implement ProtectedHandler

diff --git a/classes/article.php b/classes/article.php
index 70ecd2653398dcd026114c088dfbaa80aac30bbb..90ca129b9335c6fe458015ea44b3c1170413b3d7 100644 (file)
--- a/classes/article.php
+++ b/classes/article.php
@@ -1,5 +1,5 @@
 <?php\r
-class Article extends Handler {\r
+class Article extends Protected_Handler {\r
 \r
        function redirect() {\r
                $id = db_escape_string($_REQUEST['id']);\r

diff --git a/classes/dlg.php b/classes/dlg.php
index 3a66bf129594647bb724c5611dd5dc006d846910..dce583e013a230867767505b2dad6d24032986b1 100644 (file)
--- a/classes/dlg.php
+++ b/classes/dlg.php
@@ -1,7 +1,7 @@
 <?php
-class Dlg extends Handler {
+class Dlg extends Protected_Handler {
        private $param;
-       
+
        function before() {
                if (parent::before()) {
                        header("Content-Type: text/xml; charset=utf-8");
@@ -11,14 +11,14 @@ class Dlg extends Handler {
                }
                return false;
        }
-       
+
        function after() {
                print "</dlg>";
        }
 
        function importOpml() {
                header("Content-Type: text/html"); # required for iframe
-               
+
                print "<div class=\"prefFeedOPMLHolder\">";
                $owner_uid = $_SESSION["uid"];
 
@@ -534,7 +534,7 @@ class Dlg extends Handler {
        }
 
        function inactiveFeeds() {
-       
+
                if (DB_TYPE == "pgsql") {
                        $interval_qpart = "NOW() - INTERVAL '3 months'";
                } else {
@@ -714,7 +714,7 @@ class Dlg extends Handler {
        }
 
        function printTagSelect() {
-       
+
                print "<title>" . __('Select item(s) by tags') . "</title>";
                print "<content><![CDATA[";
 
@@ -851,7 +851,7 @@ class Dlg extends Handler {
        }
 
        function generatedFeed() {
-       
+
                print "<title>".__('View as RSS')."</title>";
                print "<content><![CDATA[";
 
@@ -884,7 +884,7 @@ class Dlg extends Handler {
        }
 
        function newVersion() {
-       
+
                $version_data = check_for_update($this->link);
                $version = $version_data['version'];
                $id = $version_data['version_id'];

diff --git a/classes/feeds.php b/classes/feeds.php
index a654c92aea6a88249783db2a8387734d994c8ac8..f4d19c00c40df1eb5e6106ffeecb9dec42857f40 100644 (file)
--- a/classes/feeds.php
+++ b/classes/feeds.php
@@ -1,11 +1,11 @@
 <?php\r
-class Feeds extends Handler {\r
-       \r
+class Feeds extends Protected_Handler {\r
+\r
        function catchupAll() {\r
                db_query($this->link, "UPDATE ttrss_user_entries SET\r
                                                last_read = NOW(),unread = false WHERE owner_uid = " . $_SESSION["uid"]);\r
                ccache_zero_all($this->link, $_SESSION["uid"]);\r
-       }       \r
+       }\r
 \r
        function collapse() {\r
                $cat_id = db_escape_string($_REQUEST["cid"]);\r
@@ -15,36 +15,36 @@ class Feeds extends Handler {
 \r
        function index() {\r
                $root = (bool)$_REQUEST["root"];\r
-       \r
+\r
                if (!$root) {\r
                        print json_encode(outputFeedList($this->link));\r
                } else {\r
-               \r
+\r
                        $feeds = outputFeedList($this->link, false);\r
-               \r
+\r
                        $root = array();\r
                        $root['id'] = 'root';\r
                        $root['name'] = __('Feeds');\r
                        $root['items'] = $feeds['items'];\r
-               \r
+\r
                        $fl = array();\r
                        $fl['identifier'] = 'id';\r
                        $fl['label'] = 'name';\r
                        $fl['items'] = array($root);\r
-               \r
+\r
                        print json_encode($fl);\r
                }\r
-       }       \r
-       \r
+       }\r
+\r
        function view() {\r
                $timing_info = getmicrotime();\r
-               \r
+\r
                $reply = array();\r
-               \r
+\r
                if ($_REQUEST["debug"]) $timing_info = print_checkpoint("0", $timing_info);\r
-               \r
+\r
                $omode = db_escape_string($_REQUEST["omode"]);\r
-               \r
+\r
                $feed = db_escape_string($_REQUEST["feed"]);\r
                $method = db_escape_string($_REQUEST["m"]);\r
                $view_mode = db_escape_string($_REQUEST["view_mode"]);\r
@@ -54,19 +54,19 @@ class Feeds extends Handler {
                @$offset = db_escape_string($_REQUEST["skip"]);\r
                @$vgroup_last_feed = db_escape_string($_REQUEST["vgrlf"]);\r
                $order_by = db_escape_string($_REQUEST["order_by"]);\r
-               \r
+\r
                if (is_numeric($feed)) $feed = (int) $feed;\r
-               \r
+\r
                /* Feed -5 is a special case: it is used to display auxiliary information\r
                 * when there's nothing to load - e.g. no stuff in fresh feed */\r
-               \r
+\r
                if ($feed == -5) {\r
                        print json_encode(generate_dashboard_feed($this->link));\r
                        return;\r
                }\r
-               \r
+\r
                $result = false;\r
-               \r
+\r
                if ($feed < -10) {\r
                        $label_feed = -11-$feed;\r
                        $result = db_query($this->link, "SELECT id FROM ttrss_labels2 WHERE\r
@@ -78,45 +78,45 @@ class Feeds extends Handler {
                        $result = db_query($this->link, "SELECT id FROM ttrss_feed_categories WHERE\r
                                                        id = '$feed' AND owner_uid = " . $_SESSION['uid']);\r
                }\r
-               \r
+\r
                if ($result && db_num_rows($result) == 0) {\r
                        print json_encode(generate_error_feed($this->link, __("Feed not found.")));\r
                        return;\r
                }\r
-               \r
+\r
                /* Updating a label ccache means recalculating all of the caches\r
                 * so for performance reasons we don't do that here */\r
-               \r
+\r
                if ($feed >= 0) {\r
                        ccache_update($this->link, $feed, $_SESSION["uid"], $cat_view);\r
                }\r
-               \r
+\r
                set_pref($this->link, "_DEFAULT_VIEW_MODE", $view_mode);\r
                set_pref($this->link, "_DEFAULT_VIEW_LIMIT", $limit);\r
                set_pref($this->link, "_DEFAULT_VIEW_ORDER_BY", $order_by);\r
-               \r
+\r
                if (!$cat_view && preg_match("/^[0-9][0-9]*$/", $feed)) {\r
                        db_query($this->link, "UPDATE ttrss_feeds SET last_viewed = NOW()\r
                                                        WHERE id = '$feed' AND owner_uid = ".$_SESSION["uid"]);\r
                }\r
-               \r
+\r
                $reply['headlines'] = array();\r
-               \r
+\r
                if (!$next_unread_feed)\r
                        $reply['headlines']['id'] = $feed;\r
                else\r
                        $reply['headlines']['id'] = $next_unread_feed;\r
-               \r
+\r
                $reply['headlines']['is_cat'] = (bool) $cat_view;\r
-               \r
+\r
                $override_order = false;\r
-               \r
+\r
                if (get_pref($this->link, "SORT_HEADLINES_BY_FEED_DATE", $owner_uid)) {\r
                        $date_sort_field = "updated";\r
                } else {\r
                        $date_sort_field = "date_entered";\r
                }\r
-               \r
+\r
                switch ($order_by) {\r
                        case "date":\r
                                if (get_pref($this->link, 'REVERSE_HEADLINES', $owner_uid)) {\r
@@ -125,7 +125,7 @@ class Feeds extends Handler {
                                        $override_order = "$date_sort_field DESC";\r
                                }\r
                                break;\r
-               \r
+\r
                        case "title":\r
                                if (get_pref($this->link, 'REVERSE_HEADLINES', $owner_uid)) {\r
                                        $override_order = "title DESC, $date_sort_field";\r
@@ -133,7 +133,7 @@ class Feeds extends Handler {
                                        $override_order = "title, $date_sort_field DESC";\r
                                }\r
                                break;\r
-               \r
+\r
                        case "score":\r
                                if (get_pref($this->link, 'REVERSE_HEADLINES', $owner_uid)) {\r
                                        $override_order = "score, $date_sort_field";\r
@@ -142,46 +142,46 @@ class Feeds extends Handler {
                                }\r
                                break;\r
                }\r
-               \r
+\r
                if ($_REQUEST["debug"]) $timing_info = print_checkpoint("04", $timing_info);\r
-               \r
+\r
                $ret = format_headlines_list($this->link, $feed, $method,\r
                        $view_mode, $limit, $cat_view, $next_unread_feed, $offset,\r
                        $vgroup_last_feed, $override_order);\r
-               \r
+\r
                $topmost_article_ids = $ret[0];\r
                $headlines_count = $ret[1];\r
                $returned_feed = $ret[2];\r
                $disable_cache = $ret[3];\r
                $vgroup_last_feed = $ret[4];\r
-               \r
+\r
                $reply['headlines']['content'] =& $ret[5]['content'];\r
                $reply['headlines']['toolbar'] =& $ret[5]['toolbar'];\r
-               \r
+\r
                if ($_REQUEST["debug"]) $timing_info = print_checkpoint("05", $timing_info);\r
-               \r
+\r
                $reply['headlines-info'] = array("count" => (int) $headlines_count,\r
                                                "vgroup_last_feed" => $vgroup_last_feed,\r
                                                "disable_cache" => (bool) $disable_cache);\r
-               \r
+\r
                if ($_REQUEST["debug"]) $timing_info = print_checkpoint("20", $timing_info);\r
-               \r
+\r
                if (is_array($topmost_article_ids) && !get_pref($this->link, 'COMBINED_DISPLAY_MODE') && !$_SESSION["bw_limit"]) {\r
                        $articles = array();\r
-               \r
+\r
                        foreach ($topmost_article_ids as $id) {\r
                                array_push($articles, format_article($this->link, $id, false));\r
                        }\r
-               \r
+\r
                        $reply['articles'] = $articles;\r
                }\r
-               \r
+\r
                if ($_REQUEST["debug"]) $timing_info = print_checkpoint("30", $timing_info);\r
-               \r
+\r
                $reply['runtime-info'] = make_runtime_info($this->link);\r
-               \r
+\r
                print json_encode($reply);\r
-               \r
+\r
        }\r
 }\r
-?>
\ No newline at end of file
+?>\r

diff --git a/classes/pref_feeds.php b/classes/pref_feeds.php
index bf15bf25ac2e316c58a72dfb372360a33cce8669..783d29f791b3cb5b8a9906b2a58742731dd1ad53 100644 (file)
--- a/classes/pref_feeds.php
+++ b/classes/pref_feeds.php
@@ -1,5 +1,5 @@
 <?php
-class Pref_Feeds extends Handler {
+class Pref_Feeds extends Protected_Handler {
        function batch_edit_cbox($elem, $label = false) {
                print "<input type=\"checkbox\" title=\"".__("Check to enable field")."\"
                        onchange=\"dijit.byId('feedEditDlg').toggleField(this, '$elem', '$label')\">";
@@ -529,7 +529,7 @@ class Pref_Feeds extends Handler {
                global $purge_intervals;
                global $update_intervals;
                global $update_methods;
-                       
+
                $feed_ids = db_escape_string($_REQUEST["ids"]);
 
                print "<input dojoType=\"dijit.form.TextBox\" style=\"display : none\" name=\"ids\" value=\"$feed_ids\">";
@@ -688,13 +688,13 @@ class Pref_Feeds extends Handler {
        function batchEditSave() {
                return editsaveops(true);
        }
-               
+
        function editSave() {
                return editsaveops(false);
        }
-       
-       function editsaveops($batch) {  
-               
+
+       function editsaveops($batch) {
+
                $feed_title = db_escape_string(trim($_POST["title"]));
                $feed_link = db_escape_string(trim($_POST["feed_url"]));
                $upd_intl = (int) db_escape_string($_POST["update_interval"]);

diff --git a/classes/pref_filters.php b/classes/pref_filters.php
index 754e8d211a5c04e7ed4f27b4526046af4ab80c0b..fdae5f59e375699c3f6148cd1316856104c2e625 100644 (file)
--- a/classes/pref_filters.php
+++ b/classes/pref_filters.php
@@ -1,5 +1,5 @@
 <?php
-class Pref_Filters extends Handler {
+class Pref_Filters extends Protected_Handler {
 
        function filter_test($filter_type, $reg_exp,
                        $action_id, $action_param, $filter_param, $inverse, $feed_id) {

diff --git a/classes/pref_labels.php b/classes/pref_labels.php
index 5de4443f706d2cd8fd0a6e433eeb91e3066488fc..0d60731f3498b743370def6f174256010ddba24b 100644 (file)
--- a/classes/pref_labels.php
+++ b/classes/pref_labels.php
@@ -1,5 +1,5 @@
 <?php
-class Pref_Labels extends Handler {
+class Pref_Labels extends Protected_Handler {
 
        function edit() {
                $label_id = db_escape_string($_REQUEST['id']);

diff --git a/classes/pref_prefs.php b/classes/pref_prefs.php
index 89626827507384435a52a42dcd036d95f257b35e..5a216d2b16867127b4eb0f5bae7c4ba3dbeecfee 100644 (file)
--- a/classes/pref_prefs.php
+++ b/classes/pref_prefs.php
@@ -1,5 +1,5 @@
 <?php
-class Pref_Prefs extends Handler {
+class Pref_Prefs extends Protected_Handler {
 
        function changepassword() {
 

diff --git a/classes/pref_users.php b/classes/pref_users.php
index 5f762b50e61d3a05edd9eb4b094b84500b2ab026..63e1fd22ccdbe76b4486d33c905a07db12b59469 100644 (file)
--- a/classes/pref_users.php
+++ b/classes/pref_users.php
@@ -1,5 +1,5 @@
 <?php
-class Pref_Users extends Handler {
+class Pref_Users extends Protected_Handler {
 
                function before() {
                        if (parent::before()) {

diff --git a/classes/protected_handler.php b/classes/protected_handler.php
new file mode 100644 (file)
index 0000000..e8a6d40
--- /dev/null
+++ b/classes/protected_handler.php
@@ -0,0 +1,8 @@
+<?php
+class Protected_Handler extends Handler {
+
+       function before() {
+               return parent::before() && $_SESSION['uid'];
+       }
+}
+?>

diff --git a/classes/rpc.php b/classes/rpc.php
index 8f03381f8a311a9281768b8a74db3a99f43315a4..c6fc8c26321e137ff66fbe6978476842fcc469bf 100644 (file)
--- a/classes/rpc.php
+++ b/classes/rpc.php
@@ -1,9 +1,9 @@
 <?php
-class RPC extends Handler {
+class RPC extends Protected_Handler {
 
        function setprofile() {
                $id = db_escape_string($_REQUEST["id"]);
-               
+
                $_SESSION["profile"] = $id;
                $_SESSION["prefs_cache"] = array();
        }
@@ -215,7 +215,7 @@ class RPC extends Handler {
 
                 if ($last_article_id != getLastArticleId($this->link)) {
                                $omode = $_REQUEST["omode"];
-       
+
                        if ($omode != "T")
                                $reply['counters'] = getAllCounters($this->link, $omode);
                        else
@@ -403,11 +403,11 @@ class RPC extends Handler {
        function assigntolabel() {
                return labelops(true);
        }
-       
+
        function removefromlabel() {
                return labelops(false);
        }
-       
+
        function labelops($assign) {
                $reply = array();