tt-rss

public/tt-rss

Fork 0

mirror of https://git.tt-rss.org/git/tt-rss.git synced 2026-02-10 16:01:33 +00:00

Commit Graph

Select branches

Hide Pull Requests

claro-throwback

dojo-module-define-test

exp-flavor-icon-cache

exp-flex-feedtree

exp-headline-flavor-images

exp-separate-handlers

js-objects

js-strict-mode

json-viewfeed

jsonfeed-test-branch

master

pdo-experimental

single-app-object

unify-method-naming

weblate-integration

wip-config-object

wip-hook-callbacks

wip-new-prefs

wip-no-prototype

wip-php8

wip-phpstan-level6

#1

#10

#11

#12

#13

#14

#15

#16

#17

#18

#19

#2

#20

#21

#22

#23

#24

#25

#26

#27

#28

#29

#3

#30

#31

#32

#33

#34

#35

#36

#37

#38

#39

#4

#40

#41

#42

#43

#44

#45

#46

#47

#48

#49

#5

#50

#51

#52

#53

#54

#55

#56

#57

#58

#59

#6

#60

#61

#62

#63

#64

#65

#66

#7

#8

#9

82bc740363 Logger::log - allow specifying errno bump severity of PDO exception log messages to E_USER_WARNING Andrew Dolgov 2020-09-29 10:08:54 +03:00
3b17c45887 exclude E_USER_NOTICE from recent events icon Andrew Dolgov 2020-09-29 10:03:11 +03:00
23d20847a3 update_rss_feed: fallback to previous method if passthru() is not available Andrew Dolgov 2020-09-28 21:19:53 +03:00
c70e26db31 validate url: feed urlencoded() URL to filter_var() only Andrew Dolgov 2020-09-28 19:46:31 +03:00
7c8bed0524 accept -1 as a valid exit code for per-feed update processes Andrew Dolgov 2020-09-28 16:02:59 +03:00
de22464ea8 schema: add ttrss_feeds.last_successful_update Andrew Dolgov 2020-09-28 14:14:06 +03:00
97d7e5a42a allow updating database schema in batch mode Andrew Dolgov 2020-09-28 13:51:47 +03:00
335dcd3bf9 don't mention last_updated in non-zero failure error message because that's not what it means Andrew Dolgov 2020-09-28 08:32:14 +03:00
3534b8dfa7 improve logging for per-feed update task failures Andrew Dolgov 2020-09-28 08:02:38 +03:00
74cd60d7cc update_rss_feed: don't return as if failed on http 304 Andrew Dolgov 2020-09-27 17:13:36 +03:00
d4d0e976dc update-feed: exit with non-zero exit code if update_rss_feed() failed daemon: log if per-feed update task terminated with non-zero exit code Andrew Dolgov 2020-09-27 16:42:42 +03:00
0761533d0a lock per-feed update processes based on feed ID to reduce possibilty of concurrent updates Andrew Dolgov 2020-09-27 16:01:39 +03:00
528b387563 update individual feed in a separate process to prevent PHP fatal errors (for example, OOM) from stopping the entire batch this should also slightly increase memory budget for update processes Andrew Dolgov 2020-09-27 15:58:13 +03:00
ce550a13bf Translated using Weblate (Persian) CERT 2020-09-26 10:49:52 +00:00
e993d4feb2 Merge branch 'master' of git.fakecake.org:tt-rss Andrew Dolgov 2020-09-25 10:04:09 +03:00
71e9f70b8a search_to_sql: use per-user default language instead of hardcoded english if isn't specified explicitly Andrew Dolgov 2020-09-25 10:03:42 +03:00
d0ed7890df prev: add missing class Andrew Dolgov 2020-09-23 13:05:00 +03:00
215f388992 move timestamp-related stuff to a separate class Andrew Dolgov 2020-09-23 13:04:26 +03:00
05744bb474 fix updater never scheduling feeds for update if they never been updated before while having default update interval set Andrew Dolgov 2020-09-22 20:33:51 +03:00
8fb2baecdc another hack for validation of URLs with invalid characters Andrew Dolgov 2020-09-22 19:56:26 +03:00
a897c4165b validate URLs: convert IDN to punycode before passing URL to filter_var() Andrew Dolgov 2020-09-22 15:32:22 +03:00
6811d0bde2 use self:: in some places to invoke static methods from the same class Andrew Dolgov 2020-09-22 14:54:15 +03:00
b5710baf34 - don't fail on non-ascii characters when validating URLs - fix IDN hostnames not being converted properly Andrew Dolgov 2020-09-22 14:37:45 +03:00
e3780050e7 Merge branch 'weblate-integration' Andrew Dolgov 2020-09-22 11:55:53 +03:00
490df818aa router: only allow functions without required parameters as handler methods Andrew Dolgov 2020-09-22 09:34:39 +03:00
ab6aa0ad3e fix previous re: resolve_redirects Andrew Dolgov 2020-09-22 09:18:24 +03:00
74568df4ff remove a lot of stuff from global context (functions.php), add a few helper classes instead Andrew Dolgov 2020-09-22 09:04:33 +03:00
4d6c80b198 Translated using Weblate (French) Glandos 2020-09-21 11:43:27 +00:00
41fbd3f15f Added translation using Weblate (Persian) Andrew Dolgov 2020-09-21 18:27:39 +00:00
d04ac399ff clarify some URL validation-related error messages Andrew Dolgov 2020-09-21 20:37:29 +03:00
3dd4169b5f clarify some URL validation-related error messages Andrew Dolgov 2020-09-21 20:35:24 +03:00
4785f21316 update_rss_feed: log effective URL after fetching validate_url: treat scheme as case-insensitive Andrew Dolgov 2020-09-21 20:26:57 +03:00
486f1d84ed resolve_redirects: fix previous Andrew Dolgov 2020-09-20 18:14:34 +03:00
d2867d887a resolve_redirects: only use three argument version of get_headers() on php 7.1+ Andrew Dolgov 2020-09-20 17:27:04 +03:00
05ef9aac2f update URL pointing to version.json Andrew Dolgov 2020-09-19 07:33:59 +03:00
7584ecc8a2 Merge branch 'gettext-const-scope' of JustAMacUser/tt-rss into master fox 2020-09-19 04:04:47 +00:00
c8ac9dc7ea Remove private scope for class constants. JustAMacUser 2020-09-18 18:13:18 -04:00
03a337a660 add basic safe mode which doesn't load any user plugins Andrew Dolgov 2020-09-18 15:48:22 +03:00
3588d5186e - gettext: merge patch from Sunil Mohan Adapa which rewrites plural parser to not use eval() - fix typo in aforementioned patch which caused plurals to never load - update code again to newer PHP constructor syntax Andrew Dolgov 2020-09-18 14:05:34 +03:00
4f5ae94b62 prevent source errors from crashing gulp watch Andrew Dolgov 2020-09-18 12:14:37 +03:00
f3803c9e60 add eslint to package.json Andrew Dolgov 2020-09-17 20:47:01 +03:00
5c1f70348e add less to package.json Andrew Dolgov 2020-09-17 20:45:21 +03:00
4efc3d7b3f validate_url: relax requirements for URLs, limit additional port/loopback filtering to fetch_file_contents() Andrew Dolgov 2020-09-17 20:20:23 +03:00
a4525d31b2 replace FALSE with false so that static analyzer shuts up about it Andrew Dolgov 2020-09-17 19:02:27 +03:00
57fac84516 rename gettext.inc to gettext.inc.php (cosmetic) Andrew Dolgov 2020-09-17 18:56:29 +03:00
d8619b9a84 auth_internal: cast OTP code to integer before trying to check it Andrew Dolgov 2020-09-17 16:50:34 +03:00
c25edd0024 fetch_file_contents: validate effective URL (after redirects) without CURL Andrew Dolgov 2020-09-17 16:17:33 +03:00
27e695436f fetch_file_contents: validate effective URL (after redirects) if using CURL Andrew Dolgov 2020-09-17 15:53:13 +03:00
afa0023c51 don't try to update manually disabled feeds even if they haven't been updated before or are marked for a manual update Andrew Dolgov 2020-09-17 15:40:50 +03:00
f41fdef389 add gulp task for less compilation Andrew Dolgov 2020-09-17 13:30:52 +03:00
5415a0e033 add makefile for less to css compilation Andrew Dolgov 2020-09-17 12:15:49 +03:00
37f41a5246 forgotpass: use type strict comparison for reset token Andrew Dolgov 2020-09-17 11:49:27 +03:00
5a7e7e1367 don't try to call hash_equals() on unset user token Andrew Dolgov 2020-09-17 10:20:55 +03:00
f72e6947d5 use hash_equals() correctly Andrew Dolgov 2020-09-17 10:04:00 +03:00
e3adacc588 fix several cases of Db class being invoked as wrong name (as DB) Andrew Dolgov 2020-09-17 09:18:03 +03:00
16c86e2fc3 replace some plain http links with https Andrew Dolgov 2020-09-17 09:02:30 +03:00
a817d3794d * use get_random_bytes() for CSRF token * get_random_bytes: use PHP7 random_bytes() if it is available * validate CSRF token using hash_equals Andrew Dolgov 2020-09-17 08:59:18 +03:00
0757ad0406 auth_internal: use type-strict comparison when checking OTP code Andrew Dolgov 2020-09-17 08:46:57 +03:00
89d53a7f49 fix typo in previous Andrew Dolgov 2020-09-17 08:45:17 +03:00
1f79d614c4 fix OTP QR code not displayed because of CSRF token passed as a query parameter use type-strict comparison when validating CSRF token on the backend Andrew Dolgov 2020-09-17 08:43:39 +03:00
6a4b6cf603 amend previous to 127/8 subnet Andrew Dolgov 2020-09-17 07:37:48 +03:00
213d6330b1 fetch_file_contents: resolve requested hosts and check for possible loopback address Andrew Dolgov 2020-09-17 07:36:47 +03:00
88c4dc405e build_url: also put query parameters and fragment in resulting URL rewrite_relative_url: simplify handling of relative URLs Andrew Dolgov 2020-09-16 21:41:05 +03:00
9d3c794983 subscribe: allow pre-filling feed URL if passed via query string Andrew Dolgov 2020-09-16 17:20:31 +03:00
da5af2fae0 cached_url: block SVG images because of potential javascript inside Andrew Dolgov 2020-09-16 16:25:20 +03:00
33fdde249e pass CSRF token to opml import and feed icon replace dialogs Andrew Dolgov 2020-09-16 06:43:55 +03:00
f693ebab21 fix default password nag dialog, load via xhr Andrew Dolgov 2020-09-16 06:38:41 +03:00
77faa5d523 editFeed: only try to reload feed tree in preferences if its actually there Andrew Dolgov 2020-09-15 18:55:34 +03:00
3f9390c45f comments link: load in new tab Andrew Dolgov 2020-09-15 18:48:33 +03:00
42b5564d1e editarticletags: load dialog via XHR Andrew Dolgov 2020-09-15 18:47:19 +03:00
0706a328a4 handler: default base csrf_ignore() to false Andrew Dolgov 2020-09-15 18:16:33 +03:00
0a142912d3 backend handler: require CSRF, remove obsolete code Andrew Dolgov 2020-09-15 18:08:08 +03:00
154417d80b public/logout: require valid CSRF token Andrew Dolgov 2020-09-15 16:59:11 +03:00
cbcb10a272 Feeds: load quickaddfeed and search dialogs via XHR w/ CSRF protection Andrew Dolgov 2020-09-15 16:28:09 +03:00
8080c525fd - backend: require CSRF token to be passed via POST - do not leak CSRF token via GET request in feed debugger - rework Article/redirect to use POST Andrew Dolgov 2020-09-15 16:12:53 +03:00
aeaafefa07 don't pass csrf token as a GET parameter to Article Andrew Dolgov 2020-09-15 16:03:09 +03:00
e670ac2ee5 require CSRF token for Article/redirect Andrew Dolgov 2020-09-15 15:35:50 +03:00
7e50c6c4b5 - enable CSRF support earlier - remove rpc/sanityCheck from CSRF-excluded calls Andrew Dolgov 2020-09-15 15:32:17 +03:00
91e1542a82 af_proxy_http: require separate token to access imgproxy Andrew Dolgov 2020-09-15 10:59:57 +03:00
1621abcffc rewrite_relative_url: validate resulting absolutized URLs Andrew Dolgov 2020-09-15 10:41:57 +03:00
aa89ea7769 validate_url: only allow safe ports (80, 443), disallow access to loopback Andrew Dolgov 2020-09-15 10:39:09 +03:00
6c02fea641 validate_url: add clean() Andrew Dolgov 2020-09-15 08:45:15 +03:00
4abc7d7898 rename base64_img() to image_to_base64() Andrew Dolgov 2020-09-15 08:05:01 +03:00
79f102c25d af_proxy_http: never print received data directly, always redirect to cached_url cache/getUrl: basename() passed filename just in case Andrew Dolgov 2020-09-15 08:02:28 +03:00
1ee458b5c1 cached_url: perform mimetype validation before possible HOOK_SEND_LOCAL_FILE hooks Andrew Dolgov 2020-09-15 07:54:46 +03:00
0758397dd8 af_redditimgur: don't add embedded blank gif image for rewritten videos Andrew Dolgov 2020-09-15 06:55:22 +03:00
4a074111b5 user preferences: forbid < and > characters when changing passwords (were silently stripped on save because of clean()) Andrew Dolgov 2020-09-14 20:53:00 +03:00
da98ba662e public/subscribe: require valid CSRF token when validating the form Andrew Dolgov 2020-09-14 20:21:22 +03:00
b4cb67e77f remove csrf token from rpc method sanityCheck Andrew Dolgov 2020-09-14 20:00:01 +03:00
c3d14e1fa5 - fix multiple vulnerabilities in af_proxy_http - fix vulnerability in rewrite_relative_url() which prevented some URLs from being properly absolutized - fetch_file_contents: validate all URLs before requesting them - validate URLs: explicitly whitelist http and https scheme, forbid everything else - DiskCache/cached_url: only serve whitelisted content types (images, video) - simplify filename/URL handling code, remove and consolidate some less-used functions Andrew Dolgov 2020-09-14 19:46:52 +03:00
5b17fdc362 Merge branch 'weblate-integration' Andrew Dolgov 2020-09-11 09:35:15 +03:00
a922b3cc6d order_to_override_query: allow HOOK_HEADLINES_CUSTOM_SORT_OVERRIDE plugins to override built-in sorting Andrew Dolgov 2020-09-11 07:48:22 +03:00
67f02e2aa7 properly return counters for labels with zero assigned articles refs https://community.tt-rss.org/t/label-counter-doesnt-update-when-count-goes-down-to-zero/3766 Andrew Dolgov 2020-08-29 08:41:52 +03:00
5497a137de Merge branch 'master' of rodneys_mission/tt-rss into master fox 2020-08-14 19:21:31 +00:00
88ced02622 Silence php 7.2 error message generated in session_set_cookie_params. Rodney Stromlund 2020-08-14 10:47:46 -05:00
ddf9227dc4 pluginhost: allow overriding default sort modes via HOOK_HEADLINES_CUSTOM_SORT_MAP etc Andrew Dolgov 2020-08-13 12:23:27 +03:00
dfa65e9374 move order_by to SQL override logic into a separate function Andrew Dolgov 2020-08-13 11:52:32 +03:00
48be005774 instead of taking batch timestamp and score (?) into account, make oldest first sorting work consistently with newest first - i.e. rely on feed-provided timestamp Andrew Dolgov 2020-08-11 13:29:09 +03:00
05a47e5cf4 OPML: export/import per-feed purge interval Andrew Dolgov 2020-08-10 11:56:32 +03:00
2b50aaed61 Merge branch 'master' of e1e0/tt-rss into master fox 2020-08-01 15:44:04 +00:00

... 11 12 13 14 15 ...