public/tt-rss
1
0
Fork 0
mirror of https://git.tt-rss.org/git/tt-rss.git synced 2026-02-10 16:01:33 +00:00
Code Issues Releases Wiki Activity

Merge branch 'master' of git.fakecake.org:fox/tt-rss

Browse Source
This commit is contained in:
Andrew Dolgov
2021-02-18 11:54:29 +03:00
parent 1adb9bb6b6 b888bc2091
commit 466cba39d8
20 changed files with 66 additions and 42 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
classes/plugin.php
View File

@@ -54,4 +54,8 @@ abstract class Plugin {
return vsprintf($this->__($msgid), $args);
}
function csrf_ignore($method) {
return false;
}
}

2
classes/pluginhandler.php
View File

@@ -11,7 +11,7 @@ class PluginHandler extends Handler_Protected {
if ($plugin) {
if (method_exists($plugin, $method)) {
if (validate_csrf($csrf_token)) {
if (validate_csrf($csrf_token) || $plugin->csrf_ignore($method)) {
$plugin->$method();
} else {
user_error("Rejected ${plugin_name}->${method}(): invalid CSRF token.", E_USER_WARNING);

13
classes/pluginhost.php
View File

@@ -611,6 +611,17 @@ class PluginHost {
$params));
}
// shortcut syntax (disabled for now)
/* function get_method_url(Plugin $sender, string $method, $params) {
return get_self_url_prefix() . "/backend.php?" .
http_build_query(
array_merge(
[
"op" => strtolower(get_class($sender) . self::PUBLIC_METHOD_DELIMITER . $method),
],
$params));
} */
// WARNING: endpoint in public.php, exposed to unauthenticated users
function get_public_method_url(Plugin $sender, string $method, $params) {
if ($sender->is_public_method($method)) {
@@ -618,7 +629,7 @@ class PluginHost {
http_build_query(
array_merge(
[
"op" => strtolower(get_class($sender) . PluginHost::PUBLIC_METHOD_DELIMITER . $method),
"op" => strtolower(get_class($sender) . self::PUBLIC_METHOD_DELIMITER . $method),
],
$params));
} else {