]> git.wh0rd.org Git - tt-rss.git/blob - plugins/af_psql_trgm/init.php
Prevent target='_blank' vulnerability on dynamic link
[tt-rss.git] / plugins / af_psql_trgm / init.php
1 <?php
2 class Af_Psql_Trgm extends Plugin {
3
4         private $host;
5
6         function about() {
7                 return array(1.0,
8                         "Marks similar articles as read (requires pg_trgm)",
9                         "fox");
10         }
11
12         function save() {
13                 $similarity = (float) db_escape_string($_POST["similarity"]);
14                 $min_title_length = (int) db_escape_string($_POST["min_title_length"]);
15                 $enable_globally = checkbox_to_sql_bool($_POST["enable_globally"]) == "true";
16
17                 if ($similarity < 0) $similarity = 0;
18                 if ($similarity > 1) $similarity = 1;
19
20                 if ($min_title_length < 0) $min_title_length = 0;
21
22                 $similarity = sprintf("%.2f", $similarity);
23
24                 $this->host->set($this, "similarity", $similarity);
25                 $this->host->set($this, "min_title_length", $min_title_length);
26                 $this->host->set($this, "enable_globally", $enable_globally);
27
28                 echo T_sprintf("Data saved (%s, %d)", $similarity, $enable_globally);
29         }
30
31         function init($host) {
32                 $this->host = $host;
33
34                 $host->add_hook($host::HOOK_ARTICLE_FILTER, $this);
35                 $host->add_hook($host::HOOK_PREFS_TAB, $this);
36                 $host->add_hook($host::HOOK_PREFS_EDIT_FEED, $this);
37                 $host->add_hook($host::HOOK_PREFS_SAVE_FEED, $this);
38                 $host->add_hook($host::HOOK_ARTICLE_BUTTON, $this);
39
40         }
41
42         function get_js() {
43                 return file_get_contents(__DIR__ . "/init.js");
44         }
45
46         function showrelated() {
47                 $id = (int) db_escape_string($_REQUEST['param']);
48                 $owner_uid = $_SESSION["uid"];
49
50                 $result = db_query("SELECT title FROM ttrss_entries, ttrss_user_entries
51                         WHERE ref_id = id AND id = $id AND owner_uid = $owner_uid");
52
53                 $title = db_fetch_result($result, 0, "title");
54
55                 print "<h2>$title</h2>";
56
57                 $title = db_escape_string($title);
58                 $result = db_query("SELECT ttrss_entries.id AS id,
59                                 feed_id,
60                                 ttrss_entries.title AS title,
61                                 updated, link,
62                                 ttrss_feeds.title AS feed_title,
63                                 SIMILARITY(ttrss_entries.title, '$title') AS sm
64                         FROM
65                                 ttrss_entries, ttrss_user_entries LEFT JOIN ttrss_feeds ON (ttrss_feeds.id = feed_id)
66                         WHERE
67                                 ttrss_entries.id = ref_id AND
68                                 ttrss_user_entries.owner_uid = $owner_uid AND
69                                 ttrss_entries.id != $id AND
70                                 date_entered >= NOW() - INTERVAL '2 weeks'
71                         ORDER BY
72                                 sm DESC, date_entered DESC
73                         LIMIT 10");
74
75                 print "<ul class=\"browseFeedList\" style=\"border-width : 1px\">";
76
77                 while ($line = db_fetch_assoc($result)) {
78                         print "<li>";
79                         print "<div class='insensitive small' style='margin-left : 20px; float : right'>" .
80                                 smart_date_time(strtotime($line["updated"]))
81                                 . "</div>";
82
83                         $sm = sprintf("%.2f", $line['sm']);
84                         print "<img src='images/score_high.png' title='$sm'
85                                 style='vertical-align : middle'>";
86
87                         $article_link = htmlspecialchars($line["link"]);
88                         print " <a target=\"_blank\" rel=\"noopener noreferrer\" href=\"$article_link\">".
89                                 $line["title"]."</a>";
90
91                         print " (<a href=\"#\" onclick=\"viewfeed({feed:".$line["feed_id"]."})\">".
92                                 htmlspecialchars($line["feed_title"])."</a>)";
93
94                         print " <span class='insensitive'>($sm)</span>";
95
96                         print "</li>";
97                 }
98
99                 print "</ul>";
100
101                 print "<div style='text-align : center'>";
102                 print "<button dojoType=\"dijit.form.Button\" onclick=\"dijit.byId('trgmRelatedDlg').hide()\">".__('Close this window')."</button>";
103                 print "</div>";
104
105
106         }
107
108         function hook_article_button($line) {
109                 return "<img src=\"plugins/af_psql_trgm/button.png\"
110                         style=\"cursor : pointer\" style=\"cursor : pointer\"
111                         onclick=\"showTrgmRelated(".$line["id"].")\"
112                         class='tagsPic' title='".__('Show related articles')."'>";
113         }
114
115         function hook_prefs_tab($args) {
116                 if ($args != "prefFeeds") return;
117
118                 print "<div dojoType=\"dijit.layout.AccordionPane\" title=\"".__('Mark similar articles as read')."\">";
119
120                 if (DB_TYPE != "pgsql") {
121                         print_error("Database type not supported.");
122                 } else {
123
124                         $result = db_query("select 'similarity'::regproc");
125
126                         if (db_num_rows($result) == 0) {
127                                 print_error("pg_trgm extension not found.");
128                         }
129
130                         $similarity = $this->host->get($this, "similarity");
131                         $min_title_length = $this->host->get($this, "min_title_length");
132                         $enable_globally = $this->host->get($this, "enable_globally");
133
134                         if (!$similarity) $similarity = '0.75';
135                         if (!$min_title_length) $min_title_length = '32';
136
137                         print "<form dojoType=\"dijit.form.Form\">";
138
139                         print "<script type=\"dojo/method\" event=\"onSubmit\" args=\"evt\">
140                                 evt.preventDefault();
141                                 if (this.validate()) {
142                                         console.log(dojo.objectToQuery(this.getValues()));
143                                         new Ajax.Request('backend.php', {
144                                                 parameters: dojo.objectToQuery(this.getValues()),
145                                                 onComplete: function(transport) {
146                                                         notify_info(transport.responseText);
147                                                 }
148                                         });
149                                         //this.reset();
150                                 }
151                                 </script>";
152
153                         print_hidden("op", "pluginhandler");
154                         print_hidden("method", "save");
155                         print_hidden("plugin", "af_psql_trgm");
156
157                         print "<p>" . __("PostgreSQL trigram extension returns string similarity as a floating point number (0-1). Setting it too low might produce false positives, zero disables checking.") . "</p>";
158                         print_notice("Enable the plugin for specific feeds in the feed editor.");
159
160                         print "<h3>" . __("Global settings") . "</h3>";
161
162                         print "<table>";
163
164                         print "<tr><td width=\"40%\">" . __("Minimum similarity:") . "</td>";
165                         print "<td>
166                                 <input dojoType=\"dijit.form.ValidationTextBox\"
167                                 placeholder=\"0.75\"
168                                 required=\"1\" name=\"similarity\" value=\"$similarity\"></td></tr>";
169                         print "<tr><td width=\"40%\">" . __("Minimum title length:") . "</td>";
170                         print "<td>
171                                 <input dojoType=\"dijit.form.ValidationTextBox\"
172                                 placeholder=\"32\"
173                                 required=\"1\" name=\"min_title_length\" value=\"$min_title_length\"></td></tr>";
174                         print "<tr><td width=\"40%\">" . __("Enable for all feeds:") . "</td>";
175                         print "<td>";
176                         print_checkbox("enable_globally", $enable_globally);
177                         print "</td></tr>";
178
179                         print "</table>";
180
181                         print "<p>"; print_button("submit", __("Save"));
182                         print "</form>";
183
184                         $enabled_feeds = $this->host->get($this, "enabled_feeds");
185                         if (!array($enabled_feeds)) $enabled_feeds = array();
186
187                         $enabled_feeds = $this->filter_unknown_feeds($enabled_feeds);
188                         $this->host->set($this, "enabled_feeds", $enabled_feeds);
189
190                         if (count($enabled_feeds) > 0) {
191                                 print "<h3>" . __("Currently enabled for (click to edit):") . "</h3>";
192
193                                 print "<ul class=\"browseFeedList\" style=\"border-width : 1px\">";
194                                 foreach ($enabled_feeds as $f) {
195                                         print "<li>" .
196                                                 "<img src='images/pub_set.png'
197                                                         style='vertical-align : middle'> <a href='#'
198                                                         onclick='editFeed($f)'>" .
199                                                 getFeedTitle($f) . "</a></li>";
200                                 }
201                                 print "</ul>";
202                         }
203                 }
204
205                 print "</div>";
206         }
207
208         function hook_prefs_edit_feed($feed_id) {
209                 print "<div class=\"dlgSec\">".__("Similarity (pg_trgm)")."</div>";
210                 print "<div class=\"dlgSecCont\">";
211
212                 $enabled_feeds = $this->host->get($this, "enabled_feeds");
213                 if (!array($enabled_feeds)) $enabled_feeds = array();
214
215                 $key = array_search($feed_id, $enabled_feeds);
216                 $checked = $key !== FALSE ? "checked" : "";
217
218                 print "<hr/><input dojoType=\"dijit.form.CheckBox\" type=\"checkbox\" id=\"trgm_similarity_enabled\"
219                         name=\"trgm_similarity_enabled\"
220                         $checked>&nbsp;<label for=\"trgm_similarity_enabled\">".__('Mark similar articles as read')."</label>";
221
222                 print "</div>";
223         }
224
225         function hook_prefs_save_feed($feed_id) {
226                 $enabled_feeds = $this->host->get($this, "enabled_feeds");
227                 if (!is_array($enabled_feeds)) $enabled_feeds = array();
228
229                 $enable = checkbox_to_sql_bool($_POST["trgm_similarity_enabled"]) == 'true';
230                 $key = array_search($feed_id, $enabled_feeds);
231
232                 if ($enable) {
233                         if ($key === FALSE) {
234                                 array_push($enabled_feeds, $feed_id);
235                         }
236                 } else {
237                         if ($key !== FALSE) {
238                                 unset($enabled_feeds[$key]);
239                         }
240                 }
241
242                 $this->host->set($this, "enabled_feeds", $enabled_feeds);
243         }
244
245         function hook_article_filter($article) {
246
247                 if (DB_TYPE != "pgsql") return $article;
248
249                 $result = db_query("select 'similarity'::regproc");
250                 if (db_num_rows($result) == 0) return $article;
251
252                 $enable_globally = $this->host->get($this, "enable_globally");
253
254                 if (!$enable_globally) {
255                         $enabled_feeds = $this->host->get($this, "enabled_feeds");
256                         $key = array_search($article["feed"]["id"], $enabled_feeds);
257                         if ($key === FALSE) return $article;
258                 }
259
260                 $similarity = (float) $this->host->get($this, "similarity");
261                 if ($similarity < 0.01) return $article;
262
263                 $min_title_length = (int) $this->host->get($this, "min_title_length");
264                 if (mb_strlen($article["title"]) < $min_title_length) return $article;
265
266                 $owner_uid = $article["owner_uid"];
267                 $entry_guid = $article["guid_hashed"];
268                 $title_escaped = db_escape_string($article["title"]);
269
270                 // trgm does not return similarity=1 for completely equal strings
271
272                 $result = db_query("SELECT COUNT(id) AS nequal
273                   FROM ttrss_entries, ttrss_user_entries WHERE ref_id = id AND
274                   date_entered >= NOW() - interval '3 days' AND
275                   title = '$title_escaped' AND
276                   guid != '$entry_guid' AND
277                   owner_uid = $owner_uid");
278
279                 $nequal = db_fetch_result($result, 0, "nequal");
280                 _debug("af_psql_trgm: num equals: $nequal");
281
282                 if ($nequal != 0) {
283                         $article["force_catchup"] = true;
284                         return $article;
285                 }
286
287                 $result = db_query("SELECT MAX(SIMILARITY(title, '$title_escaped')) AS ms
288                   FROM ttrss_entries, ttrss_user_entries WHERE ref_id = id AND
289                   date_entered >= NOW() - interval '1 day' AND
290                   guid != '$entry_guid' AND
291                   owner_uid = $owner_uid");
292
293                 $similarity_result = db_fetch_result($result, 0, "ms");
294
295                 _debug("af_psql_trgm: similarity result: $similarity_result");
296
297                 if ($similarity_result >= $similarity) {
298                         $article["force_catchup"] = true;
299                 }
300
301                 return $article;
302
303         }
304
305         function api_version() {
306                 return 2;
307         }
308
309         private function filter_unknown_feeds($enabled_feeds) {
310                 $tmp = array();
311
312                 foreach ($enabled_feeds as $feed) {
313
314                         $result = db_query("SELECT id FROM ttrss_feeds WHERE id = '$feed' AND owner_uid = " . $_SESSION["uid"]);
315
316                         if (db_num_rows($result) != 0) {
317                                 array_push($tmp, $feed);
318                         }
319                 }
320
321                 return $tmp;
322         }
323
324 }
325 ?>