X-Git-Url: https://git.wh0rd.org/?p=tt-rss.git;a=blobdiff_plain;f=classes%2Fpref%2Fprefs.php;h=0ae3e1bbb795a84b2b53a5b35eb10eb79971c019;hp=cf1322f4581cc93d8e4534db82712fdd79be3e4d;hb=81fc862e370a1dfbd3941206fd00076e3cbf0551;hpb=4ee398a41e2176d4a5c997920db35cb6bed12f2e

diff --git a/classes/pref/prefs.php b/classes/pref/prefs.php
index cf1322f4..0ae3e1bb 100644
--- a/classes/pref/prefs.php
+++ b/classes/pref/prefs.php
@@ -48,7 +48,7 @@ class Pref_Prefs extends Handler_Protected {
 			"SHOW_CONTENT_PREVIEW" => array(__("Show content preview in headlines list"), ""),
 			"SORT_HEADLINES_BY_FEED_DATE" => array(__("Sort headlines by feed date"), __("Use feed-specified date to sort headlines instead of local import date.")),
 			"SSL_CERT_SERIAL" => array(__("Login with an SSL certificate"), __("Click to register your SSL client certificate with tt-rss")),
-			"STRIP_IMAGES" => array(__("Do not embed images in articles"), ""),
+			"STRIP_IMAGES" => array(__("Do not embed media in articles"), ""),
 			"STRIP_UNSAFE_TAGS" => array(__("Strip unsafe tags from articles"), __("Strip all but most common HTML tags when reading articles.")),
 			"USER_STYLESHEET" => array(__("Customize stylesheet"), __("Customize CSS stylesheet to your liking")),
 			"USER_TIMEZONE" => array(__("Time zone"), ""),
@@ -60,9 +60,9 @@ class Pref_Prefs extends Handler_Protected {
 
 	function changepassword() {
 
-		$old_pw = $_POST["old_password"];
-		$new_pw = $_POST["new_password"];
-		$con_pw = $_POST["confirm_password"];
+		$old_pw = clean($_POST["old_password"]);
+		$new_pw = clean($_POST["new_password"]);
+		$con_pw = clean($_POST["confirm_password"]);
 
 		if ($old_pw == "") {
 			print "ERROR: ".format_error("Old password cannot be blank.");
@@ -89,7 +89,7 @@ class Pref_Prefs extends Handler_Protected {
 	}
 
 	function saveconfig() {
-		$boolean_prefs = explode(",", $_POST["boolean_prefs"]);
+		$boolean_prefs = explode(",", clean($_POST["boolean_prefs"]));
 
 		foreach ($boolean_prefs as $pref) {
 			if (!isset($_POST[$pref])) $_POST[$pref] = 'false';
@@ -99,7 +99,6 @@ class Pref_Prefs extends Handler_Protected {
 
 		foreach (array_keys($_POST) as $pref_name) {
 
-			$pref_name = $pref_name;
 			$value = $_POST[$pref_name];
 
 			if ($pref_name == 'DIGEST_PREFERRED_TIME') {
@@ -130,8 +129,8 @@ class Pref_Prefs extends Handler_Protected {
 
 	function changeemail() {
 
-		$email = $_POST["email"];
-		$full_name = $_POST["full_name"];
+		$email = clean($_POST["email"]);
+		$full_name = clean($_POST["full_name"]);
 		$active_uid = $_SESSION["uid"];
 
 		$sth = $this->pdo->prepare("UPDATE ttrss_users SET email = ?,
@@ -147,8 +146,8 @@ class Pref_Prefs extends Handler_Protected {
 
 		$_SESSION["prefs_op_result"] = "reset-to-defaults";
 
-		$sth = $this->pdo->query("DELETE FROM ttrss_user_prefs
-			WHERE (profile = :profile OR (:profile IS NULL AND profile IS NULL)) 
+		$sth = $this->pdo->prepare("DELETE FROM ttrss_user_prefs
+			WHERE (profile = :profile OR (:profile IS NULL AND profile IS NULL))
 				AND owner_uid = :uid");
 		$sth->execute([":profile" => $_SESSION['profile'], ":uid" => $_SESSION['uid']]);
 
@@ -163,7 +162,7 @@ class Pref_Prefs extends Handler_Protected {
 
 		$prefs_blacklist = array("ALLOW_DUPLICATE_POSTS", "STRIP_UNSAFE_TAGS", "REVERSE_HEADLINES",
 			"SORT_HEADLINES_BY_FEED_DATE", "DEFAULT_ARTICLE_LIMIT",
-			"FEEDS_SORT_BY_UNREAD");
+			"FEEDS_SORT_BY_UNREAD", "CDM_EXPANDED");
 
 		/* "FEEDS_SORT_BY_UNREAD", "HIDE_READ_FEEDS", "REVERSE_HEADLINES" */
 
@@ -173,6 +172,7 @@ class Pref_Prefs extends Handler_Protected {
 					"DEFAULT_UPDATE_INTERVAL", "USER_TIMEZONE", "SORT_HEADLINES_BY_FEED_DATE",
 					"SSL_CERT_SERIAL", "DIGEST_PREFERRED_TIME");
 
+		$digest_options = array("DIGEST_ENABLE", "DIGEST_CATCHUP", "DIGEST_PREFERRED_TIME");
 
 		$_SESSION["prefs_op_result"] = "";
 
@@ -228,7 +228,7 @@ class Pref_Prefs extends Handler_Protected {
 		print_hidden("op", "pref-prefs");
 		print_hidden("method", "changeemail");
 
-		print "<p><button dojoType=\"dijit.form.Button\" type=\"submit\">".
+		print "<p><button dojoType=\"dijit.form.Button\" type=\"submit\" class=\"btn-primary\">".
 			__("Save data")."</button>";
 
 		print "</form>";
@@ -299,7 +299,7 @@ class Pref_Prefs extends Handler_Protected {
 			print_hidden("op", "pref-prefs");
 			print_hidden("method", "changepassword");
 
-			print "<p><button dojoType=\"dijit.form.Button\" type=\"submit\">".
+			print "<p><button dojoType=\"dijit.form.Button\" type=\"submit\" class=\"btn-primary\">".
 				__("Change password")."</button>";
 
 			print "</form>";
@@ -404,7 +404,7 @@ class Pref_Prefs extends Handler_Protected {
 					print "</td></tr>";
 					print "</table>";
 
-					print "<p><button dojoType=\"dijit.form.Button\" type=\"submit\">".
+					print "<p><button dojoType=\"dijit.form.Button\" type=\"submit\" class=\"btn-primary\">".
 						__("Enable OTP")."</button>";
 
 					print "</form>";
@@ -503,6 +503,10 @@ class Pref_Prefs extends Handler_Protected {
 				continue;
 			}
 
+			/* Hide options from the user that are disabled in config.php. */
+			if (DIGEST_SUBJECT === false && in_array($pref_name, $digest_options))
+				continue;
+
 			if ($active_section != $line["section_id"]) {
 
 				if ($active_section != "") {
@@ -651,7 +655,7 @@ class Pref_Prefs extends Handler_Protected {
 		print_hidden("op", "pref-prefs");
 		print_hidden("method", "saveconfig");
 
-		print "<div dojoType=\"dijit.form.ComboButton\" type=\"submit\">
+		print "<div dojoType=\"dijit.form.ComboButton\" type=\"submit\" class=\"btn-primary\">
 			<span>".__('Save configuration')."</span>
 			<div dojoType=\"dijit.DropDownMenu\">
 				<div dojoType=\"dijit.MenuItem\"
@@ -663,7 +667,7 @@ class Pref_Prefs extends Handler_Protected {
 		print "<button dojoType=\"dijit.form.Button\" onclick=\"return editProfiles()\">".
 			__('Manage profiles')."</button> ";
 
-		print "<button dojoType=\"dijit.form.Button\" onclick=\"return validatePrefsReset()\">".
+		print "<button dojoType=\"dijit.form.Button\" class=\"btn-danger\" onclick=\"return validatePrefsReset()\">".
 			__('Reset to defaults')."</button>";
 
 		print "&nbsp;";
@@ -849,9 +853,6 @@ class Pref_Prefs extends Handler_Protected {
 	}
 
 	function otpqrcode() {
-		require_once "lib/otphp/vendor/base32.php";
-		require_once "lib/otphp/lib/otp.php";
-		require_once "lib/otphp/lib/totp.php";
 		require_once "lib/phpqrcode/phpqrcode.php";
 
 		$sth = $this->pdo->prepare("SELECT login,salt,otp_enabled
@@ -861,7 +862,7 @@ class Pref_Prefs extends Handler_Protected {
 
 		if ($row = $sth->fetch()) {
 
-			$base32 = new Base32();
+			$base32 = new \OTPHP\Base32();
 
 			$login = $row["login"];
 			$otp_enabled = sql_bool_to_bool($row["otp_enabled"]);
@@ -877,25 +878,22 @@ class Pref_Prefs extends Handler_Protected {
 	}
 
 	function otpenable() {
-		require_once "lib/otphp/vendor/base32.php";
-		require_once "lib/otphp/lib/otp.php";
-		require_once "lib/otphp/lib/totp.php";
 
-		$password = $_REQUEST["password"];
-		$otp = $_REQUEST["otp"];
+		$password = clean($_REQUEST["password"]);
+		$otp = clean($_REQUEST["otp"]);
 
 		$authenticator = PluginHost::getInstance()->get_plugin($_SESSION["auth_module"]);
 
 		if ($authenticator->check_password($_SESSION["uid"], $password)) {
 
-			$sth = $this->pdo->query("SELECT salt
+			$sth = $this->pdo->prepare("SELECT salt
 				FROM ttrss_users
 				WHERE id = ?");
 			$sth->execute([$_SESSION['uid']]);
 
 			if ($row = $sth->fetch()) {
 
-				$base32 = new Base32();
+				$base32 = new \OTPHP\Base32();
 
 				$secret = $base32->encode(sha1($row["salt"]));
 				$topt = new \OTPHP\TOTP($secret);
@@ -903,7 +901,7 @@ class Pref_Prefs extends Handler_Protected {
 				$otp_check = $topt->now();
 
 				if ($otp == $otp_check) {
-					$sth = $this->pdo->prepare("UPDATE ttrss_users 
+					$sth = $this->pdo->prepare("UPDATE ttrss_users
 					SET otp_enabled = true WHERE id = ?");
 
 					$sth->execute([$_SESSION['uid']]);
@@ -920,8 +918,21 @@ class Pref_Prefs extends Handler_Protected {
 
 	}
 
+	static function isdefaultpassword() {
+		$authenticator = PluginHost::getInstance()->get_plugin($_SESSION["auth_module"]);
+
+		if ($authenticator &&
+                method_exists($authenticator, "check_password") &&
+                $authenticator->check_password($_SESSION["uid"], "password")) {
+
+			return true;
+		}
+
+		return false;
+	}
+
 	function otpdisable() {
-		$password = $_REQUEST["password"];
+		$password = clean($_REQUEST["password"]);
 
 		$authenticator = PluginHost::getInstance()->get_plugin($_SESSION["auth_module"]);
 
@@ -939,8 +950,8 @@ class Pref_Prefs extends Handler_Protected {
 	}
 
 	function setplugins() {
-		if (is_array($_REQUEST["plugins"]))
-			$plugins = join(",", $_REQUEST["plugins"]);
+		if (is_array(clean($_REQUEST["plugins"])))
+			$plugins = join(",", clean($_REQUEST["plugins"]));
 		else
 			$plugins = "";
 
@@ -948,7 +959,7 @@ class Pref_Prefs extends Handler_Protected {
 	}
 
 	function clearplugindata() {
-		$name = $_REQUEST["name"];
+		$name = clean($_REQUEST["name"]);
 
 		PluginHost::getInstance()->clear_data(PluginHost::getInstance()->get_plugin($name));
 	}
@@ -1083,7 +1094,7 @@ class Pref_Prefs extends Handler_Protected {
 
 		print "<div class='dlgButtons'>
 			<div style='float : left'>
-			<button dojoType=\"dijit.form.Button\" onclick=\"dijit.byId('profileEditDlg').removeSelected()\">".
+			<button class=\"btn-danger\" dojoType=\"dijit.form.Button\" onclick=\"dijit.byId('profileEditDlg').removeSelected()\">".
 			__('Remove selected profiles')."</button>
 			<button dojoType=\"dijit.form.Button\" onclick=\"dijit.byId('profileEditDlg').activateProfile()\">".
 			__('Activate profile')."</button>
@@ -1116,4 +1127,4 @@ class Pref_Prefs extends Handler_Protected {
 
 		return "";
 	}
-}
\ No newline at end of file
+}