xle/tt-rss
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Commit Graph

  • d4d0e976dc update-feed: exit with non-zero exit code if update_rss_feed() failed daemon: log if per-feed update task terminated with non-zero exit code Andrew Dolgov 2020-09-27 16:42:42 +03:00
  • 0761533d0a lock per-feed update processes based on feed ID to reduce possibilty of concurrent updates Andrew Dolgov 2020-09-27 16:01:39 +03:00
  • 528b387563 update individual feed in a separate process to prevent PHP fatal errors (for example, OOM) from stopping the entire batch this should also slightly increase memory budget for update processes Andrew Dolgov 2020-09-27 15:58:13 +03:00
  • ce550a13bf Translated using Weblate (Persian) CERT 2020-09-26 10:49:52 +00:00
  • e993d4feb2 Merge branch 'master' of git.fakecake.org:tt-rss Andrew Dolgov 2020-09-25 10:04:09 +03:00
  • 71e9f70b8a search_to_sql: use per-user default language instead of hardcoded english if isn't specified explicitly Andrew Dolgov 2020-09-25 10:03:42 +03:00
  • d0ed7890df prev: add missing class Andrew Dolgov 2020-09-23 13:05:00 +03:00
  • 215f388992 move timestamp-related stuff to a separate class Andrew Dolgov 2020-09-23 13:04:26 +03:00
  • 05744bb474 fix updater never scheduling feeds for update if they never been updated before while having default update interval set Andrew Dolgov 2020-09-22 20:33:51 +03:00
  • 8fb2baecdc another hack for validation of URLs with invalid characters Andrew Dolgov 2020-09-22 19:56:26 +03:00
  • a897c4165b validate URLs: convert IDN to punycode before passing URL to filter_var() Andrew Dolgov 2020-09-22 15:32:22 +03:00
  • 6811d0bde2 use self:: in some places to invoke static methods from the same class Andrew Dolgov 2020-09-22 14:54:15 +03:00
  • b5710baf34 - don't fail on non-ascii characters when validating URLs - fix IDN hostnames not being converted properly Andrew Dolgov 2020-09-22 14:37:45 +03:00
  • e3780050e7 Merge branch 'weblate-integration' Andrew Dolgov 2020-09-22 11:55:53 +03:00
  • 490df818aa router: only allow functions without required parameters as handler methods Andrew Dolgov 2020-09-22 09:34:39 +03:00
  • ab6aa0ad3e fix previous re: resolve_redirects Andrew Dolgov 2020-09-22 09:18:24 +03:00
  • 74568df4ff remove a lot of stuff from global context (functions.php), add a few helper classes instead Andrew Dolgov 2020-09-22 09:04:33 +03:00
  • 4d6c80b198 Translated using Weblate (French) Glandos 2020-09-21 11:43:27 +00:00
  • 41fbd3f15f Added translation using Weblate (Persian) Andrew Dolgov 2020-09-21 18:27:39 +00:00
  • d04ac399ff clarify some URL validation-related error messages Andrew Dolgov 2020-09-21 20:37:29 +03:00
  • 3dd4169b5f clarify some URL validation-related error messages Andrew Dolgov 2020-09-21 20:35:24 +03:00
  • 4785f21316 update_rss_feed: log effective URL after fetching validate_url: treat scheme as case-insensitive Andrew Dolgov 2020-09-21 20:26:57 +03:00
  • 486f1d84ed resolve_redirects: fix previous Andrew Dolgov 2020-09-20 18:14:34 +03:00
  • d2867d887a resolve_redirects: only use three argument version of get_headers() on php 7.1+ Andrew Dolgov 2020-09-20 17:27:04 +03:00
  • 05ef9aac2f update URL pointing to version.json Andrew Dolgov 2020-09-19 07:33:59 +03:00
  • 7584ecc8a2 Merge branch 'gettext-const-scope' of JustAMacUser/tt-rss into master fox 2020-09-19 04:04:47 +00:00
  • c8ac9dc7ea Remove private scope for class constants. JustAMacUser 2020-09-18 18:13:18 -04:00
  • 03a337a660 add basic safe mode which doesn't load any user plugins Andrew Dolgov 2020-09-18 15:48:22 +03:00
  • 3588d5186e - gettext: merge patch from Sunil Mohan Adapa which rewrites plural parser to not use eval() - fix typo in aforementioned patch which caused plurals to never load - update code again to newer PHP constructor syntax Andrew Dolgov 2020-09-18 14:05:34 +03:00
  • 4f5ae94b62 prevent source errors from crashing gulp watch Andrew Dolgov 2020-09-18 12:14:37 +03:00
  • f3803c9e60 add eslint to package.json Andrew Dolgov 2020-09-17 20:47:01 +03:00
  • 5c1f70348e add less to package.json Andrew Dolgov 2020-09-17 20:45:21 +03:00
  • 4efc3d7b3f validate_url: relax requirements for URLs, limit additional port/loopback filtering to fetch_file_contents() Andrew Dolgov 2020-09-17 20:20:23 +03:00
  • a4525d31b2 replace FALSE with false so that static analyzer shuts up about it Andrew Dolgov 2020-09-17 19:02:27 +03:00
  • 57fac84516 rename gettext.inc to gettext.inc.php (cosmetic) Andrew Dolgov 2020-09-17 18:56:29 +03:00
  • d8619b9a84 auth_internal: cast OTP code to integer before trying to check it Andrew Dolgov 2020-09-17 16:50:34 +03:00
  • c25edd0024 fetch_file_contents: validate effective URL (after redirects) without CURL Andrew Dolgov 2020-09-17 16:17:33 +03:00
  • 27e695436f fetch_file_contents: validate effective URL (after redirects) if using CURL Andrew Dolgov 2020-09-17 15:53:13 +03:00
  • afa0023c51 don't try to update manually disabled feeds even if they haven't been updated before or are marked for a manual update Andrew Dolgov 2020-09-17 15:40:50 +03:00
  • f41fdef389 add gulp task for less compilation Andrew Dolgov 2020-09-17 13:30:52 +03:00
  • 5415a0e033 add makefile for less to css compilation Andrew Dolgov 2020-09-17 12:15:49 +03:00
  • 37f41a5246 forgotpass: use type strict comparison for reset token Andrew Dolgov 2020-09-17 11:49:27 +03:00
  • 5a7e7e1367 don't try to call hash_equals() on unset user token Andrew Dolgov 2020-09-17 10:20:55 +03:00
  • f72e6947d5 use hash_equals() correctly Andrew Dolgov 2020-09-17 10:04:00 +03:00
  • e3adacc588 fix several cases of Db class being invoked as wrong name (as DB) Andrew Dolgov 2020-09-17 09:18:03 +03:00
  • 16c86e2fc3 replace some plain http links with https Andrew Dolgov 2020-09-17 09:02:30 +03:00
  • a817d3794d * use get_random_bytes() for CSRF token * get_random_bytes: use PHP7 random_bytes() if it is available * validate CSRF token using hash_equals Andrew Dolgov 2020-09-17 08:59:18 +03:00
  • 0757ad0406 auth_internal: use type-strict comparison when checking OTP code Andrew Dolgov 2020-09-17 08:46:57 +03:00
  • 89d53a7f49 fix typo in previous Andrew Dolgov 2020-09-17 08:45:17 +03:00
  • 1f79d614c4 fix OTP QR code not displayed because of CSRF token passed as a query parameter use type-strict comparison when validating CSRF token on the backend Andrew Dolgov 2020-09-17 08:43:39 +03:00
  • 6a4b6cf603 amend previous to 127/8 subnet Andrew Dolgov 2020-09-17 07:37:48 +03:00
  • 213d6330b1 fetch_file_contents: resolve requested hosts and check for possible loopback address Andrew Dolgov 2020-09-17 07:36:47 +03:00
  • 88c4dc405e build_url: also put query parameters and fragment in resulting URL rewrite_relative_url: simplify handling of relative URLs Andrew Dolgov 2020-09-16 21:41:05 +03:00
  • 9d3c794983 subscribe: allow pre-filling feed URL if passed via query string Andrew Dolgov 2020-09-16 17:20:31 +03:00
  • da5af2fae0 cached_url: block SVG images because of potential javascript inside Andrew Dolgov 2020-09-16 16:25:20 +03:00
  • 33fdde249e pass CSRF token to opml import and feed icon replace dialogs Andrew Dolgov 2020-09-16 06:43:55 +03:00
  • f693ebab21 fix default password nag dialog, load via xhr Andrew Dolgov 2020-09-16 06:38:41 +03:00
  • 77faa5d523 editFeed: only try to reload feed tree in preferences if its actually there Andrew Dolgov 2020-09-15 18:55:34 +03:00
  • 3f9390c45f comments link: load in new tab Andrew Dolgov 2020-09-15 18:48:33 +03:00
  • 42b5564d1e editarticletags: load dialog via XHR Andrew Dolgov 2020-09-15 18:47:19 +03:00
  • 0706a328a4 handler: default base csrf_ignore() to false Andrew Dolgov 2020-09-15 18:16:33 +03:00
  • 0a142912d3 backend handler: require CSRF, remove obsolete code Andrew Dolgov 2020-09-15 18:08:08 +03:00
  • 154417d80b public/logout: require valid CSRF token Andrew Dolgov 2020-09-15 16:59:11 +03:00
  • cbcb10a272 Feeds: load quickaddfeed and search dialogs via XHR w/ CSRF protection Andrew Dolgov 2020-09-15 16:28:09 +03:00
  • 8080c525fd - backend: require CSRF token to be passed via POST - do not leak CSRF token via GET request in feed debugger - rework Article/redirect to use POST Andrew Dolgov 2020-09-15 16:12:53 +03:00
  • aeaafefa07 don't pass csrf token as a GET parameter to Article Andrew Dolgov 2020-09-15 16:03:09 +03:00
  • e670ac2ee5 require CSRF token for Article/redirect Andrew Dolgov 2020-09-15 15:35:50 +03:00
  • 7e50c6c4b5 - enable CSRF support earlier - remove rpc/sanityCheck from CSRF-excluded calls Andrew Dolgov 2020-09-15 15:32:17 +03:00
  • 91e1542a82 af_proxy_http: require separate token to access imgproxy Andrew Dolgov 2020-09-15 10:59:57 +03:00
  • 1621abcffc rewrite_relative_url: validate resulting absolutized URLs Andrew Dolgov 2020-09-15 10:41:57 +03:00
  • aa89ea7769 validate_url: only allow safe ports (80, 443), disallow access to loopback Andrew Dolgov 2020-09-15 10:39:09 +03:00
  • 6c02fea641 validate_url: add clean() Andrew Dolgov 2020-09-15 08:45:15 +03:00
  • 4abc7d7898 rename base64_img() to image_to_base64() Andrew Dolgov 2020-09-15 08:05:01 +03:00
  • 79f102c25d af_proxy_http: never print received data directly, always redirect to cached_url cache/getUrl: basename() passed filename just in case Andrew Dolgov 2020-09-15 08:02:28 +03:00
  • 1ee458b5c1 cached_url: perform mimetype validation before possible HOOK_SEND_LOCAL_FILE hooks Andrew Dolgov 2020-09-15 07:54:46 +03:00
  • 0758397dd8 af_redditimgur: don't add embedded blank gif image for rewritten videos Andrew Dolgov 2020-09-15 06:55:22 +03:00
  • 4a074111b5 user preferences: forbid < and > characters when changing passwords (were silently stripped on save because of clean()) Andrew Dolgov 2020-09-14 20:53:00 +03:00
  • da98ba662e public/subscribe: require valid CSRF token when validating the form Andrew Dolgov 2020-09-14 20:21:22 +03:00
  • b4cb67e77f remove csrf token from rpc method sanityCheck Andrew Dolgov 2020-09-14 20:00:01 +03:00
  • c3d14e1fa5 - fix multiple vulnerabilities in af_proxy_http - fix vulnerability in rewrite_relative_url() which prevented some URLs from being properly absolutized - fetch_file_contents: validate all URLs before requesting them - validate URLs: explicitly whitelist http and https scheme, forbid everything else - DiskCache/cached_url: only serve whitelisted content types (images, video) - simplify filename/URL handling code, remove and consolidate some less-used functions Andrew Dolgov 2020-09-14 19:46:52 +03:00
  • 5b17fdc362 Merge branch 'weblate-integration' Andrew Dolgov 2020-09-11 09:35:15 +03:00
  • a922b3cc6d order_to_override_query: allow HOOK_HEADLINES_CUSTOM_SORT_OVERRIDE plugins to override built-in sorting Andrew Dolgov 2020-09-11 07:48:22 +03:00
  • 67f02e2aa7 properly return counters for labels with zero assigned articles refs https://community.tt-rss.org/t/label-counter-doesnt-update-when-count-goes-down-to-zero/3766 Andrew Dolgov 2020-08-29 08:41:52 +03:00
  • 5497a137de Merge branch 'master' of rodneys_mission/tt-rss into master fox 2020-08-14 19:21:31 +00:00
  • 88ced02622 Silence php 7.2 error message generated in session_set_cookie_params. Rodney Stromlund 2020-08-14 10:47:46 -05:00
  • ddf9227dc4 pluginhost: allow overriding default sort modes via HOOK_HEADLINES_CUSTOM_SORT_MAP etc Andrew Dolgov 2020-08-13 12:23:27 +03:00
  • dfa65e9374 move order_by to SQL override logic into a separate function Andrew Dolgov 2020-08-13 11:52:32 +03:00
  • 48be005774 instead of taking batch timestamp and score (?) into account, make oldest first sorting work consistently with newest first - i.e. rely on feed-provided timestamp Andrew Dolgov 2020-08-11 13:29:09 +03:00
  • 05a47e5cf4 OPML: export/import per-feed purge interval Andrew Dolgov 2020-08-10 11:56:32 +03:00
  • 2b50aaed61 Merge branch 'master' of e1e0/tt-rss into master fox 2020-08-01 15:44:04 +00:00
  • c4ee0e25a1 more int/string type mismatches on getCategories Paco Esteban 2020-08-01 16:30:10 +02:00
  • 86ba8a96c4 Merge branch 'master' of e1e0/tt-rss into master fox 2020-08-01 05:52:58 +00:00
  • f99de985c1 Translated using Weblate (Czech) Marek Pavelka 2020-07-31 16:07:04 +00:00
  • 3da618e0ea make sure all ints are casted (to int) on getCategories Paco Esteban 2020-07-31 16:15:16 +02:00
  • 68ccc8f636 Translated using Weblate (Norwegian Bokmål) Jan Espen Pedersen 2020-07-19 14:25:17 +00:00
  • 376fe6271d Merge branch 'master' of rodneys_mission/tt-rss-fix-sanity-urls into master fox 2020-07-13 14:41:05 +00:00
  • 376dce02bb Update wiki and forums links in error message. Rodney Stromlund 2020-07-13 09:06:59 -05:00
  • 3b033a17f4 Merge branch 'feed-tree-localstorage' of nanaya/tt-rss into master fox 2020-07-09 18:02:02 +00:00
  • 8d8affdc45 Store FeedTree data in localStorage nanaya 2020-07-09 01:48:23 +09:00
  • 6868b41cd5 Translated using Weblate (Norwegian Bokmål) Jan Espen Pedersen 2020-07-02 21:21:09 +00:00