summaryrefslogtreecommitdiff
path: root/classes/pref
diff options
context:
space:
mode:
Diffstat (limited to 'classes/pref')
-rwxr-xr-xclasses/pref/feeds.php253
-rwxr-xr-xclasses/pref/filters.php4
-rw-r--r--classes/pref/labels.php12
-rw-r--r--classes/pref/prefs.php920
-rw-r--r--classes/pref/system.php74
-rw-r--r--classes/pref/users.php151
6 files changed, 799 insertions, 615 deletions
diff --git a/classes/pref/feeds.php b/classes/pref/feeds.php
index 3b4afab26..788104d38 100755
--- a/classes/pref/feeds.php
+++ b/classes/pref/feeds.php
@@ -1,5 +1,10 @@
<?php
class Pref_Feeds extends Handler_Protected {
+ const E_ICON_FILE_TOO_LARGE = 'E_ICON_FILE_TOO_LARGE';
+ const E_ICON_RENAME_FAILED = 'E_ICON_RENAME_FAILED';
+ const E_ICON_UPLOAD_FAILED = 'E_ICON_UPLOAD_FAILED';
+ const E_ICON_UPLOAD_SUCCESS = 'E_ICON_UPLOAD_SUCCESS';
+
function csrf_ignore($method) {
$csrf_ignored = array("index", "getfeedtree", "savefeedorder");
@@ -22,14 +27,16 @@ class Pref_Feeds extends Handler_Protected {
return $rv;
}
- function renamecat() {
+ function renameCat() {
+ $cat = ORM::for_table("ttrss_feed_categories")
+ ->where("owner_uid", $_SESSION["uid"])
+ ->find_one($_REQUEST['id']);
+
$title = clean($_REQUEST['title']);
- $id = clean($_REQUEST['id']);
- if ($title) {
- $sth = $this->pdo->prepare("UPDATE ttrss_feed_categories SET
- title = ? WHERE id = ? AND owner_uid = ?");
- $sth->execute([$title, $id, $_SESSION['uid']]);
+ if ($cat && $title) {
+ $cat->title = $title;
+ $cat->save();
}
}
@@ -433,78 +440,67 @@ class Pref_Feeds extends Handler_Protected {
}
}
- function removeicon() {
- $feed_id = clean($_REQUEST["feed_id"]);
-
- $sth = $this->pdo->prepare("SELECT id FROM ttrss_feeds
- WHERE id = ? AND owner_uid = ?");
- $sth->execute([$feed_id, $_SESSION['uid']]);
+ function removeIcon() {
+ $feed_id = (int) $_REQUEST["feed_id"];
+ $icon_file = Config::get(Config::ICONS_DIR) . "/$feed_id.ico";
- if ($row = $sth->fetch()) {
- @unlink(Config::get(Config::ICONS_DIR) . "/$feed_id.ico");
+ $feed = ORM::for_table('ttrss_feeds')
+ ->where('owner_uid', $_SESSION['uid'])
+ ->find_one($feed_id);
- $sth = $this->pdo->prepare("UPDATE ttrss_feeds SET favicon_avg_color = NULL, favicon_last_checked = '1970-01-01'
- where id = ?");
- $sth->execute([$feed_id]);
+ if ($feed && file_exists($icon_file)) {
+ if (unlink($icon_file)) {
+ $feed->set([
+ 'favicon_avg_color' => null,
+ 'favicon_last_checked' => '1970-01-01',
+ 'favicon_is_custom' => false,
+ ]);
+ $feed->save();
+ }
}
}
- function uploadicon() {
- header("Content-type: text/html");
+ function uploadIcon() {
+ $feed_id = (int) $_REQUEST['feed_id'];
+ $tmp_file = tempnam(Config::get(Config::CACHE_DIR) . '/upload', 'icon');
- if (is_uploaded_file($_FILES['icon_file']['tmp_name'])) {
- $tmp_file = tempnam(Config::get(Config::CACHE_DIR) . '/upload', 'icon');
+ // default value
+ $rc = self::E_ICON_UPLOAD_FAILED;
- if (!$tmp_file)
- return;
+ $feed = ORM::for_table('ttrss_feeds')
+ ->where('owner_uid', $_SESSION['uid'])
+ ->find_one($feed_id);
- $result = move_uploaded_file($_FILES['icon_file']['tmp_name'], $tmp_file);
+ if ($feed && $tmp_file && move_uploaded_file($_FILES['icon_file']['tmp_name'], $tmp_file)) {
+ if (filesize($tmp_file) < Config::get(Config::MAX_FAVICON_FILE_SIZE)) {
- if (!$result) {
- return;
- }
- } else {
- return;
- }
+ $new_filename = Config::get(Config::ICONS_DIR) . "/$feed_id.ico";
- $icon_file = $tmp_file;
- $feed_id = clean($_REQUEST["feed_id"]);
- $rc = 2; // failed
+ if (file_exists($new_filename)) unlink($new_filename);
+ if (rename($tmp_file, $new_filename)) {
+ chmod($new_filename, 0644);
- if ($icon_file && is_file($icon_file) && $feed_id) {
- if (filesize($icon_file) < 65535) {
+ $feed->set([
+ 'favicon_avg_color' => null,
+ 'favicon_is_custom' => true,
+ ]);
- $sth = $this->pdo->prepare("SELECT id FROM ttrss_feeds
- WHERE id = ? AND owner_uid = ?");
- $sth->execute([$feed_id, $_SESSION['uid']]);
-
- if ($row = $sth->fetch()) {
- $new_filename = Config::get(Config::ICONS_DIR) . "/$feed_id.ico";
-
- if (file_exists($new_filename)) unlink($new_filename);
-
- if (rename($icon_file, $new_filename)) {
- chmod($new_filename, 644);
-
- $sth = $this->pdo->prepare("UPDATE ttrss_feeds SET
- favicon_avg_color = ''
- WHERE id = ?");
- $sth->execute([$feed_id]);
+ if ($feed->save()) {
+ $rc = self::E_ICON_UPLOAD_SUCCESS;
+ }
- $rc = Feeds::_get_icon($feed_id);
+ } else {
+ $rc = self::E_ICON_RENAME_FAILED;
}
- }
} else {
- $rc = 1;
+ $rc = self::E_ICON_FILE_TOO_LARGE;
}
}
- if ($icon_file && is_file($icon_file)) {
- unlink($icon_file);
- }
+ if (file_exists($tmp_file))
+ unlink($tmp_file);
- print $rc;
- return;
+ print json_encode(['rc' => $rc, 'icon_url' => Feeds::_get_icon($feed_id)]);
}
function editfeed() {
@@ -513,11 +509,11 @@ class Pref_Feeds extends Handler_Protected {
$feed_id = (int)clean($_REQUEST["id"]);
- $sth = $this->pdo->prepare("SELECT * FROM ttrss_feeds WHERE id = ? AND
- owner_uid = ?");
- $sth->execute([$feed_id, $_SESSION['uid']]);
+ $row = ORM::for_table('ttrss_feeds')
+ ->where("owner_uid", $_SESSION["uid"])
+ ->find_one($feed_id)->as_array();
- if ($row = $sth->fetch(PDO::FETCH_ASSOC)) {
+ if ($row) {
ob_start();
PluginHost::getInstance()->run_hooks(PluginHost::HOOK_PREFS_EDIT_FEED, $feed_id);
@@ -694,7 +690,7 @@ class Pref_Feeds extends Handler_Protected {
$purge_intl = (int) clean($_POST["purge_interval"] ?? 0);
$feed_id = (int) clean($_POST["id"] ?? 0); /* editSave */
$feed_ids = explode(",", clean($_POST["ids"] ?? "")); /* batchEditSave */
- $cat_id = (int) clean($_POST["cat_id"]);
+ $cat_id = (int) clean($_POST["cat_id"] ?? 0);
$auth_login = clean($_POST["auth_login"]);
$auth_pass = clean($_POST["auth_pass"]);
$private = checkbox_to_sql_bool(clean($_POST["private"] ?? ""));
@@ -710,7 +706,7 @@ class Pref_Feeds extends Handler_Protected {
$mark_unread_on_update = checkbox_to_sql_bool(
clean($_POST["mark_unread_on_update"] ?? ""));
- $feed_language = clean($_POST["feed_language"]);
+ $feed_language = clean($_POST["feed_language"] ?? "");
if (!$batch) {
@@ -720,48 +716,32 @@ class Pref_Feeds extends Handler_Protected {
$reset_basic_info = $orig_feed_url != $feed_url; */
- $sth = $this->pdo->prepare("UPDATE ttrss_feeds SET
- cat_id = :cat_id,
- title = :title,
- feed_url = :feed_url,
- site_url = :site_url,
- update_interval = :upd_intl,
- purge_interval = :purge_intl,
- auth_login = :auth_login,
- auth_pass = :auth_pass,
- auth_pass_encrypted = false,
- private = :private,
- cache_images = :cache_images,
- hide_images = :hide_images,
- include_in_digest = :include_in_digest,
- always_display_enclosures = :always_display_enclosures,
- mark_unread_on_update = :mark_unread_on_update,
- feed_language = :feed_language
- WHERE id = :id AND owner_uid = :uid");
-
- $sth->execute([":title" => $feed_title,
- ":cat_id" => $cat_id ? $cat_id : null,
- ":feed_url" => $feed_url,
- ":site_url" => $site_url,
- ":upd_intl" => $upd_intl,
- ":purge_intl" => $purge_intl,
- ":auth_login" => $auth_login,
- ":auth_pass" => $auth_pass,
- ":private" => (int)$private,
- ":cache_images" => (int)$cache_images,
- ":hide_images" => (int)$hide_images,
- ":include_in_digest" => (int)$include_in_digest,
- ":always_display_enclosures" => (int)$always_display_enclosures,
- ":mark_unread_on_update" => (int)$mark_unread_on_update,
- ":feed_language" => $feed_language,
- ":id" => $feed_id,
- ":uid" => $_SESSION['uid']]);
-
-/* if ($reset_basic_info) {
- RSSUtils::set_basic_feed_info($feed_id);
- } */
-
- PluginHost::getInstance()->run_hooks(PluginHost::HOOK_PREFS_SAVE_FEED, $feed_id);
+ $feed = ORM::for_table('ttrss_feeds')
+ ->where('owner_uid', $_SESSION['uid'])
+ ->find_one($feed_id);
+
+ if ($feed) {
+
+ $feed->title = $feed_title;
+ $feed->cat_id = $cat_id ? $cat_id : null;
+ $feed->feed_url = $feed_url;
+ $feed->site_url = $site_url;
+ $feed->update_interval = $upd_intl;
+ $feed->purge_interval = $purge_intl;
+ $feed->auth_login = $auth_login;
+ $feed->auth_pass = $auth_pass;
+ $feed->private = (int)$private;
+ $feed->cache_images = (int)$cache_images;
+ $feed->hide_images = (int)$hide_images;
+ $feed->feed_language = $feed_language;
+ $feed->include_in_digest = (int)$include_in_digest;
+ $feed->always_display_enclosures = (int)$always_display_enclosures;
+ $feed->mark_unread_on_update = (int)$mark_unread_on_update;
+
+ $feed->save();
+
+ PluginHost::getInstance()->run_hooks(PluginHost::HOOK_PREFS_SAVE_FEED, $feed_id);
+ }
} else {
$feed_data = array();
@@ -874,14 +854,14 @@ class Pref_Feeds extends Handler_Protected {
function removeCat() {
$ids = explode(",", clean($_REQUEST["ids"]));
foreach ($ids as $id) {
- $this->remove_feed_category($id, $_SESSION["uid"]);
+ Feeds::_remove_cat((int)$id, $_SESSION["uid"]);
}
}
function addCat() {
$feed_cat = clean($_REQUEST["cat"]);
- Feeds::_add_cat($feed_cat);
+ Feeds::_add_cat($feed_cat, $_SESSION['uid']);
}
function importOpml() {
@@ -1003,10 +983,6 @@ class Pref_Feeds extends Handler_Protected {
private function index_opml() {
?>
- <h3><?= __("Using OPML you can export and import your feeds, filters, labels and Tiny Tiny RSS settings.") ?></h3>
-
- <?php print_notice("Only main settings profile can be migrated using OPML.") ?>
-
<form id='opml_import_form' method='post' enctype='multipart/form-data'>
<label class='dijitButton'><?= __("Choose file...") ?>
<input style='display : none' id='opml_file' name='opml_file' type='file'>
@@ -1015,20 +991,24 @@ class Pref_Feeds extends Handler_Protected {
<input type='hidden' name='csrf_token' value="<?= $_SESSION['csrf_token'] ?>">
<input type='hidden' name='method' value='importOpml'>
<button dojoType='dijit.form.Button' class='alt-primary' onclick="return Helpers.OPML.import()" type="submit">
+ <?= \Controls\icon("file_upload") ?>
<?= __('Import OPML') ?>
</button>
</form>
<hr/>
+ <?php print_notice("Only main settings profile can be migrated using OPML.") ?>
+
<form dojoType='dijit.form.Form' id='opmlExportForm' style='display : inline-block'>
<button dojoType='dijit.form.Button' onclick='Helpers.OPML.export()'>
+ <?= \Controls\icon("file_download") ?>
<?= __('Export OPML') ?>
</button>
<label class='checkbox'>
<?= \Controls\checkbox_tag("include_settings", true, "1") ?>
- <?= __("Include settings") ?>
+ <?= __("Include tt-rss settings") ?>
</label>
</form>
@@ -1036,12 +1016,10 @@ class Pref_Feeds extends Handler_Protected {
<h2><?= __("Published OPML") ?></h2>
- <p>
- <?= __('Your OPML can be published publicly and can be subscribed by anyone who knows the URL below.') ?>
- <?= __("Published OPML does not include your Tiny Tiny RSS settings, feeds that require authentication or feeds hidden from Popular feeds.") ?>
- </p>
+ <?= format_notice("Your OPML can be published and then subscribed by anyone who knows the URL below. This won't include your settings nor authenticated feeds.") ?>
<button dojoType='dijit.form.Button' class='alt-primary' onclick="return Helpers.OPML.publish()">
+ <?= \Controls\icon("share") ?>
<?= __('Display published OPML URL') ?>
</button>
@@ -1052,14 +1030,16 @@ class Pref_Feeds extends Handler_Protected {
private function index_shared() {
?>
- <h3><?= __('Published articles can be subscribed by anyone who knows the following URL:') ?></h3>
+ <?= format_notice('Published articles can be subscribed by anyone who knows the following URL:') ?></h3>
<button dojoType='dijit.form.Button' class='alt-primary'
onclick="CommonDialogs.generatedFeed(-2, false)">
+ <?= \Controls\icon('share') ?>
<?= __('Display URL') ?>
</button>
<button class='alt-danger' dojoType='dijit.form.Button' onclick='return Helpers.Feeds.clearFeedAccessKeys()'>
+ <?= \Controls\icon('delete') ?>
<?= __('Clear all generated URLs') ?>
</button>
@@ -1188,12 +1168,6 @@ class Pref_Feeds extends Handler_Protected {
print json_encode($rv);
}
- private function remove_feed_category($id, $owner_uid) {
- $sth = $this->pdo->prepare("DELETE FROM ttrss_feed_categories
- WHERE id = ? AND owner_uid = ?");
- $sth->execute([$id, $owner_uid]);
- }
-
static function remove_feed($id, $owner_uid) {
if (PluginHost::getInstance()->run_hooks_until(PluginHost::HOOK_UNSUBSCRIBE_FEED, true, $id, $owner_uid))
@@ -1273,12 +1247,16 @@ class Pref_Feeds extends Handler_Protected {
}
}
+ function clearKeys() {
+ return Feeds::_clear_access_keys($_SESSION['uid']);
+ }
+
function getOPMLKey() {
print json_encode(["link" => OPML::get_publish_url()]);
}
function regenOPMLKey() {
- $this->update_feed_access_key('OPML:Publish',
+ Feeds::_update_access_key('OPML:Publish',
false, $_SESSION["uid"]);
print json_encode(["link" => OPML::get_publish_url()]);
@@ -1288,17 +1266,17 @@ class Pref_Feeds extends Handler_Protected {
$feed_id = clean($_REQUEST['id']);
$is_cat = clean($_REQUEST['is_cat']);
- $new_key = $this->update_feed_access_key($feed_id, $is_cat, $_SESSION["uid"]);
+ $new_key = Feeds::_update_access_key($feed_id, $is_cat, $_SESSION["uid"]);
print json_encode(["link" => $new_key]);
}
- function getsharedurl() {
+ function getSharedURL() {
$feed_id = clean($_REQUEST['id']);
$is_cat = clean($_REQUEST['is_cat']) == "true";
$search = clean($_REQUEST['search']);
- $link = get_self_url_prefix() . "/public.php?" . http_build_query([
+ $link = Config::get_self_url() . "/public.php?" . http_build_query([
'op' => 'rss',
'id' => $feed_id,
'is_cat' => (int)$is_cat,
@@ -1312,23 +1290,6 @@ class Pref_Feeds extends Handler_Protected {
]);
}
- private function update_feed_access_key($feed_id, $is_cat, $owner_uid) {
-
- // clear old value and generate new one
- $sth = $this->pdo->prepare("DELETE FROM ttrss_access_keys
- WHERE feed_id = ? AND is_cat = ? AND owner_uid = ?");
- $sth->execute([$feed_id, bool_to_sql_bool($is_cat), $owner_uid]);
-
- return Feeds::_get_access_key($feed_id, $is_cat, $owner_uid);
- }
-
- // Silent
- function clearKeys() {
- $sth = $this->pdo->prepare("DELETE FROM ttrss_access_keys WHERE
- owner_uid = ?");
- $sth->execute([$_SESSION['uid']]);
- }
-
private function calculate_children_count($cat) {
$c = 0;
diff --git a/classes/pref/filters.php b/classes/pref/filters.php
index a6ea9f982..29d309dbb 100755
--- a/classes/pref/filters.php
+++ b/classes/pref/filters.php
@@ -51,8 +51,8 @@ class Pref_Filters extends Handler_Protected {
$filter = array();
$filter["enabled"] = true;
- $filter["match_any_rule"] = checkbox_to_sql_bool(clean($_REQUEST["match_any_rule"]));
- $filter["inverse"] = checkbox_to_sql_bool(clean($_REQUEST["inverse"]));
+ $filter["match_any_rule"] = checkbox_to_sql_bool(clean($_REQUEST["match_any_rule"] ?? false));
+ $filter["inverse"] = checkbox_to_sql_bool(clean($_REQUEST["inverse"] ?? false));
$filter["rules"] = array();
$filter["actions"] = array("dummy-action");
diff --git a/classes/pref/labels.php b/classes/pref/labels.php
index 5bc094d55..2cdb919ce 100644
--- a/classes/pref/labels.php
+++ b/classes/pref/labels.php
@@ -8,14 +8,12 @@ class Pref_Labels extends Handler_Protected {
}
function edit() {
- $label_id = clean($_REQUEST['id']);
+ $label = ORM::for_table('ttrss_labels2')
+ ->where('owner_uid', $_SESSION['uid'])
+ ->find_one($_REQUEST['id']);
- $sth = $this->pdo->prepare("SELECT id, caption, fg_color, bg_color FROM ttrss_labels2 WHERE
- id = ? AND owner_uid = ?");
- $sth->execute([$label_id, $_SESSION['uid']]);
-
- if ($line = $sth->fetch(PDO::FETCH_ASSOC)) {
- print json_encode($line);
+ if ($label) {
+ print json_encode($label->as_array());
}
}
diff --git a/classes/pref/prefs.php b/classes/pref/prefs.php
index ba63d76b3..16c41df9d 100644
--- a/classes/pref/prefs.php
+++ b/classes/pref/prefs.php
@@ -1,4 +1,5 @@
<?php
+use chillerlan\QRCode;
class Pref_Prefs extends Handler_Protected {
@@ -7,6 +8,15 @@ class Pref_Prefs extends Handler_Protected {
private $pref_help_bottom = [];
private $pref_blacklist = [];
+ const PI_RES_ALREADY_INSTALLED = "PI_RES_ALREADY_INSTALLED";
+ const PI_RES_SUCCESS = "PI_RES_SUCCESS";
+ const PI_ERR_NO_CLASS = "PI_ERR_NO_CLASS";
+ const PI_ERR_NO_INIT_PHP = "PI_ERR_NO_INIT_PHP";
+ const PI_ERR_EXEC_FAILED = "PI_ERR_EXEC_FAILED";
+ const PI_ERR_NO_TEMPDIR = "PI_ERR_NO_TEMPDIR";
+ const PI_ERR_PLUGIN_NOT_FOUND = "PI_ERR_PLUGIN_NOT_FOUND";
+ const PI_ERR_NO_WORKDIR = "PI_ERR_NO_WORKDIR";
+
function csrf_ignore($method) {
$csrf_ignored = array("index", "updateself", "otpqrcode");
@@ -64,6 +74,7 @@ class Pref_Prefs extends Handler_Protected {
'BLOCK_SEPARATOR',
Prefs::SSL_CERT_SERIAL,
'BLOCK_SEPARATOR',
+ Prefs::DISABLE_CONDITIONAL_COUNTERS,
Prefs::HEADLINES_NO_DISTINCT,
],
__('Debugging') => [
@@ -105,6 +116,7 @@ class Pref_Prefs extends Handler_Protected {
Prefs::USER_CSS_THEME => array(__("Theme")),
Prefs::HEADLINES_NO_DISTINCT => array(__("Don't enforce DISTINCT headlines"), __("May produce duplicate entries")),
Prefs::DEBUG_HEADLINE_IDS => array(__("Show article and feed IDs"), __("In the headlines buffer")),
+ Prefs::DISABLE_CONDITIONAL_COUNTERS => array(__("Disable conditional counter updates"), __("May increase server load")),
];
// hidden in the main prefs UI (use to hide things that have description set above)
@@ -209,48 +221,45 @@ class Pref_Prefs extends Handler_Protected {
}
}
- function changeemail() {
+ function changePersonalData() {
+
+ $user = ORM::for_table('ttrss_users')->find_one($_SESSION['uid']);
+ $new_email = clean($_POST['email']);
- $email = clean($_POST["email"]);
- $full_name = clean($_POST["full_name"]);
- $active_uid = $_SESSION["uid"];
+ if ($user) {
+ $user->full_name = clean($_POST['full_name']);
- $sth = $this->pdo->prepare("SELECT email, login, full_name FROM ttrss_users WHERE id = ?");
- $sth->execute([$active_uid]);
+ if ($user->email != $new_email)
+ Logger::log(E_USER_NOTICE, "Email address of user ".$user->login." has been changed to ${new_email}.");
- if ($row = $sth->fetch()) {
- $old_email = $row["email"];
+ if ($user->email && $user->email != $new_email) {
- if ($old_email != $email) {
$mailer = new Mailer();
$tpl = new Templator();
$tpl->readTemplateFromFile("mail_change_template.txt");
- $tpl->setVariable('LOGIN', $row["login"]);
- $tpl->setVariable('NEWMAIL', $email);
+ $tpl->setVariable('LOGIN', $user->login);
+ $tpl->setVariable('NEWMAIL', $new_email);
$tpl->setVariable('TTRSS_HOST', Config::get(Config::SELF_URL_PATH));
$tpl->addBlock('message');
$tpl->generateOutputToString($message);
- $mailer->mail(["to_name" => $row["login"],
- "to_address" => $row["email"],
- "subject" => "[tt-rss] Mail address change notification",
+ $mailer->mail(["to_name" => $user->login,
+ "to_address" => $user->email,
+ "subject" => "[tt-rss] Email address change notification",
"message" => $message]);
+ $user->email = $new_email;
}
- }
- $sth = $this->pdo->prepare("UPDATE ttrss_users SET email = ?,
- full_name = ? WHERE id = ?");
- $sth->execute([$email, $full_name, $active_uid]);
+ $user->save();
+ }
print __("Your personal data has been saved.");
-
- return;
}
function resetconfig() {
@@ -261,21 +270,13 @@ class Pref_Prefs extends Handler_Protected {
private function index_auth_personal() {
- $sth = $this->pdo->prepare("SELECT email,full_name,otp_enabled,
- access_level FROM ttrss_users
- WHERE id = ?");
- $sth->execute([$_SESSION["uid"]]);
- $row = $sth->fetch();
-
- $email = htmlspecialchars($row["email"]);
- $full_name = htmlspecialchars($row["full_name"]);
- $otp_enabled = sql_bool_to_bool($row["otp_enabled"]);
+ $user = ORM::for_table('ttrss_users')->find_one($_SESSION['uid']);
?>
<form dojoType='dijit.form.Form'>
<?= \Controls\hidden_tag("op", "pref-prefs") ?>
- <?= \Controls\hidden_tag("method", "changeemail") ?>
+ <?= \Controls\hidden_tag("method", "changePersonalData") ?>
<script type="dojo/method" event="onSubmit" args="evt">
evt.preventDefault();
@@ -289,18 +290,19 @@ class Pref_Prefs extends Handler_Protected {
<fieldset>
<label><?= __('Full name:') ?></label>
- <input dojoType='dijit.form.ValidationTextBox' name='full_name' required='1' value="<?= $full_name ?>">
+ <input dojoType='dijit.form.ValidationTextBox' name='full_name' required='1' value="<?= htmlspecialchars($user->full_name) ?>">
</fieldset>
<fieldset>
<label><?= __('E-mail:') ?></label>
- <input dojoType='dijit.form.ValidationTextBox' name='email' required='1' value="<?= $email ?>">
+ <input dojoType='dijit.form.ValidationTextBox' name='email' required='1' value="<?= htmlspecialchars($user->email) ?>">
</fieldset>
<hr/>
<button dojoType='dijit.form.Button' type='submit' class='alt-primary'>
- <?= __("Save data") ?>
+ <?= \Controls\icon("save") ?>
+ <?= __("Save") ?>
</button>
</form>
<?php
@@ -313,7 +315,7 @@ class Pref_Prefs extends Handler_Protected {
$authenticator = false;
}
- $otp_enabled = $this->is_otp_enabled();
+ $otp_enabled = UserHelper::is_otp_enabled($_SESSION["uid"]);
if ($authenticator && method_exists($authenticator, "change_password")) {
?>
@@ -350,10 +352,6 @@ class Pref_Prefs extends Handler_Protected {
}
</script>
- <?php if ($otp_enabled) {
- print_notice(__("Changing your current password will disable OTP."));
- } ?>
-
<fieldset>
<label><?= __("Old password:") ?></label>
<input dojoType='dijit.form.ValidationTextBox' type='password' required='1' name='old_password'>
@@ -372,6 +370,7 @@ class Pref_Prefs extends Handler_Protected {
<hr/>
<button dojoType='dijit.form.Button' type='submit' class='alt-primary'>
+ <?= \Controls\icon("security") ?>
<?= __("Change password") ?>
</button>
</form>
@@ -385,7 +384,7 @@ class Pref_Prefs extends Handler_Protected {
}
private function index_auth_app_passwords() {
- print_notice("You can create separate passwords for API clients. Using one is required if you enable OTP.");
+ print_notice("Separate passwords used for API clients. Required if you enable OTP.");
?>
<div id='app_passwords_holder'>
@@ -395,31 +394,21 @@ class Pref_Prefs extends Handler_Protected {
<hr>
<button style='float : left' class='alt-primary' dojoType='dijit.form.Button' onclick="Helpers.AppPasswords.generate()">
- <?= __('Generate new password') ?>
+ <?= \Controls\icon("add") ?>
+ <?= __('Generate password') ?>
</button>
<button style='float : left' class='alt-danger' dojoType='dijit.form.Button'
onclick="Helpers.AppPasswords.removeSelected()">
- <?= __('Remove selected passwords') ?>
+ <?= \Controls\icon("delete") ?>
+ <?= __('Remove selected') ?>
</button>
<?php
}
- private function is_otp_enabled() {
- $sth = $this->pdo->prepare("SELECT otp_enabled FROM ttrss_users
- WHERE id = ?");
- $sth->execute([$_SESSION["uid"]]);
-
- if ($row = $sth->fetch()) {
- return sql_bool_to_bool($row["otp_enabled"]);
- }
-
- return false;
- }
-
private function index_auth_2fa() {
- $otp_enabled = $this->is_otp_enabled();
+ $otp_enabled = UserHelper::is_otp_enabled($_SESSION["uid"]);
if ($_SESSION["auth_module"] == "auth_internal") {
if ($otp_enabled) {
@@ -455,6 +444,7 @@ class Pref_Prefs extends Handler_Protected {
<hr/>
<button dojoType='dijit.form.Button' type='submit' class='alt-danger'>
+ <?= \Controls\icon("lock_open") ?>
<?= __("Disable OTP") ?>
</button>
@@ -464,19 +454,11 @@ class Pref_Prefs extends Handler_Protected {
} else {
- print_warning("You will need a compatible Authenticator to use this. Changing your password would automatically disable OTP.");
- print_notice("You will need to generate app passwords for the API clients if you enable OTP.");
+ print "<img src=".($this->_get_otp_qrcode_img()).">";
- if (function_exists("imagecreatefromstring")) {
- print "<h3>" . __("Scan the following code by the Authenticator application or copy the key manually") . "</h3>";
- $csrf_token_hash = sha1($_SESSION["csrf_token"]);
- print "<img alt='otp qr-code' src='backend.php?op=pref-prefs&method=otpqrcode&csrf_token_hash=$csrf_token_hash'>";
- } else {
- print_error("PHP GD functions are required to generate QR codes.");
- print "<h3>" . __("Use the following OTP key with a compatible Authenticator application") . "</h3>";
- }
+ print_notice("You will need to generate app passwords for API clients if you enable OTP.");
- $otp_secret = $this->otpsecret();
+ $otp_secret = UserHelper::get_otp_secret($_SESSION["uid"]);
?>
<form dojoType='dijit.form.Form'>
@@ -486,7 +468,7 @@ class Pref_Prefs extends Handler_Protected {
<fieldset>
<label><?= __("OTP Key:") ?></label>
- <input dojoType='dijit.form.ValidationTextBox' disabled='disabled' value="<?= $otp_secret ?>" size='32'>
+ <input dojoType='dijit.form.ValidationTextBox' disabled='disabled' value="<?= $otp_secret ?>" style='width : 215px'>
</fieldset>
<!-- TODO: return JSON from the backend call -->
@@ -519,6 +501,7 @@ class Pref_Prefs extends Handler_Protected {
<hr/>
<button dojoType='dijit.form.Button' type='submit' class='alt-primary'>
+ <?= \Controls\icon("lock") ?>
<?= __("Enable OTP") ?>
</button>
@@ -635,30 +618,27 @@ class Pref_Prefs extends Handler_Protected {
} else if ($pref_name == "USER_CSS_THEME") {
- $themes = array_merge(glob("themes/*.php"), glob("themes/*.css"), glob("themes.local/*.css"));
- $themes = array_map("basename", $themes);
- $themes = array_filter($themes, "theme_exists");
- asort($themes);
-
- if (!theme_exists($value)) $value = "";
+ $theme_files = array_map("basename",
+ array_merge(glob("themes/*.php"),
+ glob("themes/*.css"),
+ glob("themes.local/*.css")));
- print "<select name='$pref_name' id='$pref_name' dojoType='fox.form.Select'>";
+ asort($theme_files);
- $issel = $value == "" ? "selected='selected'" : "";
- print "<option $issel value=''>".__("default")."</option>";
+ $themes = [ "" => __("default") ];
- foreach ($themes as $theme) {
- $issel = $value == $theme ? "selected='selected'" : "";
- print "<option $issel value='$theme'>$theme</option>";
+ foreach ($theme_files as $file) {
+ $themes[$file] = basename($file, ".css");
}
+ ?>
- print "</select>";
+ <?= \Controls\select_hash($pref_name, $value, $themes) ?>
+ <?= \Controls\button_tag(\Controls\icon("palette") . " " . __("Customize"), "",
+ ["onclick" => "Helpers.Prefs.customizeCSS()"]) ?>
+ <?= \Controls\button_tag(\Controls\icon("open_in_new") . " " . __("More themes..."), "",
+ ["class" => "alt-info", "onclick" => "window.open(\"https://tt-rss.org/wiki/Themes\")"]) ?>
- print " <button dojoType=\"dijit.form.Button\" class='alt-info'
- onclick=\"Helpers.Prefs.customizeCSS()\">" . __('Customize') . "</button>";
-
- print " <button dojoType='dijit.form.Button' onclick='window.open(\"https://tt-rss.org/wiki/Themes\")'>
- <i class='material-icons'>open_in_new</i> ".__("More themes...")."</button>";
+ <?php
} else if ($pref_name == "DEFAULT_UPDATE_INTERVAL") {
@@ -685,6 +665,11 @@ class Pref_Prefs extends Handler_Protected {
print \Controls\checkbox_tag($pref_name, $is_checked, "true",
["disabled" => $is_disabled], "CB_$pref_name");
+ if ($pref_name == Prefs::DIGEST_ENABLE) {
+ print \Controls\button_tag(\Controls\icon("info") . " " . __('Preview'), '',
+ ['onclick' => 'Helpers.Digest.preview()', 'style' => 'margin-left : 10px']);
+ }
+
} else if (in_array($pref_name, ['FRESH_ARTICLE_MAX_AGE',
'PURGE_OLD_DAYS', 'LONG_DATE_FORMAT', 'SHORT_DATE_FORMAT'])) {
@@ -704,14 +689,14 @@ class Pref_Prefs extends Handler_Protected {
print \Controls\input_tag($pref_name, $value, "text", ["readonly" => true], "SSL_CERT_SERIAL");
- $cert_serial = htmlspecialchars(get_ssl_certificate_id());
+ $cert_serial = htmlspecialchars(self::_get_ssl_certificate_id());
$has_serial = ($cert_serial) ? true : false;
- print \Controls\button_tag(__('Register'), "", [
+ print \Controls\button_tag(\Controls\icon("security") . " " . __('Register'), "", [
"disabled" => !$has_serial,
"onclick" => "dijit.byId('SSL_CERT_SERIAL').attr('value', '$cert_serial')"]);
- print \Controls\button_tag(__('Clear'), "", [
+ print \Controls\button_tag(\Controls\icon("clear") . " " . __('Clear'), "", [
"class" => "alt-danger",
"onclick" => "dijit.byId('SSL_CERT_SERIAL').attr('value', '')"]);
@@ -719,11 +704,10 @@ class Pref_Prefs extends Handler_Protected {
"class" => "alt-info",
"onclick" => "window.open('https://tt-rss.org/wiki/SSL%20Certificate%20Authentication')"]);
- } else if ($pref_name == 'DIGEST_PREFERRED_TIME') {
+ } else if ($pref_name == Prefs::DIGEST_PREFERRED_TIME) {
print "<input dojoType=\"dijit.form.ValidationTextBox\"
id=\"$pref_name\" regexp=\"[012]?\d:\d\d\" placeHolder=\"12:00\"
name=\"$pref_name\" value=\"$value\">";
-
$item['help_text'] .= ". " . T_sprintf("Current server time: %s", date("H:i"));
} else {
$regexp = ($type_hint == Config::T_INT) ? 'regexp="^\d*$"' : '';
@@ -772,19 +756,21 @@ class Pref_Prefs extends Handler_Protected {
<div dojoType="dijit.layout.ContentPane" region="bottom">
<div dojoType="fox.form.ComboButton" type="submit" class="alt-primary">
- <span><?= __('Save configuration') ?></span>
+ <span> <?= __('Save configuration') ?></span>
<div dojoType="dijit.DropDownMenu">
<div dojoType="dijit.MenuItem" onclick="dijit.byId('changeSettingsForm').onSubmit(null, true)">
- <?= __("Save and exit preferences") ?>
+ <?= __("Save and exit") ?>
</div>
</div>
</div>
<button dojoType="dijit.form.Button" onclick="return Helpers.Profiles.edit()">
+ <?= \Controls\icon("settings") ?>
<?= __('Manage profiles') ?>
</button>
<button dojoType="dijit.form.Button" class="alt-danger" onclick="return Helpers.Prefs.confirmReset()">
+ <?= \Controls\icon("clear") ?>
<?= __('Reset to defaults') ?>
</button>
@@ -795,119 +781,73 @@ class Pref_Prefs extends Handler_Protected {
<?php
}
- private function index_plugins_system() {
- print_notice("System plugins are enabled in <strong>config.php</strong> for all users.");
-
- $system_enabled = array_map("trim", explode(",", (string)Config::get(Config::PLUGINS)));
-
- $tmppluginhost = new PluginHost();
- $tmppluginhost->load_all($tmppluginhost::KIND_ALL, $_SESSION["uid"], true);
-
- foreach ($tmppluginhost->get_plugins() as $name => $plugin) {
- $about = $plugin->about();
-
- if ($about[3] ?? false) {
- $is_checked = in_array($name, $system_enabled) ? "checked" : "";
- ?>
- <fieldset class='prefs plugin'>
- <label><?= $name ?>:</label>
- <label class='checkbox description text-muted' id="PLABEL-<?= htmlspecialchars($name) ?>">
- <input disabled='1' dojoType='dijit.form.CheckBox' <?= $is_checked ?> type='checkbox'><?= htmlspecialchars($about[1]) ?>
- </label>
-
- <?php if ($about[4] ?? false) { ?>
- <button dojoType='dijit.form.Button' class='alt-info'
- onclick='window.open("<?= htmlspecialchars($about[4]) ?>")'>
- <i class='material-icons'>open_in_new</i> <?= __("More info...") ?></button>
- <?php } ?>
-
- <div dojoType='dijit.Tooltip' connectId='PLABEL-<?= htmlspecialchars($name) ?>' position='after'>
- <?= htmlspecialchars(T_sprintf("v%.2f, by %s", $about[0], $about[2])) ?>
- </div>
- </fieldset>
- <?php
- }
- }
- }
-
- private function index_plugins_user() {
+ function getPluginsList() {
$system_enabled = array_map("trim", explode(",", (string)Config::get(Config::PLUGINS)));
$user_enabled = array_map("trim", explode(",", get_pref(Prefs::_ENABLED_PLUGINS)));
$tmppluginhost = new PluginHost();
$tmppluginhost->load_all($tmppluginhost::KIND_ALL, $_SESSION["uid"], true);
+ $rv = [];
+
foreach ($tmppluginhost->get_plugins() as $name => $plugin) {
$about = $plugin->about();
+ $is_local = $tmppluginhost->is_local($plugin);
+ $version = htmlspecialchars($this->_get_plugin_version($plugin));
+
+ array_push($rv, [
+ "name" => $name,
+ "is_local" => $is_local,
+ "system_enabled" => in_array($name, $system_enabled),
+ "user_enabled" => in_array($name, $user_enabled),
+ "has_data" => count($tmppluginhost->get_all($plugin)) > 0,
+ "is_system" => (bool)($about[3] ?? false),
+ "version" => $version,
+ "author" => $about[2] ?? "",
+ "description" => $about[1] ?? "",
+ "more_info" => $about[4] ?? "",
+ ]);
+ }
- if (empty($about[3]) || $about[3] == false) {
-
- $is_checked = "";
- $is_disabled = "";
-
- if (in_array($name, $system_enabled)) {
- $is_checked = "checked='1'";
- $is_disabled = "disabled='1'";
- } else if (in_array($name, $user_enabled)) {
- $is_checked = "checked='1'";
- }
-
- ?>
-
- <fieldset class='prefs plugin'>
- <label><?= $name ?>:</label>
- <label class='checkbox description text-muted' id="PLABEL-<?= htmlspecialchars($name) ?>">
- <input name='plugins[]' value="<?= htmlspecialchars($name) ?>"
- dojoType='dijit.form.CheckBox' <?= $is_checked ?> <?= $is_disabled ?> type='checkbox'>
- <?= htmlspecialchars($about[1]) ?>
- </input>
- </label>
-
- <?php if (count($tmppluginhost->get_all($plugin)) > 0) {
- if (in_array($name, $system_enabled) || in_array($name, $user_enabled)) { ?>
- <button dojoType='dijit.form.Button'
- onclick='Helpers.Prefs.clearPluginData("<?= htmlspecialchars($name) ?>")'>
- <i class='material-icons'>clear</i> <?= __("Clear data") ?></button>
- <?php }
- } ?>
-
- <?php if ($about[4] ?? false) { ?>
- <button dojoType='dijit.form.Button' class='alt-info'
- onclick='window.open("<?= htmlspecialchars($about[4]) ?>")'>
- <i class='material-icons'>open_in_new</i> <?= __("More info...") ?></button>
- <?php } ?>
-
- <div dojoType='dijit.Tooltip' connectId="PLABEL-<?= htmlspecialchars($name) ?>" position='after'>
- <?= htmlspecialchars(T_sprintf("v%.2f, by %s", $about[0], $about[2])) ?>
- </div>
+ usort($rv, function($a, $b) { return strcmp($a["name"], $b["name"]); });
- </fieldset>
- <?php
- }
- }
+ print json_encode(['plugins' => $rv, 'is_admin' => $_SESSION['access_level'] >= 10]);
}
function index_plugins() {
?>
<form dojoType="dijit.form.Form" id="changePluginsForm">
- <script type="dojo/method" event="onSubmit" args="evt">
- evt.preventDefault();
- if (this.validate()) {
- xhr.post("backend.php", this.getValues(), () => {
- Notify.close();
- if (confirm(__('Selected plugins have been enabled. Reload?'))) {
- window.location.reload();
- }
- })
- }
- </script>
<?= \Controls\hidden_tag("op", "pref-prefs") ?>
<?= \Controls\hidden_tag("method", "setplugins") ?>
<div dojoType="dijit.layout.BorderContainer" gutters="false">
+ <div region="top" dojoType='fox.Toolbar'>
+ <div class='pull-right'>
+ <input name="search" type="search" onkeyup='Helpers.Plugins.search()' dojoType="dijit.form.TextBox">
+ <button dojoType='dijit.form.Button' onclick='Helpers.Plugins.search()'>
+ <?= __('Search') ?>
+ </button>
+ </div>
+
+ <div dojoType='fox.form.DropDownButton'>
+ <span><?= __('Select') ?></span>
+ <div dojoType='dijit.Menu' style='display: none'>
+ <div onclick="Lists.select('prefs-plugin-list', true)"
+ dojoType='dijit.MenuItem'><?= __('All') ?></div>
+ <div onclick="Lists.select('prefs-plugin-list', false)"
+ dojoType='dijit.MenuItem'><?= __('None') ?></div>
+ </div>
+ </div>
+ </div>
+
<div dojoType="dijit.layout.ContentPane" region="center" style="overflow-y : auto">
- <?php
+
+ <script type="dojo/method" event="onShow">
+ Helpers.Plugins.reload();
+ </script>
+
+ <!-- <?php
if (!empty($_SESSION["safe_mode"])) {
print_error("You have logged in using safe mode, no user plugins will be actually enabled until you login again.");
}
@@ -929,24 +869,41 @@ class Pref_Prefs extends Handler_Protected {
) . " (<a href='https://tt-rss.org/wiki/FeedHandlerPlugins' target='_blank'>".__("More info...")."</a>)"
);
}
- ?>
+ ?> -->
- <h2><?= __("System plugins") ?></h2>
-
- <?php $this->index_plugins_system() ?>
-
- <h2><?= __("User plugins") ?></h2>
-
- <?php $this->index_plugins_user() ?>
+ <ul id="prefs-plugin-list" class="prefs-plugin-list list-unstyled">
+ <li class='text-center'><?= __("Loading, please wait...") ?></li>
+ </ul>
</div>
<div dojoType="dijit.layout.ContentPane" region="bottom">
- <button dojoType='dijit.form.Button' style='float : left' class='alt-info' onclick='window.open("https://tt-rss.org/wiki/Plugins")'>
- <i class='material-icons'>help</i> <?= __("More info...") ?>
- </button>
- <button dojoType='dijit.form.Button' class='alt-primary' type='submit'>
- <?= __("Enable selected plugins") ?>
+
+ <button dojoType='dijit.form.Button' class="alt-info pull-right" onclick='window.open("https://tt-rss.org/wiki/Plugins")'>
+ <i class='material-icons'>help</i>
+ <?= __("More info") ?>
</button>
+
+ <?= \Controls\button_tag(\Controls\icon("check") . " " .__("Enable selected"), "", ["class" => "alt-primary",
+ "onclick" => "Helpers.Plugins.enableSelected()"]) ?>
+
+ <?= \Controls\button_tag(\Controls\icon("refresh"), "", ["title" => __("Reload"), "onclick" => "Helpers.Plugins.reload()"]) ?>
+
+ <?php if ($_SESSION["access_level"] >= 10) { ?>
+ <?php if (Config::get(Config::CHECK_FOR_UPDATES) && Config::get(Config::CHECK_FOR_PLUGIN_UPDATES)) { ?>
+
+ <button class='alt-warning' dojoType='dijit.form.Button' onclick="Helpers.Plugins.update()">
+ <?= \Controls\icon("update") ?>
+ <?= __("Check for updates") ?>
+ </button>
+ <?php } ?>
+
+ <?php if (Config::get(Config::ENABLE_PLUGIN_INSTALLER)) { ?>
+ <button dojoType='dijit.form.Button' onclick="Helpers.Plugins.install()">
+ <?= \Controls\icon("add") ?>
+ <?= __("Install plugin") ?>
+ </button>
+ <?php } ?>
+ <?php } ?>
</div>
</div>
</form>
@@ -970,120 +927,44 @@ class Pref_Prefs extends Handler_Protected {
<div dojoType='dijit.layout.AccordionPane' selected='true' title="<i class='material-icons'>settings</i> <?= __('Preferences') ?>">
<?php $this->index_prefs() ?>
</div>
- <div dojoType='dijit.layout.AccordionPane' title="<i class='material-icons'>extension</i> <?= __('Plugins') ?>">
- <script type='dojo/method' event='onSelected' args='evt'>
- if (this.domNode.querySelector('.loading'))
- window.setTimeout(() => {
- xhr.post("backend.php", {op: 'pref-prefs', method: 'index_plugins'}, (reply) => {
- this.attr('content', reply);
- });
- }, 200);
- </script>
- <span class='loading'><?= __("Loading, please wait...") ?></span>
+ <div dojoType='dijit.layout.AccordionPane' style='padding : 0' title="<i class='material-icons'>extension</i> <?= __('Plugins') ?>">
+ <?php $this->index_plugins() ?>
</div>
<?php PluginHost::getInstance()->run_hooks(PluginHost::HOOK_PREFS_TAB, "prefPrefs") ?>
</div>
<?php
}
- function toggleAdvanced() {
- $_SESSION["prefs_show_advanced"] = !$_SESSION["prefs_show_advanced"];
- }
-
- function otpsecret() {
- $sth = $this->pdo->prepare("SELECT salt, otp_enabled
- FROM ttrss_users
- WHERE id = ?");
- $sth->execute([$_SESSION['uid']]);
+ function _get_otp_qrcode_img() {
+ $secret = UserHelper::get_otp_secret($_SESSION["uid"]);
+ $login = UserHelper::get_login_by_id($_SESSION["uid"]);
- if ($row = $sth->fetch()) {
- $otp_enabled = sql_bool_to_bool($row["otp_enabled"]);
+ if ($secret && $login) {
+ $qrcode = new \chillerlan\QRCode\QRCode();
- if (!$otp_enabled) {
- $base32 = new \OTPHP\Base32();
- $secret = $base32->encode(mb_substr(sha1($row["salt"]), 0, 12), false);
+ $otpurl = "otpauth://totp/".urlencode($login)."?secret=$secret&issuer=".urlencode("Tiny Tiny RSS");
- return $secret;
- }
+ return $qrcode->render($otpurl);
}
return false;
}
- function otpqrcode() {
- $csrf_token_hash = clean($_REQUEST["csrf_token_hash"]);
-
- if (sha1($_SESSION["csrf_token"]) === $csrf_token_hash) {
- require_once "lib/phpqrcode/phpqrcode.php";
-
- $sth = $this->pdo->prepare("SELECT login
- FROM ttrss_users
- WHERE id = ?");
- $sth->execute([$_SESSION['uid']]);
-
- if ($row = $sth->fetch()) {
- $secret = $this->otpsecret();
- $login = $row['login'];
-
- if ($secret) {
- QRcode::png("otpauth://totp/".urlencode($login).
- "?secret=$secret&issuer=".urlencode("Tiny Tiny RSS"));
- }
- }
- } else {
- header("Content-Type: text/json");
- print Errors::to_json(Errors::E_UNAUTHORIZED);
- }
- }
-
function otpenable() {
-
$password = clean($_REQUEST["password"]);
- $otp = clean($_REQUEST["otp"]);
+ $otp_check = clean($_REQUEST["otp"]);
$authenticator = PluginHost::getInstance()->get_plugin($_SESSION["auth_module"]);
if ($authenticator->check_password($_SESSION["uid"], $password)) {
-
- $secret = $this->otpsecret();
-
- if ($secret) {
-
- $base32 = new \OTPHP\Base32();
-
- $topt = new \OTPHP\TOTP($secret);
-
- $otp_check = $topt->now();
-
- if ($otp == $otp_check) {
- $sth = $this->pdo->prepare("UPDATE ttrss_users
- SET otp_enabled = true WHERE id = ?");
-
- $sth->execute([$_SESSION['uid']]);
-
- print "OK";
- } else {
- print "ERROR:".__("Incorrect one time password");
- }
+ if (UserHelper::enable_otp($_SESSION["uid"], $otp_check)) {
+ print "OK";
+ } else {
+ print "ERROR:".__("Incorrect one time password");
}
-
} else {
print "ERROR:".__("Incorrect password");
}
-
- }
-
- static function isdefaultpassword() {
- $authenticator = PluginHost::getInstance()->get_plugin($_SESSION["auth_module"]);
-
- if ($authenticator &&
- method_exists($authenticator, "check_password") &&
- $authenticator->check_password($_SESSION["uid"], "password")) {
-
- return true;
- }
-
- return false;
}
function otpdisable() {
@@ -1116,9 +997,7 @@ class Pref_Prefs extends Handler_Protected {
"message" => $message]);
}
- $sth = $this->pdo->prepare("UPDATE ttrss_users SET otp_enabled = false WHERE
- id = ?");
- $sth->execute([$_SESSION['uid']]);
+ UserHelper::disable_otp($_SESSION["uid"]);
print "OK";
} else {
@@ -1128,12 +1007,306 @@ class Pref_Prefs extends Handler_Protected {
}
function setplugins() {
- if (is_array(clean($_REQUEST["plugins"])))
- $plugins = join(",", clean($_REQUEST["plugins"]));
- else
- $plugins = "";
+ $plugins = array_filter($_REQUEST["plugins"], 'clean') ?? [];
+
+ set_pref(Prefs::_ENABLED_PLUGINS, implode(",", $plugins));
+ }
+
+ function _get_plugin_version(Plugin $plugin) {
+ $about = $plugin->about();
+
+ if (!empty($about[0])) {
+ return T_sprintf("v%.2f, by %s", $about[0], $about[2]);
+ } else {
+ $ref = new ReflectionClass(get_class($plugin));
+
+ $plugin_dir = dirname($ref->getFileName());
+
+ if (basename($plugin_dir) == "plugins") {
+ return "";
+ }
+
+ if (is_dir("$plugin_dir/.git")) {
+ $ver = Config::get_version_from_git($plugin_dir);
+
+ return $ver["status"] == 0 ? T_sprintf("v%s, by %s", $ver["version"], $about[2]) : $ver["version"];
+ }
+ }
+ }
+
+ static function _get_updated_plugins() {
+ $root_dir = dirname(dirname(__DIR__)); # we're in classes/pref/
+ $plugin_dirs = array_filter(glob("$root_dir/plugins.local/*"), "is_dir");
+
+ $rv = [];
+
+ foreach ($plugin_dirs as $dir) {
+ if (is_dir("$dir/.git")) {
+ $plugin_name = basename($dir);
+
+ array_push($rv, ["plugin" => $plugin_name, "rv" => self::_plugin_needs_update($root_dir, $plugin_name)]);
+ }
+ }
+
+ $rv = array_values(array_filter($rv, function ($item) {
+ return $item["rv"]["need_update"];
+ }));
+
+ return $rv;
+ }
+
+ private static function _plugin_needs_update($root_dir, $plugin_name) {
+ $plugin_dir = "$root_dir/plugins.local/" . basename($plugin_name);
+ $rv = null;
+
+ if (is_dir($plugin_dir) && is_dir("$plugin_dir/.git")) {
+ $pipes = [];
+
+ $descriptorspec = [
+ //0 => ["pipe", "r"], // STDIN
+ 1 => ["pipe", "w"], // STDOUT
+ 2 => ["pipe", "w"], // STDERR
+ ];
+
+ $proc = proc_open("git fetch -q origin -a && git log HEAD..origin/master --oneline", $descriptorspec, $pipes, $plugin_dir);
+
+ if (is_resource($proc)) {
+ $rv = [
+ "stdout" => stream_get_contents($pipes[1]),
+ "stderr" => stream_get_contents($pipes[2]),
+ "git_status" => proc_close($proc),
+ ];
+ $rv["need_update"] = !empty($rv["stdout"]);
+ }
+ }
+
+ return $rv;
+ }
+
+
+ private function _update_plugin($root_dir, $plugin_name) {
+ $plugin_dir = "$root_dir/plugins.local/" . basename($plugin_name);
+ $rv = [];
+
+ if (is_dir($plugin_dir) && is_dir("$plugin_dir/.git")) {
+ $pipes = [];
+
+ $descriptorspec = [
+ //0 => ["pipe", "r"], // STDIN
+ 1 => ["pipe", "w"], // STDOUT
+ 2 => ["pipe", "w"], // STDERR
+ ];
+
+ $proc = proc_open("git fetch origin -a && git log HEAD..origin/master --oneline && git pull --ff-only origin master", $descriptorspec, $pipes, $plugin_dir);
+
+ if (is_resource($proc)) {
+ $rv["stdout"] = stream_get_contents($pipes[1]);
+ $rv["stderr"] = stream_get_contents($pipes[2]);
+ $rv["git_status"] = proc_close($proc);
+ }
+ }
+
+ return $rv;
+ }
+
+ // https://gist.github.com/mindplay-dk/a4aad91f5a4f1283a5e2#gistcomment-2036828
+ private function _recursive_rmdir(string $dir, bool $keep_root = false) {
+ // Handle bad arguments.
+ if (empty($dir) || !file_exists($dir)) {
+ return true; // No such file/dir$dir exists.
+ } elseif (is_file($dir) || is_link($dir)) {
+ return unlink($dir); // Delete file/link.
+ }
+
+ // Delete all children.
+ $files = new \RecursiveIteratorIterator(
+ new \RecursiveDirectoryIterator($dir, \RecursiveDirectoryIterator::SKIP_DOTS),
+ \RecursiveIteratorIterator::CHILD_FIRST
+ );
+
+ foreach ($files as $fileinfo) {
+ $action = $fileinfo->isDir() ? 'rmdir' : 'unlink';
+ if (!$action($fileinfo->getRealPath())) {
+ return false; // Abort due to the failure.
+ }
+ }
+
+ return $keep_root ? true : rmdir($dir);
+ }
+
+ // https://stackoverflow.com/questions/7153000/get-class-name-from-file
+ private function _get_class_name_from_file($file) {
+ $tokens = token_get_all(file_get_contents($file));
+
+ for ($i = 0; $i < count($tokens); $i++) {
+ if (isset($tokens[$i][0]) && $tokens[$i][0] == T_CLASS) {
+ for ($j = $i+1; $j < count($tokens); $j++) {
+ if (isset($tokens[$j][1]) && $tokens[$j][1] != " ") {
+ return $tokens[$j][1];
+ }
+ }
+ }
+ }
+ }
+
+ function uninstallPlugin() {
+ if ($_SESSION["access_level"] >= 10) {
+ $plugin_name = basename(clean($_REQUEST['plugin']));
+ $status = 0;
+
+ $plugin_dir = dirname(dirname(__DIR__)) . "/plugins.local/$plugin_name";
+
+ if (is_dir($plugin_dir)) {
+ $status = $this->_recursive_rmdir($plugin_dir);
+ }
+
+ print json_encode(['status' => $status]);
+ }
+ }
+
+ function installPlugin() {
+ if ($_SESSION["access_level"] >= 10 && Config::get(Config::ENABLE_PLUGIN_INSTALLER)) {
+ $plugin_name = basename(clean($_REQUEST['plugin']));
+ $all_plugins = $this->_get_available_plugins();
+ $plugin_dir = dirname(dirname(__DIR__)) . "/plugins.local";
+
+ $work_dir = "$plugin_dir/plugin-installer";
+
+ $rv = [ ];
+
+ if (is_dir($work_dir) || mkdir($work_dir)) {
+ foreach ($all_plugins as $plugin) {
+ if ($plugin['name'] == $plugin_name) {
+
+ $tmp_dir = tempnam($work_dir, $plugin_name);
+
+ if (file_exists($tmp_dir)) {
+ unlink($tmp_dir);
+
+ $pipes = [];
+
+ $descriptorspec = [
+ 1 => ["pipe", "w"], // STDOUT
+ 2 => ["pipe", "w"], // STDERR
+ ];
+
+ $proc = proc_open("git clone " . escapeshellarg($plugin['clone_url']) . " " . $tmp_dir,
+ $descriptorspec, $pipes, sys_get_temp_dir());
+
+ $status = 0;
+
+ if (is_resource($proc)) {
+ $rv["stdout"] = stream_get_contents($pipes[1]);
+ $rv["stderr"] = stream_get_contents($pipes[2]);
+ $status = proc_close($proc);
+ $rv["git_status"] = $status;
+
+ // yeah I know about mysterious RC = -1
+ if (file_exists("$tmp_dir/init.php")) {
+ $class_name = strtolower(basename($this->_get_class_name_from_file("$tmp_dir/init.php")));
+
+ if ($class_name) {
+ $dst_dir = "$plugin_dir/$class_name";
+
+ if (is_dir($dst_dir)) {
+ $rv['result'] = self::PI_RES_ALREADY_INSTALLED;
+ } else {
+ if (rename($tmp_dir, "$plugin_dir/$class_name")) {
+ $rv['result'] = self::PI_RES_SUCCESS;
+ }
+ }
+ } else {
+ $rv['result'] = self::PI_ERR_NO_CLASS;
+ }
+ } else {
+ $rv['result'] = self::PI_ERR_NO_INIT_PHP;
+ }
+
+ } else {
+ $rv['result'] = self::PI_ERR_EXEC_FAILED;
+ }
+ } else {
+ $rv['result'] = self::PI_ERR_NO_TEMPDIR;
+ }
+
+ // cleanup after failure
+ if ($tmp_dir && is_dir($tmp_dir)) {
+ $this->_recursive_rmdir($tmp_dir);
+ }
+
+ break;
+ }
+ }
+
+ if (empty($rv['result']))
+ $rv['result'] = self::PI_ERR_PLUGIN_NOT_FOUND;
+
+ } else {
+ $rv["result"] = self::PI_ERR_NO_WORKDIR;
+ }
+
+ print json_encode($rv);
+ }
+ }
+
+ private function _get_available_plugins() {
+ if ($_SESSION["access_level"] >= 10 && Config::get(Config::ENABLE_PLUGIN_INSTALLER)) {
+ return json_decode(UrlHelper::fetch(['url' => 'https://tt-rss.org/plugins.json']), true);
+ }
+ }
+ function getAvailablePlugins() {
+ if ($_SESSION["access_level"] >= 10) {
+ print json_encode($this->_get_available_plugins());
+ }
+ }
+
+ function checkForPluginUpdates() {
+ if ($_SESSION["access_level"] >= 10 && Config::get(Config::CHECK_FOR_UPDATES) && Config::get(Config::CHECK_FOR_PLUGIN_UPDATES)) {
+ $plugin_name = $_REQUEST["name"] ?? "";
+
+ $root_dir = dirname(dirname(__DIR__)); # we're in classes/pref/
- set_pref(Prefs::_ENABLED_PLUGINS, $plugins);
+ if (!empty($plugin_name)) {
+ $rv = [["plugin" => $plugin_name, "rv" => self::_plugin_needs_update($root_dir, $plugin_name)]];
+ } else {
+ $rv = self::_get_updated_plugins();
+ }
+
+ print json_encode($rv);
+ }
+ }
+
+ function updateLocalPlugins() {
+ if ($_SESSION["access_level"] >= 10) {
+ $plugins = explode(",", $_REQUEST["plugins"] ?? "");
+
+ # we're in classes/pref/
+ $root_dir = dirname(dirname(__DIR__));
+
+ $rv = [];
+
+ if (count($plugins) > 0) {
+ foreach ($plugins as $plugin_name) {
+ array_push($rv, ["plugin" => $plugin_name, "rv" => $this->_update_plugin($root_dir, $plugin_name)]);
+ }
+ // @phpstan-ignore-next-line
+ } else {
+ $plugin_dirs = array_filter(glob("$root_dir/plugins.local/*"), "is_dir");
+
+ foreach ($plugin_dirs as $dir) {
+ if (is_dir("$dir/.git")) {
+ $plugin_name = basename($dir);
+
+ $test = self::_plugin_needs_update($root_dir, $plugin_name);
+
+ if (!empty($test["o"]))
+ array_push($rv, ["plugin" => $plugin_name, "rv" => $this->_update_plugin($root_dir, $plugin_name)]);
+ }
+ }
+ }
+
+ print json_encode($rv);
+ }
}
function clearplugindata() {
@@ -1150,66 +1323,61 @@ class Pref_Prefs extends Handler_Protected {
}
function activateprofile() {
- $_SESSION["profile"] = (int) clean($_REQUEST["id"]);
+ $id = (int) $_REQUEST['id'] ?? 0;
+
+ $profile = ORM::for_table('ttrss_settings_profiles')
+ ->where('owner_uid', $_SESSION['uid'])
+ ->find_one($id);
- // default value
- if (!$_SESSION["profile"]) $_SESSION["profile"] = null;
+ if ($profile) {
+ $_SESSION["profile"] = $id;
+ } else {
+ $_SESSION["profile"] = null;
+ }
}
function remprofiles() {
- $ids = explode(",", clean($_REQUEST["ids"]));
+ $ids = $_REQUEST["ids"] ?? [];
- foreach ($ids as $id) {
- if ($_SESSION["profile"] != $id) {
- $sth = $this->pdo->prepare("DELETE FROM ttrss_settings_profiles WHERE id = ? AND
- owner_uid = ?");
- $sth->execute([$id, $_SESSION['uid']]);
- }
- }
+ ORM::for_table('ttrss_settings_profiles')
+ ->where('owner_uid', $_SESSION['uid'])
+ ->where_in('id', $ids)
+ ->where_not_equal('id', $_SESSION['profile'] ?? 0)
+ ->delete_many();
}
function addprofile() {
$title = clean($_REQUEST["title"]);
if ($title) {
- $this->pdo->beginTransaction();
-
- $sth = $this->pdo->prepare("SELECT id FROM ttrss_settings_profiles
- WHERE title = ? AND owner_uid = ?");
- $sth->execute([$title, $_SESSION['uid']]);
-
- if (!$sth->fetch()) {
+ $profile = ORM::for_table('ttrss_settings_profiles')
+ ->where('owner_uid', $_SESSION['uid'])
+ ->where('title', $title)
+ ->find_one();
- $sth = $this->pdo->prepare("INSERT INTO ttrss_settings_profiles (title, owner_uid)
- VALUES (?, ?)");
+ if (!$profile) {
+ $profile = ORM::for_table('ttrss_settings_profiles')->create();
- $sth->execute([$title, $_SESSION['uid']]);
-
- $sth = $this->pdo->prepare("SELECT id FROM ttrss_settings_profiles WHERE
- title = ? AND owner_uid = ?");
- $sth->execute([$title, $_SESSION['uid']]);
+ $profile->title = $title;
+ $profile->owner_uid = $_SESSION['uid'];
+ $profile->save();
}
-
- $this->pdo->commit();
}
}
function saveprofile() {
- $id = clean($_REQUEST["id"]);
- $title = clean($_REQUEST["title"]);
+ $id = (int)$_REQUEST["id"];
+ $title = clean($_REQUEST["value"]);
- if ($id == 0) {
- print __("Default profile");
- return;
- }
-
- if ($title) {
- $sth = $this->pdo->prepare("UPDATE ttrss_settings_profiles
- SET title = ? WHERE id = ? AND
- owner_uid = ?");
+ if ($title && $id) {
+ $profile = ORM::for_table('ttrss_settings_profiles')
+ ->where('owner_uid', $_SESSION['uid'])
+ ->find_one($id);
- $sth->execute([$title, $id, $_SESSION['uid']]);
- print $title;
+ if ($profile) {
+ $profile->title = $title;
+ $profile->save();
+ }
}
}
@@ -1217,18 +1385,19 @@ class Pref_Prefs extends Handler_Protected {
function getProfiles() {
$rv = [];
- $sth = $this->pdo->prepare("SELECT title,id FROM ttrss_settings_profiles
- WHERE owner_uid = ? ORDER BY title");
- $sth->execute([$_SESSION['uid']]);
+ $profiles = ORM::for_table('ttrss_settings_profiles')
+ ->where('owner_uid', $_SESSION['uid'])
+ ->order_by_expr('title')
+ ->find_many();
array_push($rv, ["title" => __("Default profile"),
"id" => 0,
"active" => empty($_SESSION["profile"])
]);
- while ($row = $sth->fetch(PDO::FETCH_ASSOC)) {
- $row["active"] = isset($_SESSION["profile"]) && $_SESSION["profile"] == $row["id"];
- array_push($rv, $row);
+ foreach ($profiles as $profile) {
+ $profile['active'] = ($_SESSION["profile"] ?? 0) == $profile->id;
+ array_push($rv, $profile->as_array());
};
print json_encode($rv);
@@ -1271,23 +1440,25 @@ class Pref_Prefs extends Handler_Protected {
<th align='right'><?= __("Last used") ?></th>
</tr>
<?php
- $sth = $this->pdo->prepare("SELECT id, title, created, last_used
- FROM ttrss_app_passwords WHERE owner_uid = ?");
- $sth->execute([$_SESSION['uid']]);
- while ($row = $sth->fetch()) { ?>
- <tr data-row-id='<?= $row['id'] ?>'>
+ $passwords = ORM::for_table('ttrss_app_passwords')
+ ->where('owner_uid', $_SESSION['uid'])
+ ->order_by_asc('title')
+ ->find_many();
+
+ foreach ($passwords as $pass) { ?>
+ <tr data-row-id='<?= $pass['id'] ?>'>
<td align='center'>
<input onclick='Tables.onRowChecked(this)' dojoType='dijit.form.CheckBox' type='checkbox'>
</td>
<td>
- <?= htmlspecialchars($row["title"]) ?>
+ <?= htmlspecialchars($pass["title"]) ?>
</td>
<td align='right' class='text-muted'>
- <?= TimeHelper::make_local_datetime($row['created'], false) ?>
+ <?= TimeHelper::make_local_datetime($pass['created'], false) ?>
</td>
<td align='right' class='text-muted'>
- <?= TimeHelper::make_local_datetime($row['last_used'], false) ?>
+ <?= TimeHelper::make_local_datetime($pass['last_used'], false) ?>
</td>
</tr>
<?php } ?>
@@ -1296,18 +1467,11 @@ class Pref_Prefs extends Handler_Protected {
<?php
}
- private function _encrypt_app_password($password) {
- $salt = substr(bin2hex(get_random_bytes(24)), 0, 24);
-
- return "SSHA-512:".hash('sha512', $salt . $password). ":$salt";
- }
-
- function deleteAppPassword() {
- $ids = explode(",", clean($_REQUEST['ids']));
- $ids_qmarks = arr_qmarks($ids);
-
- $sth = $this->pdo->prepare("DELETE FROM ttrss_app_passwords WHERE id IN ($ids_qmarks) AND owner_uid = ?");
- $sth->execute(array_merge($ids, [$_SESSION['uid']]));
+ function deleteAppPasswords() {
+ $passwords = ORM::for_table('ttrss_app_passwords')
+ ->where('owner_uid', $_SESSION['uid'])
+ ->where_in('id', $_REQUEST['ids'] ?? [])
+ ->delete_many();
$this->appPasswordList();
}
@@ -1315,17 +1479,41 @@ class Pref_Prefs extends Handler_Protected {
function generateAppPassword() {
$title = clean($_REQUEST['title']);
$new_password = make_password(16);
- $new_password_hash = $this->_encrypt_app_password($new_password);
+ $new_salt = UserHelper::get_salt();
+ $new_password_hash = UserHelper::hash_password($new_password, $new_salt, UserHelper::HASH_ALGOS[0]);
print_warning(T_sprintf("Generated password <strong>%s</strong> for %s. Please remember it for future reference.", $new_password, $title));
- $sth = $this->pdo->prepare("INSERT INTO ttrss_app_passwords
- (title, pwd_hash, service, created, owner_uid)
- VALUES
- (?, ?, ?, NOW(), ?)");
+ $password = ORM::for_table('ttrss_app_passwords')->create();
- $sth->execute([$title, $new_password_hash, Auth_Base::AUTH_SERVICE_API, $_SESSION['uid']]);
+ $password->title = $title;
+ $password->owner_uid = $_SESSION['uid'];
+ $password->pwd_hash = "$new_password_hash:$new_salt";
+ $password->service = Auth_Base::AUTH_SERVICE_API;
+ $password->created = Db::NOW();
+
+ $password->save();
$this->appPasswordList();
}
+
+ function previewDigest() {
+ print json_encode(Digest::prepare_headlines_digest($_SESSION["uid"], 1, 16));
+ }
+
+ static function _get_ssl_certificate_id() {
+ if ($_SERVER["REDIRECT_SSL_CLIENT_M_SERIAL"] ?? false) {
+ return sha1($_SERVER["REDIRECT_SSL_CLIENT_M_SERIAL"] .
+ $_SERVER["REDIRECT_SSL_CLIENT_V_START"] .
+ $_SERVER["REDIRECT_SSL_CLIENT_V_END"] .
+ $_SERVER["REDIRECT_SSL_CLIENT_S_DN"]);
+ }
+ if ($_SERVER["SSL_CLIENT_M_SERIAL"] ?? false) {
+ return sha1($_SERVER["SSL_CLIENT_M_SERIAL"] .
+ $_SERVER["SSL_CLIENT_V_START"] .
+ $_SERVER["SSL_CLIENT_V_END"] .
+ $_SERVER["SSL_CLIENT_S_DN"]);
+ }
+ return "";
+ }
}
diff --git a/classes/pref/system.php b/classes/pref/system.php
index 85635e753..c79b5095d 100644
--- a/classes/pref/system.php
+++ b/classes/pref/system.php
@@ -14,6 +14,20 @@ class Pref_System extends Handler_Administrative {
$this->pdo->query("DELETE FROM ttrss_error_log");
}
+ function sendTestEmail() {
+ $mail_address = clean($_REQUEST["mail_address"]);
+
+ $mailer = new Mailer();
+
+ $rc = $mailer->mail(["to_name" => "",
+ "to_address" => $mail_address,
+ "subject" => __("Test message from tt-rss"),
+ "message" => ("This message confirms that tt-rss can send outgoing mail.")
+ ]);
+
+ print json_encode(['rc' => $rc, 'error' => $mailer->error()]);
+ }
+
function getphpinfo() {
ob_start();
phpinfo();
@@ -103,12 +117,12 @@ class Pref_System extends Handler_Administrative {
<table width='100%' class='event-log'>
- <tr class='title'>
- <td width='5%'><?= __("Error") ?></td>
- <td><?= __("Filename") ?></td>
- <td><?= __("Message") ?></td>
- <td width='5%'><?= __("User") ?></td>
- <td width='5%'><?= __("Date") ?></td>
+ <tr>
+ <th width='5%'><?= __("Error") ?></th>
+ <th><?= __("Filename") ?></th>
+ <th><?= __("Message") ?></th>
+ <th width='5%'><?= __("User") ?></th>
+ <th width='5%'><?= __("Date") ?></th>
</tr>
<?php
@@ -151,16 +165,48 @@ class Pref_System extends Handler_Administrative {
$page = (int) ($_REQUEST["page"] ?? 0);
?>
<div dojoType='dijit.layout.AccordionContainer' region='center'>
- <div dojoType='dijit.layout.AccordionPane' style='padding : 0' title='<i class="material-icons">report</i> <?= __('Event Log') ?>'>
- <?php
- if (Config::get(Config::LOG_DESTINATION) == "sql") {
+ <?php if (Config::get(Config::LOG_DESTINATION) == Logger::LOG_DEST_SQL) { ?>
+ <div dojoType='dijit.layout.AccordionPane' style='padding : 0' title='<i class="material-icons">report</i> <?= __('Event log') ?>'>
+ <?php
$this->_log_viewer($page, $severity);
- } else {
- print_notice("Please set Config::get(Config::LOG_DESTINATION) to 'sql' in config.php to enable database logging.");
- }
- ?>
+ ?>
+ </div>
+ <?php } ?>
+ <div dojoType='dijit.layout.AccordionPane' style='padding : 0' title='<i class="material-icons">mail</i> <?= __('Mail configuration') ?>'>
+ <div dojoType="dijit.layout.ContentPane">
+
+ <form dojoType="dijit.form.Form">
+ <script type="dojo/method" event="onSubmit" args="evt">
+ evt.preventDefault();
+ if (this.validate()) {
+ xhr.json("backend.php", this.getValues(), (reply) => {
+ const msg = App.byId("mail-test-result");
+
+ if (reply.rc) {
+ msg.innerHTML = __("Mail sent.");
+ msg.className = 'alert alert-success';
+ } else {
+ msg.innerHTML = reply.error;
+ msg.className = 'alert alert-danger';
+ }
+
+ msg.show();
+ })
+ }
+ </script>
+
+ <?= \Controls\hidden_tag("op", "pref-system") ?>
+ <?= \Controls\hidden_tag("method", "sendTestEmail") ?>
+
+ <fieldset>
+ <label><?= __("To:") ?></label>
+ <?= \Controls\input_tag("mail_address", "", "text", ['required' => 1]) ?>
+ <?= \Controls\submit_tag(__("Send test email")) ?>
+ <span style="display: none; margin-left : 10px" class="alert alert-error" id="mail-test-result">...</span>
+ </fieldset>
+ </form>
+ </div>
</div>
-
<div dojoType='dijit.layout.AccordionPane' title='<i class="material-icons">info</i> <?= __('PHP Information') ?>'>
<script type='dojo/method' event='onSelected' args='evt'>
if (this.domNode.querySelector('.loading'))
diff --git a/classes/pref/users.php b/classes/pref/users.php
index 13f808cb3..2e3dc4b67 100644
--- a/classes/pref/users.php
+++ b/classes/pref/users.php
@@ -1,24 +1,22 @@
<?php
class Pref_Users extends Handler_Administrative {
function csrf_ignore($method) {
- $csrf_ignored = array("index");
-
- return array_search($method, $csrf_ignored) !== false;
+ return $method == "index";
}
function edit() {
- global $access_level_names;
-
- $id = (int)clean($_REQUEST["id"]);
+ $user = ORM::for_table('ttrss_users')
+ ->select_expr("id,login,access_level,email,full_name,otp_enabled")
+ ->find_one((int)$_REQUEST["id"])
+ ->as_array();
- $sth = $this->pdo->prepare("SELECT id, login, access_level, email FROM ttrss_users WHERE id = ?");
- $sth->execute([$id]);
+ global $access_level_names;
- if ($row = $sth->fetch(PDO::FETCH_ASSOC)) {
+ if ($user) {
print json_encode([
- "user" => $row,
- "access_level_names" => $access_level_names
- ]);
+ "user" => $user,
+ "access_level_names" => $access_level_names
+ ]);
}
}
@@ -106,31 +104,32 @@ class Pref_Users extends Handler_Administrative {
}
function editSave() {
- $login = clean($_REQUEST["login"]);
- $uid = clean($_REQUEST["id"]);
- $access_level = (int) clean($_REQUEST["access_level"]);
- $email = clean($_REQUEST["email"]);
+ $id = (int)$_REQUEST['id'];
$password = clean($_REQUEST["password"]);
+ $user = ORM::for_table('ttrss_users')->find_one($id);
- // no blank usernames
- if (!$login) return;
+ if ($user) {
+ $login = clean($_REQUEST["login"]);
- // forbid renaming admin
- if ($uid == 1) $login = "admin";
+ if ($id == 1) $login = "admin";
+ if (!$login) return;
- if ($password) {
- $salt = substr(bin2hex(get_random_bytes(125)), 0, 250);
- $pwd_hash = encrypt_password($password, $salt, true);
- $pass_query_part = "pwd_hash = ".$this->pdo->quote($pwd_hash).",
- salt = ".$this->pdo->quote($salt).",";
- } else {
- $pass_query_part = "";
- }
+ $user->login = mb_strtolower($login);
+ $user->access_level = (int) clean($_REQUEST["access_level"]);
+ $user->email = clean($_REQUEST["email"]);
+ $user->otp_enabled = checkbox_to_sql_bool($_REQUEST["otp_enabled"]);
- $sth = $this->pdo->prepare("UPDATE ttrss_users SET $pass_query_part login = LOWER(?),
- access_level = ?, email = ?, otp_enabled = false WHERE id = ?");
- $sth->execute([$login, $access_level, $email, $uid]);
+ // force new OTP secret when next enabled
+ if (Config::get_schema_version() >= 143 && !$user->otp_enabled) {
+ $user->otp_secret = null;
+ }
+
+ $user->save();
+ }
+ if ($password) {
+ UserHelper::reset_password($id, false, $password);
+ }
}
function remove() {
@@ -152,24 +151,25 @@ class Pref_Users extends Handler_Administrative {
function add() {
$login = clean($_REQUEST["login"]);
- $tmp_user_pwd = make_password();
- $salt = substr(bin2hex(get_random_bytes(125)), 0, 250);
- $pwd_hash = encrypt_password($tmp_user_pwd, $salt, true);
if (!$login) return; // no blank usernames
if (!UserHelper::find_user_by_login($login)) {
- $sth = $this->pdo->prepare("INSERT INTO ttrss_users
- (login,pwd_hash,access_level,last_login,created, salt)
- VALUES (LOWER(?), ?, 0, null, NOW(), ?)");
- $sth->execute([$login, $pwd_hash, $salt]);
+ $new_password = make_password();
- if ($new_uid = UserHelper::find_user_by_login($login)) {
+ $user = ORM::for_table('ttrss_users')->create();
- print T_sprintf("Added user %s with password %s",
- $login, $tmp_user_pwd);
+ $user->salt = UserHelper::get_salt();
+ $user->login = mb_strtolower($login);
+ $user->pwd_hash = UserHelper::hash_password($new_password, $user->salt);
+ $user->access_level = 0;
+ $user->created = Db::NOW();
+ $user->save();
+ if ($new_uid = UserHelper::find_user_by_login($login)) {
+ print T_sprintf("Added user %s with password %s",
+ $login, $new_password);
} else {
print T_sprintf("Could not create user %s", $login);
}
@@ -200,11 +200,10 @@ class Pref_Users extends Handler_Administrative {
$sort = "login";
}
- $sort = $this->_validate_field($sort,
- ["login", "access_level", "created", "num_feeds", "created", "last_login"], "login");
+ if (!in_array($sort, ["login", "access_level", "created", "num_feeds", "created", "last_login"]))
+ $sort = "login";
if ($sort != "login") $sort = "$sort DESC";
-
?>
<div dojoType='dijit.layout.BorderContainer' gutters='false'>
@@ -249,42 +248,41 @@ class Pref_Users extends Handler_Administrative {
<table width='100%' class='users-list' id='users-list'>
- <tr class='title'>
- <td align='center' width='5%'> </td>
- <td width='20%'><a href='#' onclick="Users.reload('login')"><?= ('Login') ?></a></td>
- <td width='20%'><a href='#' onclick="Users.reload('access_level')"><?= ('Access Level') ?></a></td>
- <td width='10%'><a href='#' onclick="Users.reload('num_feeds')"><?= ('Subscribed feeds') ?></a></td>
- <td width='20%'><a href='#' onclick="Users.reload('created')"><?= ('Registered') ?></a></td>
- <td width='20%'><a href='#' onclick="Users.reload('last_login')"><?= ('Last login') ?></a></td>
+ <tr>
+ <th></th>
+ <th><a href='#' onclick="Users.reload('login')"><?= ('Login') ?></a></th>
+ <th><a href='#' onclick="Users.reload('access_level')"><?= ('Access Level') ?></a></th>
+ <th><a href='#' onclick="Users.reload('num_feeds')"><?= ('Subscribed feeds') ?></a></th>
+ <th><a href='#' onclick="Users.reload('created')"><?= ('Registered') ?></a></th>
+ <th><a href='#' onclick="Users.reload('last_login')"><?= ('Last login') ?></a></th>
</tr>
<?php
- $sth = $this->pdo->prepare("SELECT
- tu.id,
- login,access_level,email,
- ".SUBSTRING_FOR_DATE."(last_login,1,16) as last_login,
- ".SUBSTRING_FOR_DATE."(created,1,16) as created,
- (SELECT COUNT(id) FROM ttrss_feeds WHERE owner_uid = tu.id) AS num_feeds
- FROM
- ttrss_users tu
- WHERE
- (:search = '' OR login LIKE :search) AND tu.id > 0
- ORDER BY $sort");
- $sth->execute([":search" => $user_search ? "%$user_search%" : ""]);
-
- while ($row = $sth->fetch()) { ?>
-
- <tr data-row-id='<?= $row["id"] ?>' onclick='Users.edit(<?= $row["id"] ?>)' title="<?= __('Click to edit') ?>">
- <td align='center'>
+ $users = ORM::for_table('ttrss_users')
+ ->table_alias('u')
+ ->left_outer_join("ttrss_feeds", ["owner_uid", "=", "u.id"], 'f')
+ ->select_expr('u.*,COUNT(f.id) AS num_feeds')
+ ->where_like("login", $user_search ? "%$user_search%" : "%")
+ ->order_by_expr($sort)
+ ->group_by_expr('u.id')
+ ->find_many();
+
+ foreach ($users as $user) { ?>
+
+ <tr data-row-id='<?= $user["id"] ?>' onclick='Users.edit(<?= $user["id"] ?>)' title="<?= __('Click to edit') ?>">
+ <td class='checkbox'>
<input onclick='Tables.onRowChecked(this); event.stopPropagation();'
dojoType='dijit.form.CheckBox' type='checkbox'>
</td>
- <td><i class='material-icons'>person</i> <?= htmlspecialchars($row["login"]) ?></td>
- <td><?= $access_level_names[$row["access_level"]] ?></td>
- <td><?= $row["num_feeds"] ?></td>
- <td><?= TimeHelper::make_local_datetime($row["created"], false) ?></td>
- <td><?= TimeHelper::make_local_datetime($row["last_login"], false) ?></td>
+ <td width='30%'>
+ <i class='material-icons'>person</i>
+ <strong><?= htmlspecialchars($user["login"]) ?></strong>
+ </td>
+ <td><?= $access_level_names[$user["access_level"]] ?></td>
+ <td><?= $user["num_feeds"] ?></td>
+ <td class='text-muted'><?= TimeHelper::make_local_datetime($user["created"], false) ?></td>
+ <td class='text-muted'><?= TimeHelper::make_local_datetime($user["last_login"], false) ?></td>
</tr>
<?php } ?>
</table>
@@ -294,11 +292,4 @@ class Pref_Users extends Handler_Administrative {
<?php
}
- private function _validate_field($string, $allowed, $default = "") {
- if (in_array($string, $allowed))
- return $string;
- else
- return $default;
- }
-
}