiny RSS - ".$line["title"]."". - stylesheet_tag("css/tt-rss.css"). - stylesheet_tag("css/zoom.css"). - stylesheet_tag("css/dijit.css")." - + ".$line["title"]."". + stylesheet_tag("css/default.css")." - + "; + + $rv['content'] .= "\n"; + $rv['content'] .= "\n"; + $rv['content'] .= "\n"; + + $rv['content'] .= ""; + + $og_image = false; + + foreach ($enclosures as $enc) { + if (strpos($enc["content_type"], "image/") !== FALSE) { + $og_image = $enc["content_url"]; + break; + } + } + + if (!$og_image) { + $tmpdoc = new DOMDocument(); - "; + if (@$tmpdoc->loadHTML(mb_substr($line["content"], 0, 131070))) { + $tmpxpath = new DOMXPath($tmpdoc); + $first_img = $tmpxpath->query("//img")->item(0); + + if ($first_img) { + $og_image = $first_img->getAttribute("src"); + } + } + } + + if ($og_image) { + $rv['content'] .= ""; + } + + $rv['content'] .= ""; } - $rv['content'] .= "
"; + $rv['content'] .= "
"; - $rv['content'] .= "
"; + $rv['content'] .= "
"; $entry_author = $line["author"]; @@ -625,25 +692,25 @@ class Article extends Handler_Protected { $owner_uid, true); if (!$zoom_mode) - $rv['content'] .= "
$parsed_updated
"; + $rv['content'] .= "
$parsed_updated
"; if ($line["link"]) { - $rv['content'] .= "
" . $line["title"] . "" . "$entry_author
"; } else { - $rv['content'] .= "
" . $line["title"] . "$entry_author
"; + $rv['content'] .= "
" . $line["title"] . "$entry_author
"; } if ($zoom_mode) { $feed_title = htmlspecialchars($line["feed_title"]); - $rv['content'] .= "
$feed_title
"; + $rv['content'] .= "
$feed_title
"; - $rv['content'] .= "
$parsed_updated
"; + $rv['content'] .= "
$parsed_updated
"; } $tags_str = Article::format_tags_string($line["tags"], $id); @@ -653,7 +720,7 @@ class Article extends Handler_Protected { if (!$entry_comments) $entry_comments = " "; # placeholder - $rv['content'] .= "