-
-
";
-
- } else {
- $this->render_login_form();
- }
- }
-
function index() {
header("Content-Type: text/plain");
print error_json(13);
@@ -928,7 +615,7 @@ class Handler_Public extends Handler {
if (!SINGLE_USER_MODE && $_SESSION["access_level"] < 10) {
$_SESSION["login_error_msg"] = __("Your access level is insufficient to run this script.");
- $this->render_login_form();
+ $this->_render_login_form();
exit;
}
@@ -1066,7 +753,7 @@ class Handler_Public extends Handler {
}
}
- private function make_article_tag_uri($id, $timestamp) {
+ private function _make_article_tag_uri($id, $timestamp) {
$timestamp = date("Y-m-d", strtotime($timestamp));
@@ -1108,7 +795,7 @@ class Handler_Public extends Handler {
}
}
- static function render_login_form() {
+ static function _render_login_form() {
header('Cache-Control: public');
require_once "login_form.php";
diff --git a/classes/pluginhost.php b/classes/pluginhost.php
index 065fa99c4..d50c5a706 100755
--- a/classes/pluginhost.php
+++ b/classes/pluginhost.php
@@ -599,7 +599,7 @@ class PluginHost {
}
// handled by classes/pluginhandler.php, requires valid session
- function get_method_url(Plugin $sender, string $method, $params) {
+ function get_method_url(Plugin $sender, string $method, $params = []) {
return get_self_url_prefix() . "/backend.php?" .
http_build_query(
array_merge(
@@ -623,7 +623,7 @@ class PluginHost {
} */
// WARNING: endpoint in public.php, exposed to unauthenticated users
- function get_public_method_url(Plugin $sender, string $method, $params) {
+ function get_public_method_url(Plugin $sender, string $method, $params = []) {
if ($sender->is_public_method($method)) {
return get_self_url_prefix() . "/public.php?" .
http_build_query(
diff --git a/classes/userhelper.php b/classes/userhelper.php
index 42d50a0f4..7fe1e5557 100644
--- a/classes/userhelper.php
+++ b/classes/userhelper.php
@@ -107,7 +107,7 @@ class UserHelper {
if (empty($_SESSION["uid"])) {
UserHelper::logout();
- Handler_Public::render_login_form();
+ Handler_Public::_render_login_form();
exit;
}
diff --git a/include/controls.php b/include/controls.php
index a60b1e0b0..ae5fba739 100755
--- a/include/controls.php
+++ b/include/controls.php
@@ -16,6 +16,10 @@
return hidden_tag("op", strtolower(get_class($plugin) . \PluginHost::PUBLIC_METHOD_DELIMITER . $method));
} */
+ function public_method_tags(\Plugin $plugin, string $method) {
+ return hidden_tag("op", strtolower(get_class($plugin) . \PluginHost::PUBLIC_METHOD_DELIMITER . $method));
+ }
+
function pluginhandler_tags(\Plugin $plugin, string $method) {
return hidden_tag("op", "pluginhandler") .
hidden_tag("plugin", strtolower(get_class($plugin))) .
diff --git a/plugins/bookmarklets/init.php b/plugins/bookmarklets/init.php
index a9dc3e69d..4c3bbf4cc 100644
--- a/plugins/bookmarklets/init.php
+++ b/plugins/bookmarklets/init.php
@@ -16,21 +16,338 @@ class Bookmarklets extends Plugin {
$host->add_hook($host::HOOK_PREFS_TAB, $this);
}
- private function subscribe_to_feed_url() {
- $url_path = get_self_url_prefix() .
- "/public.php?op=subscribe&feed_url=%s";
- return $url_path;
+ function is_public_method($method) {
+ return in_array($method, ["subscribe", "sharepopup"]);
}
+ function subscribe() {
+ if (SINGLE_USER_MODE) {
+ UserHelper::login_sequence();
+ }
+
+ if (!empty($_SESSION["uid"])) {
+
+ $feed_url = clean($_REQUEST["feed_url"] ?? "");
+ $csrf_token = clean($_POST["csrf_token"] ?? "");
+
+ header('Content-Type: text/html; charset=utf-8');
+ ?>
+
+
+
+
-
-
- %s.", $feed_url));
- break;
- case 1:
- print_notice(T_sprintf("Subscribed to %s.", $feed_url));
- break;
- case 2:
- print_error(T_sprintf("Could not subscribe to %s.", $feed_url));
- break;
- case 3:
- print_error(T_sprintf("No feeds found in %s.", $feed_url));
- break;
- case 4:
- $feed_urls = $rc["feeds"];
- break;
- case 5:
- print_error(T_sprintf("Could not subscribe to %s.
Can't download the Feed URL.", $feed_url)); - break; - } - - if ($feed_urls) { - - print ""; - } - - $tp_uri = get_self_url_prefix() . "/prefs.php"; - - if ($rc['code'] <= 2){ - $sth = $this->pdo->prepare("SELECT id FROM ttrss_feeds WHERE - feed_url = ? AND owner_uid = ?"); - $sth->execute([$feed_url, $_SESSION['uid']]); - $row = $sth->fetch(); - - $feed_id = $row["id"]; - } else { - $feed_id = 0; - } - - if ($feed_id) { - print ""; - } - } - - print "
Can't download the Feed URL.", $feed_url)); - break; - } - - if ($feed_urls) { - - print ""; - } - - $tp_uri = get_self_url_prefix() . "/prefs.php"; - - if ($rc['code'] <= 2){ - $sth = $this->pdo->prepare("SELECT id FROM ttrss_feeds WHERE - feed_url = ? AND owner_uid = ?"); - $sth->execute([$feed_url, $_SESSION['uid']]); - $row = $sth->fetch(); - - $feed_id = $row["id"]; - } else { - $feed_id = 0; - } - - if ($feed_id) { - print ""; - } - } - - print "
+
+
";
+ } else {
+ Handler_Public::_render_login_form();
+ }
+ }
+
+ function sharepopup() {
+ if (SINGLE_USER_MODE) {
+ UserHelper::login_sequence();
+ }
+
+ header('Content-Type: text/html; charset=utf-8');
+ ?>
+
+
+
+
+
+
+ %s.", $feed_url));
+ break;
+ case 1:
+ print_notice(T_sprintf("Subscribed to %s.", $feed_url));
+ break;
+ case 2:
+ print_error(T_sprintf("Could not subscribe to %s.", $feed_url));
+ break;
+ case 3:
+ print_error(T_sprintf("No feeds found in %s.", $feed_url));
+ break;
+ case 4:
+ $feed_urls = $rc["feeds"];
+ break;
+ case 5:
+ print_error(T_sprintf("Could not subscribe to %s.
Can't download the Feed URL.", $feed_url)); + break; + } + + if ($feed_urls) { + + print ""; + } + + $tp_uri = get_self_url_prefix() . "/prefs.php"; + + if ($rc['code'] <= 2){ + $sth = $this->pdo->prepare("SELECT id FROM ttrss_feeds WHERE + feed_url = ? AND owner_uid = ?"); + $sth->execute([$feed_url, $_SESSION['uid']]); + $row = $sth->fetch(); + + $feed_id = $row["id"]; + } else { + $feed_id = 0; + } + + if ($feed_id) { + print ""; + } + } + + print "
Can't download the Feed URL.", $feed_url)); + break; + } + + if ($feed_urls) { + + print ""; + } + + $tp_uri = get_self_url_prefix() . "/prefs.php"; + + if ($rc['code'] <= 2){ + $sth = $this->pdo->prepare("SELECT id FROM ttrss_feeds WHERE + feed_url = ? AND owner_uid = ?"); + $sth->execute([$feed_url, $_SESSION['uid']]); + $row = $sth->fetch(); + + $feed_id = $row["id"]; + } else { + $feed_id = 0; + } + + if ($feed_id) { + print ""; + } + } + + print "
+
+ ";
+ print "window.close();";
+ print "";
+
+ } else {
+ $title = htmlspecialchars(clean($_REQUEST["title"]));
+ $url = htmlspecialchars(clean($_REQUEST["url"]));
+
+ ?>
+
+
+
+
+
+
+
+ ";
+ subscribe_to_feed_url());
- $confirm_str = str_replace("'", "\'", __('Subscribe to %s in Tiny Tiny RSS?'));
- $bm_subscribe_url = htmlspecialchars("javascript:{if(confirm('$confirm_str'.replace('%s',window.location.href)))window.location.href='$bm_subscribe_url'+encodeURIComponent(window.location.href)}");
+ $bm_subscribe_url = $this->host->get_public_method_url($this, "subscribe");
+ $bm_share_url = $this->host->get_public_method_url($this, "sharepopup");
- $bm_share_url = htmlspecialchars("javascript:(function(){var d=document,w=window,e=w.getSelection,k=d.getSelection,x=d.selection,s=(e?e():(k)?k():(x?x.createRange().text:0)),f='".get_self_url_prefix()."/public.php?op=sharepopup',l=d.location,e=encodeURIComponent,g=f+'&title='+((e(s))?e(s):e(document.title))+'&url='+e(l.href);function a(){if(!w.open(g,'t','toolbar=0,resizable=0,scrollbars=1,status=1,width=500,height=250')){l.href=g;}}a();})()");
+ $confirm_str = str_replace("'", "\'", __('Subscribe to %s in Tiny Tiny RSS?'));
+
+ $bm_subscribe_url = htmlspecialchars("javascript:{if(confirm('$confirm_str'.replace('%s',window.location.href)))window.location.href='$bm_subscribe_url&feed_url='+encodeURIComponent(window.location.href)}");
+ $bm_share_url = htmlspecialchars("javascript:(function(){var d=document,w=window,e=w.getSelection,k=d.getSelection,x=d.selection,s=(e?e():(k)?k():(x?x.createRange().text:0)),f='$bm_share_url',l=d.location,e=encodeURIComponent,g=f+'&title='+((e(s))?e(s):e(document.title))+'&url='+e(l.href);function a(){if(!w.open(g,'t','toolbar=0,resizable=0,scrollbars=1,status=1,width=500,height=250')){l.href=g;}}a();})()");
+
+ //$bm_subscribe_url = str_replace('%s', '', $this->subscribe_to_feed_url());
+ //$confirm_str = str_replace("'", "\'", __('Subscribe to %s in Tiny Tiny RSS?'));
+ //$bm_subscribe_url = htmlspecialchars("javascript:{if(confirm('$confirm_str'.replace('%s',window.location.href)))window.location.href='$bm_subscribe_url'+encodeURIComponent(window.location.href)}");
+
+ //$bm_share_url = htmlspecialchars("javascript:(function(){var d=document,w=window,e=w.getSelection,k=d.getSelection,x=d.selection,s=(e?e():(k)?k():(x?x.createRange().text:0)),f='".get_self_url_prefix()."/public.php?op=sharepopup',l=d.location,e=encodeURIComponent,g=f+'&title='+((e(s))?e(s):e(document.title))+'&url='+e(l.href);function a(){if(!w.open(g,'t','toolbar=0,resizable=0,scrollbars=1,status=1,width=500,height=250')){l.href=g;}}a();})()");
?>