diff options
Diffstat (limited to 'classes/pref')
| -rwxr-xr-x | classes/pref/feeds.php | 253 | ||||
| -rwxr-xr-x | classes/pref/filters.php | 4 | ||||
| -rw-r--r-- | classes/pref/labels.php | 12 | ||||
| -rw-r--r-- | classes/pref/prefs.php | 920 | ||||
| -rw-r--r-- | classes/pref/system.php | 74 | ||||
| -rw-r--r-- | classes/pref/users.php | 151 |
6 files changed, 799 insertions, 615 deletions
diff --git a/classes/pref/feeds.php b/classes/pref/feeds.php index 3b4afab26..788104d38 100755 --- a/classes/pref/feeds.php +++ b/classes/pref/feeds.php @@ -1,5 +1,10 @@ <?php class Pref_Feeds extends Handler_Protected { + const E_ICON_FILE_TOO_LARGE = 'E_ICON_FILE_TOO_LARGE'; + const E_ICON_RENAME_FAILED = 'E_ICON_RENAME_FAILED'; + const E_ICON_UPLOAD_FAILED = 'E_ICON_UPLOAD_FAILED'; + const E_ICON_UPLOAD_SUCCESS = 'E_ICON_UPLOAD_SUCCESS'; + function csrf_ignore($method) { $csrf_ignored = array("index", "getfeedtree", "savefeedorder"); @@ -22,14 +27,16 @@ class Pref_Feeds extends Handler_Protected { return $rv; } - function renamecat() { + function renameCat() { + $cat = ORM::for_table("ttrss_feed_categories") + ->where("owner_uid", $_SESSION["uid"]) + ->find_one($_REQUEST['id']); + $title = clean($_REQUEST['title']); - $id = clean($_REQUEST['id']); - if ($title) { - $sth = $this->pdo->prepare("UPDATE ttrss_feed_categories SET - title = ? WHERE id = ? AND owner_uid = ?"); - $sth->execute([$title, $id, $_SESSION['uid']]); + if ($cat && $title) { + $cat->title = $title; + $cat->save(); } } @@ -433,78 +440,67 @@ class Pref_Feeds extends Handler_Protected { } } - function removeicon() { - $feed_id = clean($_REQUEST["feed_id"]); - - $sth = $this->pdo->prepare("SELECT id FROM ttrss_feeds - WHERE id = ? AND owner_uid = ?"); - $sth->execute([$feed_id, $_SESSION['uid']]); + function removeIcon() { + $feed_id = (int) $_REQUEST["feed_id"]; + $icon_file = Config::get(Config::ICONS_DIR) . "/$feed_id.ico"; - if ($row = $sth->fetch()) { - @unlink(Config::get(Config::ICONS_DIR) . "/$feed_id.ico"); + $feed = ORM::for_table('ttrss_feeds') + ->where('owner_uid', $_SESSION['uid']) + ->find_one($feed_id); - $sth = $this->pdo->prepare("UPDATE ttrss_feeds SET favicon_avg_color = NULL, favicon_last_checked = '1970-01-01' - where id = ?"); - $sth->execute([$feed_id]); + if ($feed && file_exists($icon_file)) { + if (unlink($icon_file)) { + $feed->set([ + 'favicon_avg_color' => null, + 'favicon_last_checked' => '1970-01-01', + 'favicon_is_custom' => false, + ]); + $feed->save(); + } } } - function uploadicon() { - header("Content-type: text/html"); + function uploadIcon() { + $feed_id = (int) $_REQUEST['feed_id']; + $tmp_file = tempnam(Config::get(Config::CACHE_DIR) . '/upload', 'icon'); - if (is_uploaded_file($_FILES['icon_file']['tmp_name'])) { - $tmp_file = tempnam(Config::get(Config::CACHE_DIR) . '/upload', 'icon'); + // default value + $rc = self::E_ICON_UPLOAD_FAILED; - if (!$tmp_file) - return; + $feed = ORM::for_table('ttrss_feeds') + ->where('owner_uid', $_SESSION['uid']) + ->find_one($feed_id); - $result = move_uploaded_file($_FILES['icon_file']['tmp_name'], $tmp_file); + if ($feed && $tmp_file && move_uploaded_file($_FILES['icon_file']['tmp_name'], $tmp_file)) { + if (filesize($tmp_file) < Config::get(Config::MAX_FAVICON_FILE_SIZE)) { - if (!$result) { - return; - } - } else { - return; - } + $new_filename = Config::get(Config::ICONS_DIR) . "/$feed_id.ico"; - $icon_file = $tmp_file; - $feed_id = clean($_REQUEST["feed_id"]); - $rc = 2; // failed + if (file_exists($new_filename)) unlink($new_filename); + if (rename($tmp_file, $new_filename)) { + chmod($new_filename, 0644); - if ($icon_file && is_file($icon_file) && $feed_id) { - if (filesize($icon_file) < 65535) { + $feed->set([ + 'favicon_avg_color' => null, + 'favicon_is_custom' => true, + ]); - $sth = $this->pdo->prepare("SELECT id FROM ttrss_feeds - WHERE id = ? AND owner_uid = ?"); - $sth->execute([$feed_id, $_SESSION['uid']]); - - if ($row = $sth->fetch()) { - $new_filename = Config::get(Config::ICONS_DIR) . "/$feed_id.ico"; - - if (file_exists($new_filename)) unlink($new_filename); - - if (rename($icon_file, $new_filename)) { - chmod($new_filename, 644); - - $sth = $this->pdo->prepare("UPDATE ttrss_feeds SET - favicon_avg_color = '' - WHERE id = ?"); - $sth->execute([$feed_id]); + if ($feed->save()) { + $rc = self::E_ICON_UPLOAD_SUCCESS; + } - $rc = Feeds::_get_icon($feed_id); + } else { + $rc = self::E_ICON_RENAME_FAILED; } - } } else { - $rc = 1; + $rc = self::E_ICON_FILE_TOO_LARGE; } } - if ($icon_file && is_file($icon_file)) { - unlink($icon_file); - } + if (file_exists($tmp_file)) + unlink($tmp_file); - print $rc; - return; + print json_encode(['rc' => $rc, 'icon_url' => Feeds::_get_icon($feed_id)]); } function editfeed() { @@ -513,11 +509,11 @@ class Pref_Feeds extends Handler_Protected { $feed_id = (int)clean($_REQUEST["id"]); - $sth = $this->pdo->prepare("SELECT * FROM ttrss_feeds WHERE id = ? AND - owner_uid = ?"); - $sth->execute([$feed_id, $_SESSION['uid']]); + $row = ORM::for_table('ttrss_feeds') + ->where("owner_uid", $_SESSION["uid"]) + ->find_one($feed_id)->as_array(); - if ($row = $sth->fetch(PDO::FETCH_ASSOC)) { + if ($row) { ob_start(); PluginHost::getInstance()->run_hooks(PluginHost::HOOK_PREFS_EDIT_FEED, $feed_id); @@ -694,7 +690,7 @@ class Pref_Feeds extends Handler_Protected { $purge_intl = (int) clean($_POST["purge_interval"] ?? 0); $feed_id = (int) clean($_POST["id"] ?? 0); /* editSave */ $feed_ids = explode(",", clean($_POST["ids"] ?? "")); /* batchEditSave */ - $cat_id = (int) clean($_POST["cat_id"]); + $cat_id = (int) clean($_POST["cat_id"] ?? 0); $auth_login = clean($_POST["auth_login"]); $auth_pass = clean($_POST["auth_pass"]); $private = checkbox_to_sql_bool(clean($_POST["private"] ?? "")); @@ -710,7 +706,7 @@ class Pref_Feeds extends Handler_Protected { $mark_unread_on_update = checkbox_to_sql_bool( clean($_POST["mark_unread_on_update"] ?? "")); - $feed_language = clean($_POST["feed_language"]); + $feed_language = clean($_POST["feed_language"] ?? ""); if (!$batch) { @@ -720,48 +716,32 @@ class Pref_Feeds extends Handler_Protected { $reset_basic_info = $orig_feed_url != $feed_url; */ - $sth = $this->pdo->prepare("UPDATE ttrss_feeds SET - cat_id = :cat_id, - title = :title, - feed_url = :feed_url, - site_url = :site_url, - update_interval = :upd_intl, - purge_interval = :purge_intl, - auth_login = :auth_login, - auth_pass = :auth_pass, - auth_pass_encrypted = false, - private = :private, - cache_images = :cache_images, - hide_images = :hide_images, - include_in_digest = :include_in_digest, - always_display_enclosures = :always_display_enclosures, - mark_unread_on_update = :mark_unread_on_update, - feed_language = :feed_language - WHERE id = :id AND owner_uid = :uid"); - - $sth->execute([":title" => $feed_title, - ":cat_id" => $cat_id ? $cat_id : null, - ":feed_url" => $feed_url, - ":site_url" => $site_url, - ":upd_intl" => $upd_intl, - ":purge_intl" => $purge_intl, - ":auth_login" => $auth_login, - ":auth_pass" => $auth_pass, - ":private" => (int)$private, - ":cache_images" => (int)$cache_images, - ":hide_images" => (int)$hide_images, - ":include_in_digest" => (int)$include_in_digest, - ":always_display_enclosures" => (int)$always_display_enclosures, - ":mark_unread_on_update" => (int)$mark_unread_on_update, - ":feed_language" => $feed_language, - ":id" => $feed_id, - ":uid" => $_SESSION['uid']]); - -/* if ($reset_basic_info) { - RSSUtils::set_basic_feed_info($feed_id); - } */ - - PluginHost::getInstance()->run_hooks(PluginHost::HOOK_PREFS_SAVE_FEED, $feed_id); + $feed = ORM::for_table('ttrss_feeds') + ->where('owner_uid', $_SESSION['uid']) + ->find_one($feed_id); + + if ($feed) { + + $feed->title = $feed_title; + $feed->cat_id = $cat_id ? $cat_id : null; + $feed->feed_url = $feed_url; + $feed->site_url = $site_url; + $feed->update_interval = $upd_intl; + $feed->purge_interval = $purge_intl; + $feed->auth_login = $auth_login; + $feed->auth_pass = $auth_pass; + $feed->private = (int)$private; + $feed->cache_images = (int)$cache_images; + $feed->hide_images = (int)$hide_images; + $feed->feed_language = $feed_language; + $feed->include_in_digest = (int)$include_in_digest; + $feed->always_display_enclosures = (int)$always_display_enclosures; + $feed->mark_unread_on_update = (int)$mark_unread_on_update; + + $feed->save(); + + PluginHost::getInstance()->run_hooks(PluginHost::HOOK_PREFS_SAVE_FEED, $feed_id); + } } else { $feed_data = array(); @@ -874,14 +854,14 @@ class Pref_Feeds extends Handler_Protected { function removeCat() { $ids = explode(",", clean($_REQUEST["ids"])); foreach ($ids as $id) { - $this->remove_feed_category($id, $_SESSION["uid"]); + Feeds::_remove_cat((int)$id, $_SESSION["uid"]); } } function addCat() { $feed_cat = clean($_REQUEST["cat"]); - Feeds::_add_cat($feed_cat); + Feeds::_add_cat($feed_cat, $_SESSION['uid']); } function importOpml() { @@ -1003,10 +983,6 @@ class Pref_Feeds extends Handler_Protected { private function index_opml() { ?> - <h3><?= __("Using OPML you can export and import your feeds, filters, labels and Tiny Tiny RSS settings.") ?></h3> - - <?php print_notice("Only main settings profile can be migrated using OPML.") ?> - <form id='opml_import_form' method='post' enctype='multipart/form-data'> <label class='dijitButton'><?= __("Choose file...") ?> <input style='display : none' id='opml_file' name='opml_file' type='file'> @@ -1015,20 +991,24 @@ class Pref_Feeds extends Handler_Protected { <input type='hidden' name='csrf_token' value="<?= $_SESSION['csrf_token'] ?>"> <input type='hidden' name='method' value='importOpml'> <button dojoType='dijit.form.Button' class='alt-primary' onclick="return Helpers.OPML.import()" type="submit"> + <?= \Controls\icon("file_upload") ?> <?= __('Import OPML') ?> </button> </form> <hr/> + <?php print_notice("Only main settings profile can be migrated using OPML.") ?> + <form dojoType='dijit.form.Form' id='opmlExportForm' style='display : inline-block'> <button dojoType='dijit.form.Button' onclick='Helpers.OPML.export()'> + <?= \Controls\icon("file_download") ?> <?= __('Export OPML') ?> </button> <label class='checkbox'> <?= \Controls\checkbox_tag("include_settings", true, "1") ?> - <?= __("Include settings") ?> + <?= __("Include tt-rss settings") ?> </label> </form> @@ -1036,12 +1016,10 @@ class Pref_Feeds extends Handler_Protected { <h2><?= __("Published OPML") ?></h2> - <p> - <?= __('Your OPML can be published publicly and can be subscribed by anyone who knows the URL below.') ?> - <?= __("Published OPML does not include your Tiny Tiny RSS settings, feeds that require authentication or feeds hidden from Popular feeds.") ?> - </p> + <?= format_notice("Your OPML can be published and then subscribed by anyone who knows the URL below. This won't include your settings nor authenticated feeds.") ?> <button dojoType='dijit.form.Button' class='alt-primary' onclick="return Helpers.OPML.publish()"> + <?= \Controls\icon("share") ?> <?= __('Display published OPML URL') ?> </button> @@ -1052,14 +1030,16 @@ class Pref_Feeds extends Handler_Protected { private function index_shared() { ?> - <h3><?= __('Published articles can be subscribed by anyone who knows the following URL:') ?></h3> + <?= format_notice('Published articles can be subscribed by anyone who knows the following URL:') ?></h3> <button dojoType='dijit.form.Button' class='alt-primary' onclick="CommonDialogs.generatedFeed(-2, false)"> + <?= \Controls\icon('share') ?> <?= __('Display URL') ?> </button> <button class='alt-danger' dojoType='dijit.form.Button' onclick='return Helpers.Feeds.clearFeedAccessKeys()'> + <?= \Controls\icon('delete') ?> <?= __('Clear all generated URLs') ?> </button> @@ -1188,12 +1168,6 @@ class Pref_Feeds extends Handler_Protected { print json_encode($rv); } - private function remove_feed_category($id, $owner_uid) { - $sth = $this->pdo->prepare("DELETE FROM ttrss_feed_categories - WHERE id = ? AND owner_uid = ?"); - $sth->execute([$id, $owner_uid]); - } - static function remove_feed($id, $owner_uid) { if (PluginHost::getInstance()->run_hooks_until(PluginHost::HOOK_UNSUBSCRIBE_FEED, true, $id, $owner_uid)) @@ -1273,12 +1247,16 @@ class Pref_Feeds extends Handler_Protected { } } + function clearKeys() { + return Feeds::_clear_access_keys($_SESSION['uid']); + } + function getOPMLKey() { print json_encode(["link" => OPML::get_publish_url()]); } function regenOPMLKey() { - $this->update_feed_access_key('OPML:Publish', + Feeds::_update_access_key('OPML:Publish', false, $_SESSION["uid"]); print json_encode(["link" => OPML::get_publish_url()]); @@ -1288,17 +1266,17 @@ class Pref_Feeds extends Handler_Protected { $feed_id = clean($_REQUEST['id']); $is_cat = clean($_REQUEST['is_cat']); - $new_key = $this->update_feed_access_key($feed_id, $is_cat, $_SESSION["uid"]); + $new_key = Feeds::_update_access_key($feed_id, $is_cat, $_SESSION["uid"]); print json_encode(["link" => $new_key]); } - function getsharedurl() { + function getSharedURL() { $feed_id = clean($_REQUEST['id']); $is_cat = clean($_REQUEST['is_cat']) == "true"; $search = clean($_REQUEST['search']); - $link = get_self_url_prefix() . "/public.php?" . http_build_query([ + $link = Config::get_self_url() . "/public.php?" . http_build_query([ 'op' => 'rss', 'id' => $feed_id, 'is_cat' => (int)$is_cat, @@ -1312,23 +1290,6 @@ class Pref_Feeds extends Handler_Protected { ]); } - private function update_feed_access_key($feed_id, $is_cat, $owner_uid) { - - // clear old value and generate new one - $sth = $this->pdo->prepare("DELETE FROM ttrss_access_keys - WHERE feed_id = ? AND is_cat = ? AND owner_uid = ?"); - $sth->execute([$feed_id, bool_to_sql_bool($is_cat), $owner_uid]); - - return Feeds::_get_access_key($feed_id, $is_cat, $owner_uid); - } - - // Silent - function clearKeys() { - $sth = $this->pdo->prepare("DELETE FROM ttrss_access_keys WHERE - owner_uid = ?"); - $sth->execute([$_SESSION['uid']]); - } - private function calculate_children_count($cat) { $c = 0; diff --git a/classes/pref/filters.php b/classes/pref/filters.php index a6ea9f982..29d309dbb 100755 --- a/classes/pref/filters.php +++ b/classes/pref/filters.php @@ -51,8 +51,8 @@ class Pref_Filters extends Handler_Protected { $filter = array(); $filter["enabled"] = true; - $filter["match_any_rule"] = checkbox_to_sql_bool(clean($_REQUEST["match_any_rule"])); - $filter["inverse"] = checkbox_to_sql_bool(clean($_REQUEST["inverse"])); + $filter["match_any_rule"] = checkbox_to_sql_bool(clean($_REQUEST["match_any_rule"] ?? false)); + $filter["inverse"] = checkbox_to_sql_bool(clean($_REQUEST["inverse"] ?? false)); $filter["rules"] = array(); $filter["actions"] = array("dummy-action"); diff --git a/classes/pref/labels.php b/classes/pref/labels.php index 5bc094d55..2cdb919ce 100644 --- a/classes/pref/labels.php +++ b/classes/pref/labels.php @@ -8,14 +8,12 @@ class Pref_Labels extends Handler_Protected { } function edit() { - $label_id = clean($_REQUEST['id']); + $label = ORM::for_table('ttrss_labels2') + ->where('owner_uid', $_SESSION['uid']) + ->find_one($_REQUEST['id']); - $sth = $this->pdo->prepare("SELECT id, caption, fg_color, bg_color FROM ttrss_labels2 WHERE - id = ? AND owner_uid = ?"); - $sth->execute([$label_id, $_SESSION['uid']]); - - if ($line = $sth->fetch(PDO::FETCH_ASSOC)) { - print json_encode($line); + if ($label) { + print json_encode($label->as_array()); } } diff --git a/classes/pref/prefs.php b/classes/pref/prefs.php index ba63d76b3..16c41df9d 100644 --- a/classes/pref/prefs.php +++ b/classes/pref/prefs.php @@ -1,4 +1,5 @@ <?php +use chillerlan\QRCode; class Pref_Prefs extends Handler_Protected { @@ -7,6 +8,15 @@ class Pref_Prefs extends Handler_Protected { private $pref_help_bottom = []; private $pref_blacklist = []; + const PI_RES_ALREADY_INSTALLED = "PI_RES_ALREADY_INSTALLED"; + const PI_RES_SUCCESS = "PI_RES_SUCCESS"; + const PI_ERR_NO_CLASS = "PI_ERR_NO_CLASS"; + const PI_ERR_NO_INIT_PHP = "PI_ERR_NO_INIT_PHP"; + const PI_ERR_EXEC_FAILED = "PI_ERR_EXEC_FAILED"; + const PI_ERR_NO_TEMPDIR = "PI_ERR_NO_TEMPDIR"; + const PI_ERR_PLUGIN_NOT_FOUND = "PI_ERR_PLUGIN_NOT_FOUND"; + const PI_ERR_NO_WORKDIR = "PI_ERR_NO_WORKDIR"; + function csrf_ignore($method) { $csrf_ignored = array("index", "updateself", "otpqrcode"); @@ -64,6 +74,7 @@ class Pref_Prefs extends Handler_Protected { 'BLOCK_SEPARATOR', Prefs::SSL_CERT_SERIAL, 'BLOCK_SEPARATOR', + Prefs::DISABLE_CONDITIONAL_COUNTERS, Prefs::HEADLINES_NO_DISTINCT, ], __('Debugging') => [ @@ -105,6 +116,7 @@ class Pref_Prefs extends Handler_Protected { Prefs::USER_CSS_THEME => array(__("Theme")), Prefs::HEADLINES_NO_DISTINCT => array(__("Don't enforce DISTINCT headlines"), __("May produce duplicate entries")), Prefs::DEBUG_HEADLINE_IDS => array(__("Show article and feed IDs"), __("In the headlines buffer")), + Prefs::DISABLE_CONDITIONAL_COUNTERS => array(__("Disable conditional counter updates"), __("May increase server load")), ]; // hidden in the main prefs UI (use to hide things that have description set above) @@ -209,48 +221,45 @@ class Pref_Prefs extends Handler_Protected { } } - function changeemail() { + function changePersonalData() { + + $user = ORM::for_table('ttrss_users')->find_one($_SESSION['uid']); + $new_email = clean($_POST['email']); - $email = clean($_POST["email"]); - $full_name = clean($_POST["full_name"]); - $active_uid = $_SESSION["uid"]; + if ($user) { + $user->full_name = clean($_POST['full_name']); - $sth = $this->pdo->prepare("SELECT email, login, full_name FROM ttrss_users WHERE id = ?"); - $sth->execute([$active_uid]); + if ($user->email != $new_email) + Logger::log(E_USER_NOTICE, "Email address of user ".$user->login." has been changed to ${new_email}."); - if ($row = $sth->fetch()) { - $old_email = $row["email"]; + if ($user->email && $user->email != $new_email) { - if ($old_email != $email) { $mailer = new Mailer(); $tpl = new Templator(); $tpl->readTemplateFromFile("mail_change_template.txt"); - $tpl->setVariable('LOGIN', $row["login"]); - $tpl->setVariable('NEWMAIL', $email); + $tpl->setVariable('LOGIN', $user->login); + $tpl->setVariable('NEWMAIL', $new_email); $tpl->setVariable('TTRSS_HOST', Config::get(Config::SELF_URL_PATH)); $tpl->addBlock('message'); $tpl->generateOutputToString($message); - $mailer->mail(["to_name" => $row["login"], - "to_address" => $row["email"], - "subject" => "[tt-rss] Mail address change notification", + $mailer->mail(["to_name" => $user->login, + "to_address" => $user->email, + "subject" => "[tt-rss] Email address change notification", "message" => $message]); + $user->email = $new_email; } - } - $sth = $this->pdo->prepare("UPDATE ttrss_users SET email = ?, - full_name = ? WHERE id = ?"); - $sth->execute([$email, $full_name, $active_uid]); + $user->save(); + } print __("Your personal data has been saved."); - - return; } function resetconfig() { @@ -261,21 +270,13 @@ class Pref_Prefs extends Handler_Protected { private function index_auth_personal() { - $sth = $this->pdo->prepare("SELECT email,full_name,otp_enabled, - access_level FROM ttrss_users - WHERE id = ?"); - $sth->execute([$_SESSION["uid"]]); - $row = $sth->fetch(); - - $email = htmlspecialchars($row["email"]); - $full_name = htmlspecialchars($row["full_name"]); - $otp_enabled = sql_bool_to_bool($row["otp_enabled"]); + $user = ORM::for_table('ttrss_users')->find_one($_SESSION['uid']); ?> <form dojoType='dijit.form.Form'> <?= \Controls\hidden_tag("op", "pref-prefs") ?> - <?= \Controls\hidden_tag("method", "changeemail") ?> + <?= \Controls\hidden_tag("method", "changePersonalData") ?> <script type="dojo/method" event="onSubmit" args="evt"> evt.preventDefault(); @@ -289,18 +290,19 @@ class Pref_Prefs extends Handler_Protected { <fieldset> <label><?= __('Full name:') ?></label> - <input dojoType='dijit.form.ValidationTextBox' name='full_name' required='1' value="<?= $full_name ?>"> + <input dojoType='dijit.form.ValidationTextBox' name='full_name' required='1' value="<?= htmlspecialchars($user->full_name) ?>"> </fieldset> <fieldset> <label><?= __('E-mail:') ?></label> - <input dojoType='dijit.form.ValidationTextBox' name='email' required='1' value="<?= $email ?>"> + <input dojoType='dijit.form.ValidationTextBox' name='email' required='1' value="<?= htmlspecialchars($user->email) ?>"> </fieldset> <hr/> <button dojoType='dijit.form.Button' type='submit' class='alt-primary'> - <?= __("Save data") ?> + <?= \Controls\icon("save") ?> + <?= __("Save") ?> </button> </form> <?php @@ -313,7 +315,7 @@ class Pref_Prefs extends Handler_Protected { $authenticator = false; } - $otp_enabled = $this->is_otp_enabled(); + $otp_enabled = UserHelper::is_otp_enabled($_SESSION["uid"]); if ($authenticator && method_exists($authenticator, "change_password")) { ?> @@ -350,10 +352,6 @@ class Pref_Prefs extends Handler_Protected { } </script> - <?php if ($otp_enabled) { - print_notice(__("Changing your current password will disable OTP.")); - } ?> - <fieldset> <label><?= __("Old password:") ?></label> <input dojoType='dijit.form.ValidationTextBox' type='password' required='1' name='old_password'> @@ -372,6 +370,7 @@ class Pref_Prefs extends Handler_Protected { <hr/> <button dojoType='dijit.form.Button' type='submit' class='alt-primary'> + <?= \Controls\icon("security") ?> <?= __("Change password") ?> </button> </form> @@ -385,7 +384,7 @@ class Pref_Prefs extends Handler_Protected { } private function index_auth_app_passwords() { - print_notice("You can create separate passwords for API clients. Using one is required if you enable OTP."); + print_notice("Separate passwords used for API clients. Required if you enable OTP."); ?> <div id='app_passwords_holder'> @@ -395,31 +394,21 @@ class Pref_Prefs extends Handler_Protected { <hr> <button style='float : left' class='alt-primary' dojoType='dijit.form.Button' onclick="Helpers.AppPasswords.generate()"> - <?= __('Generate new password') ?> + <?= \Controls\icon("add") ?> + <?= __('Generate password') ?> </button> <button style='float : left' class='alt-danger' dojoType='dijit.form.Button' onclick="Helpers.AppPasswords.removeSelected()"> - <?= __('Remove selected passwords') ?> + <?= \Controls\icon("delete") ?> + <?= __('Remove selected') ?> </button> <?php } - private function is_otp_enabled() { - $sth = $this->pdo->prepare("SELECT otp_enabled FROM ttrss_users - WHERE id = ?"); - $sth->execute([$_SESSION["uid"]]); - - if ($row = $sth->fetch()) { - return sql_bool_to_bool($row["otp_enabled"]); - } - - return false; - } - private function index_auth_2fa() { - $otp_enabled = $this->is_otp_enabled(); + $otp_enabled = UserHelper::is_otp_enabled($_SESSION["uid"]); if ($_SESSION["auth_module"] == "auth_internal") { if ($otp_enabled) { @@ -455,6 +444,7 @@ class Pref_Prefs extends Handler_Protected { <hr/> <button dojoType='dijit.form.Button' type='submit' class='alt-danger'> + <?= \Controls\icon("lock_open") ?> <?= __("Disable OTP") ?> </button> @@ -464,19 +454,11 @@ class Pref_Prefs extends Handler_Protected { } else { - print_warning("You will need a compatible Authenticator to use this. Changing your password would automatically disable OTP."); - print_notice("You will need to generate app passwords for the API clients if you enable OTP."); + print "<img src=".($this->_get_otp_qrcode_img()).">"; - if (function_exists("imagecreatefromstring")) { - print "<h3>" . __("Scan the following code by the Authenticator application or copy the key manually") . "</h3>"; - $csrf_token_hash = sha1($_SESSION["csrf_token"]); - print "<img alt='otp qr-code' src='backend.php?op=pref-prefs&method=otpqrcode&csrf_token_hash=$csrf_token_hash'>"; - } else { - print_error("PHP GD functions are required to generate QR codes."); - print "<h3>" . __("Use the following OTP key with a compatible Authenticator application") . "</h3>"; - } + print_notice("You will need to generate app passwords for API clients if you enable OTP."); - $otp_secret = $this->otpsecret(); + $otp_secret = UserHelper::get_otp_secret($_SESSION["uid"]); ?> <form dojoType='dijit.form.Form'> @@ -486,7 +468,7 @@ class Pref_Prefs extends Handler_Protected { <fieldset> <label><?= __("OTP Key:") ?></label> - <input dojoType='dijit.form.ValidationTextBox' disabled='disabled' value="<?= $otp_secret ?>" size='32'> + <input dojoType='dijit.form.ValidationTextBox' disabled='disabled' value="<?= $otp_secret ?>" style='width : 215px'> </fieldset> <!-- TODO: return JSON from the backend call --> @@ -519,6 +501,7 @@ class Pref_Prefs extends Handler_Protected { <hr/> <button dojoType='dijit.form.Button' type='submit' class='alt-primary'> + <?= \Controls\icon("lock") ?> <?= __("Enable OTP") ?> </button> @@ -635,30 +618,27 @@ class Pref_Prefs extends Handler_Protected { } else if ($pref_name == "USER_CSS_THEME") { - $themes = array_merge(glob("themes/*.php"), glob("themes/*.css"), glob("themes.local/*.css")); - $themes = array_map("basename", $themes); - $themes = array_filter($themes, "theme_exists"); - asort($themes); - - if (!theme_exists($value)) $value = ""; + $theme_files = array_map("basename", + array_merge(glob("themes/*.php"), + glob("themes/*.css"), + glob("themes.local/*.css"))); - print "<select name='$pref_name' id='$pref_name' dojoType='fox.form.Select'>"; + asort($theme_files); - $issel = $value == "" ? "selected='selected'" : ""; - print "<option $issel value=''>".__("default")."</option>"; + $themes = [ "" => __("default") ]; - foreach ($themes as $theme) { - $issel = $value == $theme ? "selected='selected'" : ""; - print "<option $issel value='$theme'>$theme</option>"; + foreach ($theme_files as $file) { + $themes[$file] = basename($file, ".css"); } + ?> - print "</select>"; + <?= \Controls\select_hash($pref_name, $value, $themes) ?> + <?= \Controls\button_tag(\Controls\icon("palette") . " " . __("Customize"), "", + ["onclick" => "Helpers.Prefs.customizeCSS()"]) ?> + <?= \Controls\button_tag(\Controls\icon("open_in_new") . " " . __("More themes..."), "", + ["class" => "alt-info", "onclick" => "window.open(\"https://tt-rss.org/wiki/Themes\")"]) ?> - print " <button dojoType=\"dijit.form.Button\" class='alt-info' - onclick=\"Helpers.Prefs.customizeCSS()\">" . __('Customize') . "</button>"; - - print " <button dojoType='dijit.form.Button' onclick='window.open(\"https://tt-rss.org/wiki/Themes\")'> - <i class='material-icons'>open_in_new</i> ".__("More themes...")."</button>"; + <?php } else if ($pref_name == "DEFAULT_UPDATE_INTERVAL") { @@ -685,6 +665,11 @@ class Pref_Prefs extends Handler_Protected { print \Controls\checkbox_tag($pref_name, $is_checked, "true", ["disabled" => $is_disabled], "CB_$pref_name"); + if ($pref_name == Prefs::DIGEST_ENABLE) { + print \Controls\button_tag(\Controls\icon("info") . " " . __('Preview'), '', + ['onclick' => 'Helpers.Digest.preview()', 'style' => 'margin-left : 10px']); + } + } else if (in_array($pref_name, ['FRESH_ARTICLE_MAX_AGE', 'PURGE_OLD_DAYS', 'LONG_DATE_FORMAT', 'SHORT_DATE_FORMAT'])) { @@ -704,14 +689,14 @@ class Pref_Prefs extends Handler_Protected { print \Controls\input_tag($pref_name, $value, "text", ["readonly" => true], "SSL_CERT_SERIAL"); - $cert_serial = htmlspecialchars(get_ssl_certificate_id()); + $cert_serial = htmlspecialchars(self::_get_ssl_certificate_id()); $has_serial = ($cert_serial) ? true : false; - print \Controls\button_tag(__('Register'), "", [ + print \Controls\button_tag(\Controls\icon("security") . " " . __('Register'), "", [ "disabled" => !$has_serial, "onclick" => "dijit.byId('SSL_CERT_SERIAL').attr('value', '$cert_serial')"]); - print \Controls\button_tag(__('Clear'), "", [ + print \Controls\button_tag(\Controls\icon("clear") . " " . __('Clear'), "", [ "class" => "alt-danger", "onclick" => "dijit.byId('SSL_CERT_SERIAL').attr('value', '')"]); @@ -719,11 +704,10 @@ class Pref_Prefs extends Handler_Protected { "class" => "alt-info", "onclick" => "window.open('https://tt-rss.org/wiki/SSL%20Certificate%20Authentication')"]); - } else if ($pref_name == 'DIGEST_PREFERRED_TIME') { + } else if ($pref_name == Prefs::DIGEST_PREFERRED_TIME) { print "<input dojoType=\"dijit.form.ValidationTextBox\" id=\"$pref_name\" regexp=\"[012]?\d:\d\d\" placeHolder=\"12:00\" name=\"$pref_name\" value=\"$value\">"; - $item['help_text'] .= ". " . T_sprintf("Current server time: %s", date("H:i")); } else { $regexp = ($type_hint == Config::T_INT) ? 'regexp="^\d*$"' : ''; @@ -772,19 +756,21 @@ class Pref_Prefs extends Handler_Protected { <div dojoType="dijit.layout.ContentPane" region="bottom"> <div dojoType="fox.form.ComboButton" type="submit" class="alt-primary"> - <span><?= __('Save configuration') ?></span> + <span> <?= __('Save configuration') ?></span> <div dojoType="dijit.DropDownMenu"> <div dojoType="dijit.MenuItem" onclick="dijit.byId('changeSettingsForm').onSubmit(null, true)"> - <?= __("Save and exit preferences") ?> + <?= __("Save and exit") ?> </div> </div> </div> <button dojoType="dijit.form.Button" onclick="return Helpers.Profiles.edit()"> + <?= \Controls\icon("settings") ?> <?= __('Manage profiles') ?> </button> <button dojoType="dijit.form.Button" class="alt-danger" onclick="return Helpers.Prefs.confirmReset()"> + <?= \Controls\icon("clear") ?> <?= __('Reset to defaults') ?> </button> @@ -795,119 +781,73 @@ class Pref_Prefs extends Handler_Protected { <?php } - private function index_plugins_system() { - print_notice("System plugins are enabled in <strong>config.php</strong> for all users."); - - $system_enabled = array_map("trim", explode(",", (string)Config::get(Config::PLUGINS))); - - $tmppluginhost = new PluginHost(); - $tmppluginhost->load_all($tmppluginhost::KIND_ALL, $_SESSION["uid"], true); - - foreach ($tmppluginhost->get_plugins() as $name => $plugin) { - $about = $plugin->about(); - - if ($about[3] ?? false) { - $is_checked = in_array($name, $system_enabled) ? "checked" : ""; - ?> - <fieldset class='prefs plugin'> - <label><?= $name ?>:</label> - <label class='checkbox description text-muted' id="PLABEL-<?= htmlspecialchars($name) ?>"> - <input disabled='1' dojoType='dijit.form.CheckBox' <?= $is_checked ?> type='checkbox'><?= htmlspecialchars($about[1]) ?> - </label> - - <?php if ($about[4] ?? false) { ?> - <button dojoType='dijit.form.Button' class='alt-info' - onclick='window.open("<?= htmlspecialchars($about[4]) ?>")'> - <i class='material-icons'>open_in_new</i> <?= __("More info...") ?></button> - <?php } ?> - - <div dojoType='dijit.Tooltip' connectId='PLABEL-<?= htmlspecialchars($name) ?>' position='after'> - <?= htmlspecialchars(T_sprintf("v%.2f, by %s", $about[0], $about[2])) ?> - </div> - </fieldset> - <?php - } - } - } - - private function index_plugins_user() { + function getPluginsList() { $system_enabled = array_map("trim", explode(",", (string)Config::get(Config::PLUGINS))); $user_enabled = array_map("trim", explode(",", get_pref(Prefs::_ENABLED_PLUGINS))); $tmppluginhost = new PluginHost(); $tmppluginhost->load_all($tmppluginhost::KIND_ALL, $_SESSION["uid"], true); + $rv = []; + foreach ($tmppluginhost->get_plugins() as $name => $plugin) { $about = $plugin->about(); + $is_local = $tmppluginhost->is_local($plugin); + $version = htmlspecialchars($this->_get_plugin_version($plugin)); + + array_push($rv, [ + "name" => $name, + "is_local" => $is_local, + "system_enabled" => in_array($name, $system_enabled), + "user_enabled" => in_array($name, $user_enabled), + "has_data" => count($tmppluginhost->get_all($plugin)) > 0, + "is_system" => (bool)($about[3] ?? false), + "version" => $version, + "author" => $about[2] ?? "", + "description" => $about[1] ?? "", + "more_info" => $about[4] ?? "", + ]); + } - if (empty($about[3]) || $about[3] == false) { - - $is_checked = ""; - $is_disabled = ""; - - if (in_array($name, $system_enabled)) { - $is_checked = "checked='1'"; - $is_disabled = "disabled='1'"; - } else if (in_array($name, $user_enabled)) { - $is_checked = "checked='1'"; - } - - ?> - - <fieldset class='prefs plugin'> - <label><?= $name ?>:</label> - <label class='checkbox description text-muted' id="PLABEL-<?= htmlspecialchars($name) ?>"> - <input name='plugins[]' value="<?= htmlspecialchars($name) ?>" - dojoType='dijit.form.CheckBox' <?= $is_checked ?> <?= $is_disabled ?> type='checkbox'> - <?= htmlspecialchars($about[1]) ?> - </input> - </label> - - <?php if (count($tmppluginhost->get_all($plugin)) > 0) { - if (in_array($name, $system_enabled) || in_array($name, $user_enabled)) { ?> - <button dojoType='dijit.form.Button' - onclick='Helpers.Prefs.clearPluginData("<?= htmlspecialchars($name) ?>")'> - <i class='material-icons'>clear</i> <?= __("Clear data") ?></button> - <?php } - } ?> - - <?php if ($about[4] ?? false) { ?> - <button dojoType='dijit.form.Button' class='alt-info' - onclick='window.open("<?= htmlspecialchars($about[4]) ?>")'> - <i class='material-icons'>open_in_new</i> <?= __("More info...") ?></button> - <?php } ?> - - <div dojoType='dijit.Tooltip' connectId="PLABEL-<?= htmlspecialchars($name) ?>" position='after'> - <?= htmlspecialchars(T_sprintf("v%.2f, by %s", $about[0], $about[2])) ?> - </div> + usort($rv, function($a, $b) { return strcmp($a["name"], $b["name"]); }); - </fieldset> - <?php - } - } + print json_encode(['plugins' => $rv, 'is_admin' => $_SESSION['access_level'] >= 10]); } function index_plugins() { ?> <form dojoType="dijit.form.Form" id="changePluginsForm"> - <script type="dojo/method" event="onSubmit" args="evt"> - evt.preventDefault(); - if (this.validate()) { - xhr.post("backend.php", this.getValues(), () => { - Notify.close(); - if (confirm(__('Selected plugins have been enabled. Reload?'))) { - window.location.reload(); - } - }) - } - </script> <?= \Controls\hidden_tag("op", "pref-prefs") ?> <?= \Controls\hidden_tag("method", "setplugins") ?> <div dojoType="dijit.layout.BorderContainer" gutters="false"> + <div region="top" dojoType='fox.Toolbar'> + <div class='pull-right'> + <input name="search" type="search" onkeyup='Helpers.Plugins.search()' dojoType="dijit.form.TextBox"> + <button dojoType='dijit.form.Button' onclick='Helpers.Plugins.search()'> + <?= __('Search') ?> + </button> + </div> + + <div dojoType='fox.form.DropDownButton'> + <span><?= __('Select') ?></span> + <div dojoType='dijit.Menu' style='display: none'> + <div onclick="Lists.select('prefs-plugin-list', true)" + dojoType='dijit.MenuItem'><?= __('All') ?></div> + <div onclick="Lists.select('prefs-plugin-list', false)" + dojoType='dijit.MenuItem'><?= __('None') ?></div> + </div> + </div> + </div> + <div dojoType="dijit.layout.ContentPane" region="center" style="overflow-y : auto"> - <?php + + <script type="dojo/method" event="onShow"> + Helpers.Plugins.reload(); + </script> + + <!-- <?php if (!empty($_SESSION["safe_mode"])) { print_error("You have logged in using safe mode, no user plugins will be actually enabled until you login again."); } @@ -929,24 +869,41 @@ class Pref_Prefs extends Handler_Protected { ) . " (<a href='https://tt-rss.org/wiki/FeedHandlerPlugins' target='_blank'>".__("More info...")."</a>)" ); } - ?> + ?> --> - <h2><?= __("System plugins") ?></h2> - - <?php $this->index_plugins_system() ?> - - <h2><?= __("User plugins") ?></h2> - - <?php $this->index_plugins_user() ?> + <ul id="prefs-plugin-list" class="prefs-plugin-list list-unstyled"> + <li class='text-center'><?= __("Loading, please wait...") ?></li> + </ul> </div> <div dojoType="dijit.layout.ContentPane" region="bottom"> - <button dojoType='dijit.form.Button' style='float : left' class='alt-info' onclick='window.open("https://tt-rss.org/wiki/Plugins")'> - <i class='material-icons'>help</i> <?= __("More info...") ?> - </button> - <button dojoType='dijit.form.Button' class='alt-primary' type='submit'> - <?= __("Enable selected plugins") ?> + + <button dojoType='dijit.form.Button' class="alt-info pull-right" onclick='window.open("https://tt-rss.org/wiki/Plugins")'> + <i class='material-icons'>help</i> + <?= __("More info") ?> </button> + + <?= \Controls\button_tag(\Controls\icon("check") . " " .__("Enable selected"), "", ["class" => "alt-primary", + "onclick" => "Helpers.Plugins.enableSelected()"]) ?> + + <?= \Controls\button_tag(\Controls\icon("refresh"), "", ["title" => __("Reload"), "onclick" => "Helpers.Plugins.reload()"]) ?> + + <?php if ($_SESSION["access_level"] >= 10) { ?> + <?php if (Config::get(Config::CHECK_FOR_UPDATES) && Config::get(Config::CHECK_FOR_PLUGIN_UPDATES)) { ?> + + <button class='alt-warning' dojoType='dijit.form.Button' onclick="Helpers.Plugins.update()"> + <?= \Controls\icon("update") ?> + <?= __("Check for updates") ?> + </button> + <?php } ?> + + <?php if (Config::get(Config::ENABLE_PLUGIN_INSTALLER)) { ?> + <button dojoType='dijit.form.Button' onclick="Helpers.Plugins.install()"> + <?= \Controls\icon("add") ?> + <?= __("Install plugin") ?> + </button> + <?php } ?> + <?php } ?> </div> </div> </form> @@ -970,120 +927,44 @@ class Pref_Prefs extends Handler_Protected { <div dojoType='dijit.layout.AccordionPane' selected='true' title="<i class='material-icons'>settings</i> <?= __('Preferences') ?>"> <?php $this->index_prefs() ?> </div> - <div dojoType='dijit.layout.AccordionPane' title="<i class='material-icons'>extension</i> <?= __('Plugins') ?>"> - <script type='dojo/method' event='onSelected' args='evt'> - if (this.domNode.querySelector('.loading')) - window.setTimeout(() => { - xhr.post("backend.php", {op: 'pref-prefs', method: 'index_plugins'}, (reply) => { - this.attr('content', reply); - }); - }, 200); - </script> - <span class='loading'><?= __("Loading, please wait...") ?></span> + <div dojoType='dijit.layout.AccordionPane' style='padding : 0' title="<i class='material-icons'>extension</i> <?= __('Plugins') ?>"> + <?php $this->index_plugins() ?> </div> <?php PluginHost::getInstance()->run_hooks(PluginHost::HOOK_PREFS_TAB, "prefPrefs") ?> </div> <?php } - function toggleAdvanced() { - $_SESSION["prefs_show_advanced"] = !$_SESSION["prefs_show_advanced"]; - } - - function otpsecret() { - $sth = $this->pdo->prepare("SELECT salt, otp_enabled - FROM ttrss_users - WHERE id = ?"); - $sth->execute([$_SESSION['uid']]); + function _get_otp_qrcode_img() { + $secret = UserHelper::get_otp_secret($_SESSION["uid"]); + $login = UserHelper::get_login_by_id($_SESSION["uid"]); - if ($row = $sth->fetch()) { - $otp_enabled = sql_bool_to_bool($row["otp_enabled"]); + if ($secret && $login) { + $qrcode = new \chillerlan\QRCode\QRCode(); - if (!$otp_enabled) { - $base32 = new \OTPHP\Base32(); - $secret = $base32->encode(mb_substr(sha1($row["salt"]), 0, 12), false); + $otpurl = "otpauth://totp/".urlencode($login)."?secret=$secret&issuer=".urlencode("Tiny Tiny RSS"); - return $secret; - } + return $qrcode->render($otpurl); } return false; } - function otpqrcode() { - $csrf_token_hash = clean($_REQUEST["csrf_token_hash"]); - - if (sha1($_SESSION["csrf_token"]) === $csrf_token_hash) { - require_once "lib/phpqrcode/phpqrcode.php"; - - $sth = $this->pdo->prepare("SELECT login - FROM ttrss_users - WHERE id = ?"); - $sth->execute([$_SESSION['uid']]); - - if ($row = $sth->fetch()) { - $secret = $this->otpsecret(); - $login = $row['login']; - - if ($secret) { - QRcode::png("otpauth://totp/".urlencode($login). - "?secret=$secret&issuer=".urlencode("Tiny Tiny RSS")); - } - } - } else { - header("Content-Type: text/json"); - print Errors::to_json(Errors::E_UNAUTHORIZED); - } - } - function otpenable() { - $password = clean($_REQUEST["password"]); - $otp = clean($_REQUEST["otp"]); + $otp_check = clean($_REQUEST["otp"]); $authenticator = PluginHost::getInstance()->get_plugin($_SESSION["auth_module"]); if ($authenticator->check_password($_SESSION["uid"], $password)) { - - $secret = $this->otpsecret(); - - if ($secret) { - - $base32 = new \OTPHP\Base32(); - - $topt = new \OTPHP\TOTP($secret); - - $otp_check = $topt->now(); - - if ($otp == $otp_check) { - $sth = $this->pdo->prepare("UPDATE ttrss_users - SET otp_enabled = true WHERE id = ?"); - - $sth->execute([$_SESSION['uid']]); - - print "OK"; - } else { - print "ERROR:".__("Incorrect one time password"); - } + if (UserHelper::enable_otp($_SESSION["uid"], $otp_check)) { + print "OK"; + } else { + print "ERROR:".__("Incorrect one time password"); } - } else { print "ERROR:".__("Incorrect password"); } - - } - - static function isdefaultpassword() { - $authenticator = PluginHost::getInstance()->get_plugin($_SESSION["auth_module"]); - - if ($authenticator && - method_exists($authenticator, "check_password") && - $authenticator->check_password($_SESSION["uid"], "password")) { - - return true; - } - - return false; } function otpdisable() { @@ -1116,9 +997,7 @@ class Pref_Prefs extends Handler_Protected { "message" => $message]); } - $sth = $this->pdo->prepare("UPDATE ttrss_users SET otp_enabled = false WHERE - id = ?"); - $sth->execute([$_SESSION['uid']]); + UserHelper::disable_otp($_SESSION["uid"]); print "OK"; } else { @@ -1128,12 +1007,306 @@ class Pref_Prefs extends Handler_Protected { } function setplugins() { - if (is_array(clean($_REQUEST["plugins"]))) - $plugins = join(",", clean($_REQUEST["plugins"])); - else - $plugins = ""; + $plugins = array_filter($_REQUEST["plugins"], 'clean') ?? []; + + set_pref(Prefs::_ENABLED_PLUGINS, implode(",", $plugins)); + } + + function _get_plugin_version(Plugin $plugin) { + $about = $plugin->about(); + + if (!empty($about[0])) { + return T_sprintf("v%.2f, by %s", $about[0], $about[2]); + } else { + $ref = new ReflectionClass(get_class($plugin)); + + $plugin_dir = dirname($ref->getFileName()); + + if (basename($plugin_dir) == "plugins") { + return ""; + } + + if (is_dir("$plugin_dir/.git")) { + $ver = Config::get_version_from_git($plugin_dir); + + return $ver["status"] == 0 ? T_sprintf("v%s, by %s", $ver["version"], $about[2]) : $ver["version"]; + } + } + } + + static function _get_updated_plugins() { + $root_dir = dirname(dirname(__DIR__)); # we're in classes/pref/ + $plugin_dirs = array_filter(glob("$root_dir/plugins.local/*"), "is_dir"); + + $rv = []; + + foreach ($plugin_dirs as $dir) { + if (is_dir("$dir/.git")) { + $plugin_name = basename($dir); + + array_push($rv, ["plugin" => $plugin_name, "rv" => self::_plugin_needs_update($root_dir, $plugin_name)]); + } + } + + $rv = array_values(array_filter($rv, function ($item) { + return $item["rv"]["need_update"]; + })); + + return $rv; + } + + private static function _plugin_needs_update($root_dir, $plugin_name) { + $plugin_dir = "$root_dir/plugins.local/" . basename($plugin_name); + $rv = null; + + if (is_dir($plugin_dir) && is_dir("$plugin_dir/.git")) { + $pipes = []; + + $descriptorspec = [ + //0 => ["pipe", "r"], // STDIN + 1 => ["pipe", "w"], // STDOUT + 2 => ["pipe", "w"], // STDERR + ]; + + $proc = proc_open("git fetch -q origin -a && git log HEAD..origin/master --oneline", $descriptorspec, $pipes, $plugin_dir); + + if (is_resource($proc)) { + $rv = [ + "stdout" => stream_get_contents($pipes[1]), + "stderr" => stream_get_contents($pipes[2]), + "git_status" => proc_close($proc), + ]; + $rv["need_update"] = !empty($rv["stdout"]); + } + } + + return $rv; + } + + + private function _update_plugin($root_dir, $plugin_name) { + $plugin_dir = "$root_dir/plugins.local/" . basename($plugin_name); + $rv = []; + + if (is_dir($plugin_dir) && is_dir("$plugin_dir/.git")) { + $pipes = []; + + $descriptorspec = [ + //0 => ["pipe", "r"], // STDIN + 1 => ["pipe", "w"], // STDOUT + 2 => ["pipe", "w"], // STDERR + ]; + + $proc = proc_open("git fetch origin -a && git log HEAD..origin/master --oneline && git pull --ff-only origin master", $descriptorspec, $pipes, $plugin_dir); + + if (is_resource($proc)) { + $rv["stdout"] = stream_get_contents($pipes[1]); + $rv["stderr"] = stream_get_contents($pipes[2]); + $rv["git_status"] = proc_close($proc); + } + } + + return $rv; + } + + // https://gist.github.com/mindplay-dk/a4aad91f5a4f1283a5e2#gistcomment-2036828 + private function _recursive_rmdir(string $dir, bool $keep_root = false) { + // Handle bad arguments. + if (empty($dir) || !file_exists($dir)) { + return true; // No such file/dir$dir exists. + } elseif (is_file($dir) || is_link($dir)) { + return unlink($dir); // Delete file/link. + } + + // Delete all children. + $files = new \RecursiveIteratorIterator( + new \RecursiveDirectoryIterator($dir, \RecursiveDirectoryIterator::SKIP_DOTS), + \RecursiveIteratorIterator::CHILD_FIRST + ); + + foreach ($files as $fileinfo) { + $action = $fileinfo->isDir() ? 'rmdir' : 'unlink'; + if (!$action($fileinfo->getRealPath())) { + return false; // Abort due to the failure. + } + } + + return $keep_root ? true : rmdir($dir); + } + + // https://stackoverflow.com/questions/7153000/get-class-name-from-file + private function _get_class_name_from_file($file) { + $tokens = token_get_all(file_get_contents($file)); + + for ($i = 0; $i < count($tokens); $i++) { + if (isset($tokens[$i][0]) && $tokens[$i][0] == T_CLASS) { + for ($j = $i+1; $j < count($tokens); $j++) { + if (isset($tokens[$j][1]) && $tokens[$j][1] != " ") { + return $tokens[$j][1]; + } + } + } + } + } + + function uninstallPlugin() { + if ($_SESSION["access_level"] >= 10) { + $plugin_name = basename(clean($_REQUEST['plugin'])); + $status = 0; + + $plugin_dir = dirname(dirname(__DIR__)) . "/plugins.local/$plugin_name"; + + if (is_dir($plugin_dir)) { + $status = $this->_recursive_rmdir($plugin_dir); + } + + print json_encode(['status' => $status]); + } + } + + function installPlugin() { + if ($_SESSION["access_level"] >= 10 && Config::get(Config::ENABLE_PLUGIN_INSTALLER)) { + $plugin_name = basename(clean($_REQUEST['plugin'])); + $all_plugins = $this->_get_available_plugins(); + $plugin_dir = dirname(dirname(__DIR__)) . "/plugins.local"; + + $work_dir = "$plugin_dir/plugin-installer"; + + $rv = [ ]; + + if (is_dir($work_dir) || mkdir($work_dir)) { + foreach ($all_plugins as $plugin) { + if ($plugin['name'] == $plugin_name) { + + $tmp_dir = tempnam($work_dir, $plugin_name); + + if (file_exists($tmp_dir)) { + unlink($tmp_dir); + + $pipes = []; + + $descriptorspec = [ + 1 => ["pipe", "w"], // STDOUT + 2 => ["pipe", "w"], // STDERR + ]; + + $proc = proc_open("git clone " . escapeshellarg($plugin['clone_url']) . " " . $tmp_dir, + $descriptorspec, $pipes, sys_get_temp_dir()); + + $status = 0; + + if (is_resource($proc)) { + $rv["stdout"] = stream_get_contents($pipes[1]); + $rv["stderr"] = stream_get_contents($pipes[2]); + $status = proc_close($proc); + $rv["git_status"] = $status; + + // yeah I know about mysterious RC = -1 + if (file_exists("$tmp_dir/init.php")) { + $class_name = strtolower(basename($this->_get_class_name_from_file("$tmp_dir/init.php"))); + + if ($class_name) { + $dst_dir = "$plugin_dir/$class_name"; + + if (is_dir($dst_dir)) { + $rv['result'] = self::PI_RES_ALREADY_INSTALLED; + } else { + if (rename($tmp_dir, "$plugin_dir/$class_name")) { + $rv['result'] = self::PI_RES_SUCCESS; + } + } + } else { + $rv['result'] = self::PI_ERR_NO_CLASS; + } + } else { + $rv['result'] = self::PI_ERR_NO_INIT_PHP; + } + + } else { + $rv['result'] = self::PI_ERR_EXEC_FAILED; + } + } else { + $rv['result'] = self::PI_ERR_NO_TEMPDIR; + } + + // cleanup after failure + if ($tmp_dir && is_dir($tmp_dir)) { + $this->_recursive_rmdir($tmp_dir); + } + + break; + } + } + + if (empty($rv['result'])) + $rv['result'] = self::PI_ERR_PLUGIN_NOT_FOUND; + + } else { + $rv["result"] = self::PI_ERR_NO_WORKDIR; + } + + print json_encode($rv); + } + } + + private function _get_available_plugins() { + if ($_SESSION["access_level"] >= 10 && Config::get(Config::ENABLE_PLUGIN_INSTALLER)) { + return json_decode(UrlHelper::fetch(['url' => 'https://tt-rss.org/plugins.json']), true); + } + } + function getAvailablePlugins() { + if ($_SESSION["access_level"] >= 10) { + print json_encode($this->_get_available_plugins()); + } + } + + function checkForPluginUpdates() { + if ($_SESSION["access_level"] >= 10 && Config::get(Config::CHECK_FOR_UPDATES) && Config::get(Config::CHECK_FOR_PLUGIN_UPDATES)) { + $plugin_name = $_REQUEST["name"] ?? ""; + + $root_dir = dirname(dirname(__DIR__)); # we're in classes/pref/ - set_pref(Prefs::_ENABLED_PLUGINS, $plugins); + if (!empty($plugin_name)) { + $rv = [["plugin" => $plugin_name, "rv" => self::_plugin_needs_update($root_dir, $plugin_name)]]; + } else { + $rv = self::_get_updated_plugins(); + } + + print json_encode($rv); + } + } + + function updateLocalPlugins() { + if ($_SESSION["access_level"] >= 10) { + $plugins = explode(",", $_REQUEST["plugins"] ?? ""); + + # we're in classes/pref/ + $root_dir = dirname(dirname(__DIR__)); + + $rv = []; + + if (count($plugins) > 0) { + foreach ($plugins as $plugin_name) { + array_push($rv, ["plugin" => $plugin_name, "rv" => $this->_update_plugin($root_dir, $plugin_name)]); + } + // @phpstan-ignore-next-line + } else { + $plugin_dirs = array_filter(glob("$root_dir/plugins.local/*"), "is_dir"); + + foreach ($plugin_dirs as $dir) { + if (is_dir("$dir/.git")) { + $plugin_name = basename($dir); + + $test = self::_plugin_needs_update($root_dir, $plugin_name); + + if (!empty($test["o"])) + array_push($rv, ["plugin" => $plugin_name, "rv" => $this->_update_plugin($root_dir, $plugin_name)]); + } + } + } + + print json_encode($rv); + } } function clearplugindata() { @@ -1150,66 +1323,61 @@ class Pref_Prefs extends Handler_Protected { } function activateprofile() { - $_SESSION["profile"] = (int) clean($_REQUEST["id"]); + $id = (int) $_REQUEST['id'] ?? 0; + + $profile = ORM::for_table('ttrss_settings_profiles') + ->where('owner_uid', $_SESSION['uid']) + ->find_one($id); - // default value - if (!$_SESSION["profile"]) $_SESSION["profile"] = null; + if ($profile) { + $_SESSION["profile"] = $id; + } else { + $_SESSION["profile"] = null; + } } function remprofiles() { - $ids = explode(",", clean($_REQUEST["ids"])); + $ids = $_REQUEST["ids"] ?? []; - foreach ($ids as $id) { - if ($_SESSION["profile"] != $id) { - $sth = $this->pdo->prepare("DELETE FROM ttrss_settings_profiles WHERE id = ? AND - owner_uid = ?"); - $sth->execute([$id, $_SESSION['uid']]); - } - } + ORM::for_table('ttrss_settings_profiles') + ->where('owner_uid', $_SESSION['uid']) + ->where_in('id', $ids) + ->where_not_equal('id', $_SESSION['profile'] ?? 0) + ->delete_many(); } function addprofile() { $title = clean($_REQUEST["title"]); if ($title) { - $this->pdo->beginTransaction(); - - $sth = $this->pdo->prepare("SELECT id FROM ttrss_settings_profiles - WHERE title = ? AND owner_uid = ?"); - $sth->execute([$title, $_SESSION['uid']]); - - if (!$sth->fetch()) { + $profile = ORM::for_table('ttrss_settings_profiles') + ->where('owner_uid', $_SESSION['uid']) + ->where('title', $title) + ->find_one(); - $sth = $this->pdo->prepare("INSERT INTO ttrss_settings_profiles (title, owner_uid) - VALUES (?, ?)"); + if (!$profile) { + $profile = ORM::for_table('ttrss_settings_profiles')->create(); - $sth->execute([$title, $_SESSION['uid']]); - - $sth = $this->pdo->prepare("SELECT id FROM ttrss_settings_profiles WHERE - title = ? AND owner_uid = ?"); - $sth->execute([$title, $_SESSION['uid']]); + $profile->title = $title; + $profile->owner_uid = $_SESSION['uid']; + $profile->save(); } - - $this->pdo->commit(); } } function saveprofile() { - $id = clean($_REQUEST["id"]); - $title = clean($_REQUEST["title"]); + $id = (int)$_REQUEST["id"]; + $title = clean($_REQUEST["value"]); - if ($id == 0) { - print __("Default profile"); - return; - } - - if ($title) { - $sth = $this->pdo->prepare("UPDATE ttrss_settings_profiles - SET title = ? WHERE id = ? AND - owner_uid = ?"); + if ($title && $id) { + $profile = ORM::for_table('ttrss_settings_profiles') + ->where('owner_uid', $_SESSION['uid']) + ->find_one($id); - $sth->execute([$title, $id, $_SESSION['uid']]); - print $title; + if ($profile) { + $profile->title = $title; + $profile->save(); + } } } @@ -1217,18 +1385,19 @@ class Pref_Prefs extends Handler_Protected { function getProfiles() { $rv = []; - $sth = $this->pdo->prepare("SELECT title,id FROM ttrss_settings_profiles - WHERE owner_uid = ? ORDER BY title"); - $sth->execute([$_SESSION['uid']]); + $profiles = ORM::for_table('ttrss_settings_profiles') + ->where('owner_uid', $_SESSION['uid']) + ->order_by_expr('title') + ->find_many(); array_push($rv, ["title" => __("Default profile"), "id" => 0, "active" => empty($_SESSION["profile"]) ]); - while ($row = $sth->fetch(PDO::FETCH_ASSOC)) { - $row["active"] = isset($_SESSION["profile"]) && $_SESSION["profile"] == $row["id"]; - array_push($rv, $row); + foreach ($profiles as $profile) { + $profile['active'] = ($_SESSION["profile"] ?? 0) == $profile->id; + array_push($rv, $profile->as_array()); }; print json_encode($rv); @@ -1271,23 +1440,25 @@ class Pref_Prefs extends Handler_Protected { <th align='right'><?= __("Last used") ?></th> </tr> <?php - $sth = $this->pdo->prepare("SELECT id, title, created, last_used - FROM ttrss_app_passwords WHERE owner_uid = ?"); - $sth->execute([$_SESSION['uid']]); - while ($row = $sth->fetch()) { ?> - <tr data-row-id='<?= $row['id'] ?>'> + $passwords = ORM::for_table('ttrss_app_passwords') + ->where('owner_uid', $_SESSION['uid']) + ->order_by_asc('title') + ->find_many(); + + foreach ($passwords as $pass) { ?> + <tr data-row-id='<?= $pass['id'] ?>'> <td align='center'> <input onclick='Tables.onRowChecked(this)' dojoType='dijit.form.CheckBox' type='checkbox'> </td> <td> - <?= htmlspecialchars($row["title"]) ?> + <?= htmlspecialchars($pass["title"]) ?> </td> <td align='right' class='text-muted'> - <?= TimeHelper::make_local_datetime($row['created'], false) ?> + <?= TimeHelper::make_local_datetime($pass['created'], false) ?> </td> <td align='right' class='text-muted'> - <?= TimeHelper::make_local_datetime($row['last_used'], false) ?> + <?= TimeHelper::make_local_datetime($pass['last_used'], false) ?> </td> </tr> <?php } ?> @@ -1296,18 +1467,11 @@ class Pref_Prefs extends Handler_Protected { <?php } - private function _encrypt_app_password($password) { - $salt = substr(bin2hex(get_random_bytes(24)), 0, 24); - - return "SSHA-512:".hash('sha512', $salt . $password). ":$salt"; - } - - function deleteAppPassword() { - $ids = explode(",", clean($_REQUEST['ids'])); - $ids_qmarks = arr_qmarks($ids); - - $sth = $this->pdo->prepare("DELETE FROM ttrss_app_passwords WHERE id IN ($ids_qmarks) AND owner_uid = ?"); - $sth->execute(array_merge($ids, [$_SESSION['uid']])); + function deleteAppPasswords() { + $passwords = ORM::for_table('ttrss_app_passwords') + ->where('owner_uid', $_SESSION['uid']) + ->where_in('id', $_REQUEST['ids'] ?? []) + ->delete_many(); $this->appPasswordList(); } @@ -1315,17 +1479,41 @@ class Pref_Prefs extends Handler_Protected { function generateAppPassword() { $title = clean($_REQUEST['title']); $new_password = make_password(16); - $new_password_hash = $this->_encrypt_app_password($new_password); + $new_salt = UserHelper::get_salt(); + $new_password_hash = UserHelper::hash_password($new_password, $new_salt, UserHelper::HASH_ALGOS[0]); print_warning(T_sprintf("Generated password <strong>%s</strong> for %s. Please remember it for future reference.", $new_password, $title)); - $sth = $this->pdo->prepare("INSERT INTO ttrss_app_passwords - (title, pwd_hash, service, created, owner_uid) - VALUES - (?, ?, ?, NOW(), ?)"); + $password = ORM::for_table('ttrss_app_passwords')->create(); - $sth->execute([$title, $new_password_hash, Auth_Base::AUTH_SERVICE_API, $_SESSION['uid']]); + $password->title = $title; + $password->owner_uid = $_SESSION['uid']; + $password->pwd_hash = "$new_password_hash:$new_salt"; + $password->service = Auth_Base::AUTH_SERVICE_API; + $password->created = Db::NOW(); + + $password->save(); $this->appPasswordList(); } + + function previewDigest() { + print json_encode(Digest::prepare_headlines_digest($_SESSION["uid"], 1, 16)); + } + + static function _get_ssl_certificate_id() { + if ($_SERVER["REDIRECT_SSL_CLIENT_M_SERIAL"] ?? false) { + return sha1($_SERVER["REDIRECT_SSL_CLIENT_M_SERIAL"] . + $_SERVER["REDIRECT_SSL_CLIENT_V_START"] . + $_SERVER["REDIRECT_SSL_CLIENT_V_END"] . + $_SERVER["REDIRECT_SSL_CLIENT_S_DN"]); + } + if ($_SERVER["SSL_CLIENT_M_SERIAL"] ?? false) { + return sha1($_SERVER["SSL_CLIENT_M_SERIAL"] . + $_SERVER["SSL_CLIENT_V_START"] . + $_SERVER["SSL_CLIENT_V_END"] . + $_SERVER["SSL_CLIENT_S_DN"]); + } + return ""; + } } diff --git a/classes/pref/system.php b/classes/pref/system.php index 85635e753..c79b5095d 100644 --- a/classes/pref/system.php +++ b/classes/pref/system.php @@ -14,6 +14,20 @@ class Pref_System extends Handler_Administrative { $this->pdo->query("DELETE FROM ttrss_error_log"); } + function sendTestEmail() { + $mail_address = clean($_REQUEST["mail_address"]); + + $mailer = new Mailer(); + + $rc = $mailer->mail(["to_name" => "", + "to_address" => $mail_address, + "subject" => __("Test message from tt-rss"), + "message" => ("This message confirms that tt-rss can send outgoing mail.") + ]); + + print json_encode(['rc' => $rc, 'error' => $mailer->error()]); + } + function getphpinfo() { ob_start(); phpinfo(); @@ -103,12 +117,12 @@ class Pref_System extends Handler_Administrative { <table width='100%' class='event-log'> - <tr class='title'> - <td width='5%'><?= __("Error") ?></td> - <td><?= __("Filename") ?></td> - <td><?= __("Message") ?></td> - <td width='5%'><?= __("User") ?></td> - <td width='5%'><?= __("Date") ?></td> + <tr> + <th width='5%'><?= __("Error") ?></th> + <th><?= __("Filename") ?></th> + <th><?= __("Message") ?></th> + <th width='5%'><?= __("User") ?></th> + <th width='5%'><?= __("Date") ?></th> </tr> <?php @@ -151,16 +165,48 @@ class Pref_System extends Handler_Administrative { $page = (int) ($_REQUEST["page"] ?? 0); ?> <div dojoType='dijit.layout.AccordionContainer' region='center'> - <div dojoType='dijit.layout.AccordionPane' style='padding : 0' title='<i class="material-icons">report</i> <?= __('Event Log') ?>'> - <?php - if (Config::get(Config::LOG_DESTINATION) == "sql") { + <?php if (Config::get(Config::LOG_DESTINATION) == Logger::LOG_DEST_SQL) { ?> + <div dojoType='dijit.layout.AccordionPane' style='padding : 0' title='<i class="material-icons">report</i> <?= __('Event log') ?>'> + <?php $this->_log_viewer($page, $severity); - } else { - print_notice("Please set Config::get(Config::LOG_DESTINATION) to 'sql' in config.php to enable database logging."); - } - ?> + ?> + </div> + <?php } ?> + <div dojoType='dijit.layout.AccordionPane' style='padding : 0' title='<i class="material-icons">mail</i> <?= __('Mail configuration') ?>'> + <div dojoType="dijit.layout.ContentPane"> + + <form dojoType="dijit.form.Form"> + <script type="dojo/method" event="onSubmit" args="evt"> + evt.preventDefault(); + if (this.validate()) { + xhr.json("backend.php", this.getValues(), (reply) => { + const msg = App.byId("mail-test-result"); + + if (reply.rc) { + msg.innerHTML = __("Mail sent."); + msg.className = 'alert alert-success'; + } else { + msg.innerHTML = reply.error; + msg.className = 'alert alert-danger'; + } + + msg.show(); + }) + } + </script> + + <?= \Controls\hidden_tag("op", "pref-system") ?> + <?= \Controls\hidden_tag("method", "sendTestEmail") ?> + + <fieldset> + <label><?= __("To:") ?></label> + <?= \Controls\input_tag("mail_address", "", "text", ['required' => 1]) ?> + <?= \Controls\submit_tag(__("Send test email")) ?> + <span style="display: none; margin-left : 10px" class="alert alert-error" id="mail-test-result">...</span> + </fieldset> + </form> + </div> </div> - <div dojoType='dijit.layout.AccordionPane' title='<i class="material-icons">info</i> <?= __('PHP Information') ?>'> <script type='dojo/method' event='onSelected' args='evt'> if (this.domNode.querySelector('.loading')) diff --git a/classes/pref/users.php b/classes/pref/users.php index 13f808cb3..2e3dc4b67 100644 --- a/classes/pref/users.php +++ b/classes/pref/users.php @@ -1,24 +1,22 @@ <?php class Pref_Users extends Handler_Administrative { function csrf_ignore($method) { - $csrf_ignored = array("index"); - - return array_search($method, $csrf_ignored) !== false; + return $method == "index"; } function edit() { - global $access_level_names; - - $id = (int)clean($_REQUEST["id"]); + $user = ORM::for_table('ttrss_users') + ->select_expr("id,login,access_level,email,full_name,otp_enabled") + ->find_one((int)$_REQUEST["id"]) + ->as_array(); - $sth = $this->pdo->prepare("SELECT id, login, access_level, email FROM ttrss_users WHERE id = ?"); - $sth->execute([$id]); + global $access_level_names; - if ($row = $sth->fetch(PDO::FETCH_ASSOC)) { + if ($user) { print json_encode([ - "user" => $row, - "access_level_names" => $access_level_names - ]); + "user" => $user, + "access_level_names" => $access_level_names + ]); } } @@ -106,31 +104,32 @@ class Pref_Users extends Handler_Administrative { } function editSave() { - $login = clean($_REQUEST["login"]); - $uid = clean($_REQUEST["id"]); - $access_level = (int) clean($_REQUEST["access_level"]); - $email = clean($_REQUEST["email"]); + $id = (int)$_REQUEST['id']; $password = clean($_REQUEST["password"]); + $user = ORM::for_table('ttrss_users')->find_one($id); - // no blank usernames - if (!$login) return; + if ($user) { + $login = clean($_REQUEST["login"]); - // forbid renaming admin - if ($uid == 1) $login = "admin"; + if ($id == 1) $login = "admin"; + if (!$login) return; - if ($password) { - $salt = substr(bin2hex(get_random_bytes(125)), 0, 250); - $pwd_hash = encrypt_password($password, $salt, true); - $pass_query_part = "pwd_hash = ".$this->pdo->quote($pwd_hash).", - salt = ".$this->pdo->quote($salt).","; - } else { - $pass_query_part = ""; - } + $user->login = mb_strtolower($login); + $user->access_level = (int) clean($_REQUEST["access_level"]); + $user->email = clean($_REQUEST["email"]); + $user->otp_enabled = checkbox_to_sql_bool($_REQUEST["otp_enabled"]); - $sth = $this->pdo->prepare("UPDATE ttrss_users SET $pass_query_part login = LOWER(?), - access_level = ?, email = ?, otp_enabled = false WHERE id = ?"); - $sth->execute([$login, $access_level, $email, $uid]); + // force new OTP secret when next enabled + if (Config::get_schema_version() >= 143 && !$user->otp_enabled) { + $user->otp_secret = null; + } + + $user->save(); + } + if ($password) { + UserHelper::reset_password($id, false, $password); + } } function remove() { @@ -152,24 +151,25 @@ class Pref_Users extends Handler_Administrative { function add() { $login = clean($_REQUEST["login"]); - $tmp_user_pwd = make_password(); - $salt = substr(bin2hex(get_random_bytes(125)), 0, 250); - $pwd_hash = encrypt_password($tmp_user_pwd, $salt, true); if (!$login) return; // no blank usernames if (!UserHelper::find_user_by_login($login)) { - $sth = $this->pdo->prepare("INSERT INTO ttrss_users - (login,pwd_hash,access_level,last_login,created, salt) - VALUES (LOWER(?), ?, 0, null, NOW(), ?)"); - $sth->execute([$login, $pwd_hash, $salt]); + $new_password = make_password(); - if ($new_uid = UserHelper::find_user_by_login($login)) { + $user = ORM::for_table('ttrss_users')->create(); - print T_sprintf("Added user %s with password %s", - $login, $tmp_user_pwd); + $user->salt = UserHelper::get_salt(); + $user->login = mb_strtolower($login); + $user->pwd_hash = UserHelper::hash_password($new_password, $user->salt); + $user->access_level = 0; + $user->created = Db::NOW(); + $user->save(); + if ($new_uid = UserHelper::find_user_by_login($login)) { + print T_sprintf("Added user %s with password %s", + $login, $new_password); } else { print T_sprintf("Could not create user %s", $login); } @@ -200,11 +200,10 @@ class Pref_Users extends Handler_Administrative { $sort = "login"; } - $sort = $this->_validate_field($sort, - ["login", "access_level", "created", "num_feeds", "created", "last_login"], "login"); + if (!in_array($sort, ["login", "access_level", "created", "num_feeds", "created", "last_login"])) + $sort = "login"; if ($sort != "login") $sort = "$sort DESC"; - ?> <div dojoType='dijit.layout.BorderContainer' gutters='false'> @@ -249,42 +248,41 @@ class Pref_Users extends Handler_Administrative { <table width='100%' class='users-list' id='users-list'> - <tr class='title'> - <td align='center' width='5%'> </td> - <td width='20%'><a href='#' onclick="Users.reload('login')"><?= ('Login') ?></a></td> - <td width='20%'><a href='#' onclick="Users.reload('access_level')"><?= ('Access Level') ?></a></td> - <td width='10%'><a href='#' onclick="Users.reload('num_feeds')"><?= ('Subscribed feeds') ?></a></td> - <td width='20%'><a href='#' onclick="Users.reload('created')"><?= ('Registered') ?></a></td> - <td width='20%'><a href='#' onclick="Users.reload('last_login')"><?= ('Last login') ?></a></td> + <tr> + <th></th> + <th><a href='#' onclick="Users.reload('login')"><?= ('Login') ?></a></th> + <th><a href='#' onclick="Users.reload('access_level')"><?= ('Access Level') ?></a></th> + <th><a href='#' onclick="Users.reload('num_feeds')"><?= ('Subscribed feeds') ?></a></th> + <th><a href='#' onclick="Users.reload('created')"><?= ('Registered') ?></a></th> + <th><a href='#' onclick="Users.reload('last_login')"><?= ('Last login') ?></a></th> </tr> <?php - $sth = $this->pdo->prepare("SELECT - tu.id, - login,access_level,email, - ".SUBSTRING_FOR_DATE."(last_login,1,16) as last_login, - ".SUBSTRING_FOR_DATE."(created,1,16) as created, - (SELECT COUNT(id) FROM ttrss_feeds WHERE owner_uid = tu.id) AS num_feeds - FROM - ttrss_users tu - WHERE - (:search = '' OR login LIKE :search) AND tu.id > 0 - ORDER BY $sort"); - $sth->execute([":search" => $user_search ? "%$user_search%" : ""]); - - while ($row = $sth->fetch()) { ?> - - <tr data-row-id='<?= $row["id"] ?>' onclick='Users.edit(<?= $row["id"] ?>)' title="<?= __('Click to edit') ?>"> - <td align='center'> + $users = ORM::for_table('ttrss_users') + ->table_alias('u') + ->left_outer_join("ttrss_feeds", ["owner_uid", "=", "u.id"], 'f') + ->select_expr('u.*,COUNT(f.id) AS num_feeds') + ->where_like("login", $user_search ? "%$user_search%" : "%") + ->order_by_expr($sort) + ->group_by_expr('u.id') + ->find_many(); + + foreach ($users as $user) { ?> + + <tr data-row-id='<?= $user["id"] ?>' onclick='Users.edit(<?= $user["id"] ?>)' title="<?= __('Click to edit') ?>"> + <td class='checkbox'> <input onclick='Tables.onRowChecked(this); event.stopPropagation();' dojoType='dijit.form.CheckBox' type='checkbox'> </td> - <td><i class='material-icons'>person</i> <?= htmlspecialchars($row["login"]) ?></td> - <td><?= $access_level_names[$row["access_level"]] ?></td> - <td><?= $row["num_feeds"] ?></td> - <td><?= TimeHelper::make_local_datetime($row["created"], false) ?></td> - <td><?= TimeHelper::make_local_datetime($row["last_login"], false) ?></td> + <td width='30%'> + <i class='material-icons'>person</i> + <strong><?= htmlspecialchars($user["login"]) ?></strong> + </td> + <td><?= $access_level_names[$user["access_level"]] ?></td> + <td><?= $user["num_feeds"] ?></td> + <td class='text-muted'><?= TimeHelper::make_local_datetime($user["created"], false) ?></td> + <td class='text-muted'><?= TimeHelper::make_local_datetime($user["last_login"], false) ?></td> </tr> <?php } ?> </table> @@ -294,11 +292,4 @@ class Pref_Users extends Handler_Administrative { <?php } - private function _validate_field($string, $allowed, $default = "") { - if (in_array($string, $allowed)) - return $string; - else - return $default; - } - } |