From 3306daecf4450555961490c11e70e7cf7fe7b86e Mon Sep 17 00:00:00 2001
From: Andrew Dolgov <fox@fakecake.org>
Date: Thu, 11 Apr 2013 19:12:00 +0400
Subject: implement upload-related support for open_basedir

---
 install/index.php | 4 ----
 1 file changed, 4 deletions(-)

(limited to 'install/index.php')

diff --git a/install/index.php b/install/index.php
index 026e00d01..3b6a1f544 100644
--- a/install/index.php
+++ b/install/index.php
@@ -17,10 +17,6 @@
 			array_push($errors, "PHP version 5.3.0 or newer required.");
 		}
 
-		if (ini_get("open_basedir")) {
-			array_push($errors, "PHP configuration option open_basedir is not supported. Please disable this in PHP settings file (php.ini).");
-		}
-
 		if (!function_exists("curl_init") && !ini_get("allow_url_fopen")) {
 			array_push($errors, "PHP configuration option allow_url_fopen is disabled, and CURL functions are not present. Either enable allow_url_fopen or install PHP extension for CURL.");
 		}
-- 
cgit v1.2.3-54-g00ecf


From 044cff2d74ece46256201695346d1a0d1d66c746 Mon Sep 17 00:00:00 2001
From: Andrew Dolgov <fox@fakecake.org>
Date: Sat, 13 Apr 2013 18:24:27 +0400
Subject: implement basic feed authentication parameter encryption in the
 database (FEED_CRYPT_KEY)

---
 classes/pref/feeds.php    | 36 ++++++++++++++++++++++++++++++++----
 config.php-dist           |  7 +++++++
 include/crypt.php         | 36 ++++++++++++++++++++++++++++++++++++
 include/functions.php     | 12 ++++++++++--
 include/rssfuncs.php      |  9 ++++++++-
 include/sanity_check.php  |  8 ++++++++
 include/sanity_config.php |  4 ++--
 install/index.php         | 27 +++++++++++++++++++++++++++
 8 files changed, 130 insertions(+), 9 deletions(-)
 create mode 100644 include/crypt.php

(limited to 'install/index.php')

diff --git a/classes/pref/feeds.php b/classes/pref/feeds.php
index f57cc37d6..4a77ed8cf 100644
--- a/classes/pref/feeds.php
+++ b/classes/pref/feeds.php
@@ -528,6 +528,9 @@ class Pref_Feeds extends Handler_Protected {
 			"SELECT * FROM ttrss_feeds WHERE id = '$feed_id' AND
 				owner_uid = " . $_SESSION["uid"]);
 
+		$auth_pass_encrypted = sql_bool_to_bool(db_fetch_result($result, 0,
+			"auth_pass_encrypted"));
+
 		$title = htmlspecialchars(db_fetch_result($result,
 			0, "title"));
 
@@ -613,7 +616,14 @@ class Pref_Feeds extends Handler_Protected {
 			placeHolder=\"".__("Login")."\"
 			name=\"auth_login\" value=\"$auth_login\"><hr/>";
 
-		$auth_pass = htmlspecialchars(db_fetch_result($result, 0, "auth_pass"));
+		$auth_pass = db_fetch_result($result, 0, "auth_pass");
+
+		if ($auth_pass_encrypted) {
+			require_once "crypt.php";
+			$auth_pass = decrypt_string($auth_pass);
+		}
+
+		$auth_pass = htmlspecialchars($auth_pass);
 
 		print "<input dojoType=\"dijit.form.TextBox\" type=\"password\" name=\"auth_pass\"
 			placeHolder=\"".__("Password")."\"
@@ -936,6 +946,14 @@ class Pref_Feeds extends Handler_Protected {
 		$mark_unread_on_update = checkbox_to_sql_bool(
 			db_escape_string($this->link, $_POST["mark_unread_on_update"]));
 
+		if (strlen(FEED_CRYPT_KEY) > 0) {
+			require_once "crypt.php";
+			$auth_pass = substr(encrypt_string($auth_pass), 0, 250);
+			$auth_pass_encrypted = 'true';
+		} else {
+			$auth_pass_encrypted = 'false';
+		}
+
 		if (get_pref($this->link, 'ENABLE_FEED_CATS')) {
 			if ($cat_id && $cat_id != 0) {
 				$category_qpart = "cat_id = '$cat_id',";
@@ -958,6 +976,7 @@ class Pref_Feeds extends Handler_Protected {
 				purge_interval = '$purge_intl',
 				auth_login = '$auth_login',
 				auth_pass = '$auth_pass',
+				auth_pass_encrypted = $auth_pass_encrypted,
 				private = $private,
 				cache_images = $cache_images,
 				hide_images = $hide_images,
@@ -1003,7 +1022,8 @@ class Pref_Feeds extends Handler_Protected {
 						break;
 
 					case "auth_pass":
-						$qpart = "auth_pass = '$auth_pass'";
+						$qpart = "auth_pass = '$auth_pass' AND
+							auth_pass_encrypted = $auth_pass_encrypted";
 						break;
 
 					case "private":
@@ -1841,12 +1861,20 @@ class Pref_Feeds extends Handler_Protected {
 					"SELECT id FROM ttrss_feeds
 					WHERE feed_url = '$feed' AND owner_uid = ".$_SESSION["uid"]);
 
+				if (strlen(FEED_CRYPT_KEY) > 0) {
+					require_once "crypt.php";
+					$pass = substr(encrypt_string($pass), 0, 250);
+					$auth_pass_encrypted = 'true';
+				} else {
+					$auth_pass_encrypted = 'false';
+				}
+
 				if (db_num_rows($result) == 0) {
 					$result = db_query($this->link,
 						"INSERT INTO ttrss_feeds
-							(owner_uid,feed_url,title,cat_id,auth_login,auth_pass,update_method)
+							(owner_uid,feed_url,title,cat_id,auth_login,auth_pass,update_method,auth_pass_encrypted)
 						VALUES ('".$_SESSION["uid"]."', '$feed',
-							'[Unknown]', $cat_qpart, '$login', '$pass', 0)");
+							'[Unknown]', $cat_qpart, '$login', '$pass', 0, $auth_pass_encrypted)");
 				}
 
 				db_query($this->link, "COMMIT");
diff --git a/config.php-dist b/config.php-dist
index eb3339742..fc999354b 100644
--- a/config.php-dist
+++ b/config.php-dist
@@ -24,6 +24,13 @@
 	// You need to set this option correctly otherwise several features
 	// including PUSH, bookmarklets and browser integration will not work properly.
 
+	define('FEED_CRYPT_KEY', '');
+   // Key used for encryption of login/passwords for password-protected feeds
+   // in the database. A string of 24 random characters. If left blank, encryption
+	// is not used. Requires mcrypt functions.
+	// Warning: changing this key will make your stored feed passwords impossible
+	// to decrypt.
+	
 	define('SINGLE_USER_MODE', false);
 	// Operate in single user mode, disables all functionality related to
 	// multiple users and authentication. Enabling this assumes you have
diff --git a/include/crypt.php b/include/crypt.php
new file mode 100644
index 000000000..f06483ef1
--- /dev/null
+++ b/include/crypt.php
@@ -0,0 +1,36 @@
+<?php
+	function decrypt_string($str) {
+		$pair = explode(":", $str);
+
+		if (count($pair) == 2) {
+			@$iv = base64_decode($pair[0]);
+			@$encstr = base64_decode($pair[1]);
+
+			if ($iv && $encstr) {
+				$key = hash('SHA256', FEED_CRYPT_KEY, true);
+
+				$str = mcrypt_decrypt(MCRYPT_RIJNDAEL_128, $key, $encstr,
+					MCRYPT_MODE_CBC, $iv);
+
+				if ($str) return rtrim($str);
+			}
+		}
+
+		return false;
+	}
+
+	function encrypt_string($str) {
+		$key = hash('SHA256', FEED_CRYPT_KEY, true);
+
+		$iv = mcrypt_create_iv(mcrypt_get_iv_size(MCRYPT_RIJNDAEL_128,
+			MCRYPT_MODE_CBC), MCRYPT_RAND);
+
+		$encstr = mcrypt_encrypt(MCRYPT_RIJNDAEL_128, $key, $str,
+			MCRYPT_MODE_CBC, $iv);
+
+		$iv_base64 = base64_encode($iv);
+		$encstr_base64 = base64_encode($encstr);
+
+		return "$iv_base64:$encstr_base64";
+	}
+?>
diff --git a/include/functions.php b/include/functions.php
index f5685b89a..73ed97d08 100644
--- a/include/functions.php
+++ b/include/functions.php
@@ -1614,12 +1614,20 @@
 			"SELECT id FROM ttrss_feeds
 			WHERE feed_url = '$url' AND owner_uid = ".$_SESSION["uid"]);
 
+		if (strlen(FEED_CRYPT_KEY) > 0) {
+			require_once "crypt.php";
+			$auth_pass = substr(encrypt_string($auth_pass), 0, 250);
+			$auth_pass_encrypted = 'true';
+		} else {
+			$auth_pass_encrypted = 'false';
+		}
+
 		if (db_num_rows($result) == 0) {
 			$result = db_query($link,
 				"INSERT INTO ttrss_feeds
-					(owner_uid,feed_url,title,cat_id, auth_login,auth_pass,update_method)
+					(owner_uid,feed_url,title,cat_id, auth_login,auth_pass,update_method,auth_pass_encrypted)
 				VALUES ('".$_SESSION["uid"]."', '$url',
-				'[Unknown]', $cat_qpart, '$auth_login', '$auth_pass', 0)");
+				'[Unknown]', $cat_qpart, '$auth_login', '$auth_pass', 0, $auth_pass_encrypted)");
 
 			$result = db_query($link,
 				"SELECT id FROM ttrss_feeds WHERE feed_url = '$url'
diff --git a/include/rssfuncs.php b/include/rssfuncs.php
index 6e3ef4cf1..859c575cc 100644
--- a/include/rssfuncs.php
+++ b/include/rssfuncs.php
@@ -203,7 +203,7 @@
 		$result = db_query($link, "SELECT id,update_interval,auth_login,
 			feed_url,auth_pass,cache_images,last_updated,
 			mark_unread_on_update, owner_uid,
-			pubsub_state
+			pubsub_state, auth_pass_encrypted
 			FROM ttrss_feeds WHERE id = '$feed'");
 
 		if (db_num_rows($result) == 0) {
@@ -218,6 +218,8 @@
 		$mark_unread_on_update = sql_bool_to_bool(db_fetch_result($result,
 			0, "mark_unread_on_update"));
 		$pubsub_state = db_fetch_result($result, 0, "pubsub_state");
+		$auth_pass_encrypted = sql_bool_to_bool(db_fetch_result($result,
+			0, "auth_pass_encrypted"));
 
 		db_query($link, "UPDATE ttrss_feeds SET last_update_started = NOW()
 			WHERE id = '$feed'");
@@ -225,6 +227,11 @@
 		$auth_login = db_fetch_result($result, 0, "auth_login");
 		$auth_pass = db_fetch_result($result, 0, "auth_pass");
 
+		if ($auth_pass_encrypted) {
+			require_once "crypt.php";
+			$auth_pass = decrypt_string($auth_pass);
+		}
+
 		$cache_images = sql_bool_to_bool(db_fetch_result($result, 0, "cache_images"));
 		$fetch_url = db_fetch_result($result, 0, "feed_url");
 
diff --git a/include/sanity_check.php b/include/sanity_check.php
index 69309290e..b4102d234 100644
--- a/include/sanity_check.php
+++ b/include/sanity_check.php
@@ -67,6 +67,14 @@
 				array_push($errors, "Javascript cache is not writable (chmod -R 777 ".CACHE_DIR."/js)");
 			}
 
+			if (strlen(FEED_CRYPT_KEY) != 24) {
+				array_push($errors, "FEED_CRYPT_KEY should be exactly 24 characters in length.");
+			}
+
+			if (strlen(FEED_CRYPT_KEY) != 0 && !function_exists("mcrypt_decrypt")) {
+				array_push($errors, "FEED_CRYPT_KEY requires mcrypt functions which are not found.");
+			}
+
 			if (GENERATED_CONFIG_CHECK != EXPECTED_CONFIG_VERSION) {
 				array_push($errors,
 					"Configuration option checker sanity_config.php is outdated, please recreate it using ./utils/regen_config_checks.sh");
diff --git a/include/sanity_config.php b/include/sanity_config.php
index cb1c1e8ca..0c829981e 100644
--- a/include/sanity_config.php
+++ b/include/sanity_config.php
@@ -1,3 +1,3 @@
-<?php # This file has been generated at:  Mon Apr 1 18:30:54 IDT 2013
+<?php # This file has been generated at:  Sat Apr 13 17:41:19 MSK 2013
 define('GENERATED_CONFIG_CHECK', 26);
-$requred_defines = array( 'DB_TYPE', 'DB_HOST', 'DB_USER', 'DB_NAME', 'DB_PASS', 'MYSQL_CHARSET', 'SELF_URL_PATH', 'SINGLE_USER_MODE', 'SIMPLE_UPDATE_MODE', 'PHP_EXECUTABLE', 'LOCK_DIRECTORY', 'CACHE_DIR', 'ICONS_DIR', 'ICONS_URL', 'AUTH_AUTO_CREATE', 'AUTH_AUTO_LOGIN', 'FORCE_ARTICLE_PURGE', 'PUBSUBHUBBUB_HUB', 'PUBSUBHUBBUB_ENABLED', 'SPHINX_ENABLED', 'SPHINX_INDEX', 'ENABLE_REGISTRATION', 'REG_NOTIFY_ADDRESS', 'REG_MAX_USERS', 'SESSION_COOKIE_LIFETIME', 'SESSION_CHECK_ADDRESS', 'SMTP_FROM_NAME', 'SMTP_FROM_ADDRESS', 'DIGEST_SUBJECT', 'SMTP_HOST', 'SMTP_PORT', 'SMTP_LOGIN', 'SMTP_PASSWORD', 'CHECK_FOR_NEW_VERSION', 'ENABLE_GZIP_OUTPUT', 'PLUGINS', 'CONFIG_VERSION'); ?>
+$requred_defines = array( 'DB_TYPE', 'DB_HOST', 'DB_USER', 'DB_NAME', 'DB_PASS', 'MYSQL_CHARSET', 'SELF_URL_PATH', 'FEED_CRYPT_KEY', 'SINGLE_USER_MODE', 'SIMPLE_UPDATE_MODE', 'PHP_EXECUTABLE', 'LOCK_DIRECTORY', 'CACHE_DIR', 'ICONS_DIR', 'ICONS_URL', 'AUTH_AUTO_CREATE', 'AUTH_AUTO_LOGIN', 'FORCE_ARTICLE_PURGE', 'PUBSUBHUBBUB_HUB', 'PUBSUBHUBBUB_ENABLED', 'SPHINX_ENABLED', 'SPHINX_INDEX', 'ENABLE_REGISTRATION', 'REG_NOTIFY_ADDRESS', 'REG_MAX_USERS', 'SESSION_COOKIE_LIFETIME', 'SESSION_CHECK_ADDRESS', 'SMTP_FROM_NAME', 'SMTP_FROM_ADDRESS', 'DIGEST_SUBJECT', 'SMTP_HOST', 'SMTP_PORT', 'SMTP_LOGIN', 'SMTP_PASSWORD', 'CHECK_FOR_NEW_VERSION', 'ENABLE_GZIP_OUTPUT', 'PLUGINS', 'CONFIG_VERSION'); ?>
diff --git a/install/index.php b/install/index.php
index 3b6a1f544..1aae5da83 100644
--- a/install/index.php
+++ b/install/index.php
@@ -10,6 +10,25 @@
 <body>
 
 <?php
+	function make_password($length = 8) {
+
+		$password = "";
+		$possible = "0123456789abcdfghjkmnpqrstvwxyzABCDFGHJKMNPQRSTVWXYZ*%+^";
+
+   	$i = 0;
+
+		while ($i < $length) {
+			$char = substr($possible, mt_rand(0, strlen($possible)-1), 1);
+
+			if (!strstr($password, $char)) {
+				$password .= $char;
+				$i++;
+			}
+		}
+		return $password;
+	}
+
+
 	function sanity_check($db_type) {
 		$errors = array();
 
@@ -108,6 +127,12 @@
 
 		$finished = false;
 
+		if (function_exists("mcrypt_decrypt")) {
+			$crypt_key = make_password(24);
+		} else {
+			$crypt_key = "";
+		}
+
 		foreach ($data as $line) {
 			if (preg_match("/define\('DB_TYPE'/", $line)) {
 				$rv .= "\tdefine('DB_TYPE', '$DB_TYPE');\n";
@@ -123,6 +148,8 @@
 				$rv .= "\tdefine('DB_PORT', '$DB_PORT');\n";
 			} else if (preg_match("/define\('SELF_URL_PATH'/", $line)) {
 				$rv .= "\tdefine('SELF_URL_PATH', '$SELF_URL_PATH');\n";
+			} else if (preg_match("/define\('FEED_CRYPT_KEY'/", $line)) {
+				$rv .= "\tdefine('FEED_CRYPT_KEY', '$crypt_key');\n";
 			} else if (!$finished) {
 				$rv .= "$line\n";
 			}
-- 
cgit v1.2.3-54-g00ecf


From ae35bb87ebcf08007a6086f136b98cba2448d34f Mon Sep 17 00:00:00 2001
From: Andrew Dolgov <fox@fakecake.org>
Date: Wed, 17 Apr 2013 18:56:13 +0400
Subject: support mysqli when available

---
 classes/db.php        |  8 ++++--
 classes/db/mysql.php  |  4 ++-
 classes/db/mysqli.php | 74 +++++++++++++++++++++++++++++++++++++++++++++++++++
 install/index.php     |  2 +-
 4 files changed, 84 insertions(+), 4 deletions(-)
 create mode 100644 classes/db/mysqli.php

(limited to 'install/index.php')

diff --git a/classes/db.php b/classes/db.php
index 6dc31a22e..c9d9ad5ea 100644
--- a/classes/db.php
+++ b/classes/db.php
@@ -7,7 +7,11 @@ class Db implements IDb {
 	private function __construct() {
 		switch (DB_TYPE) {
 		case "mysql":
-			$this->adapter = new Db_Mysql();
+			if (function_exists("mysqli_connect")) {
+				$this->adapter = new Db_Mysqli();
+			} else {
+				$this->adapter = new Db_Mysql();
+			}
 			break;
 		case "pgsql":
 			$this->adapter = new Db_Pgsql();
@@ -16,7 +20,7 @@ class Db implements IDb {
 			die("Unknown DB_TYPE: " . DB_TYPE);
 		}
 
-		$this->link = $this->adapter->connect(DB_HOST, DB_USER, DB_PASS, DB_NAME, DB_PORT);
+		$this->link = $this->adapter->connect(DB_HOST, DB_USER, DB_PASS, DB_NAME, defined('DB_PORT') ? DB_PORT : false);
 	}
 
 	private function __clone() {
diff --git a/classes/db/mysql.php b/classes/db/mysql.php
index fe5d05e2f..aab05aca2 100644
--- a/classes/db/mysql.php
+++ b/classes/db/mysql.php
@@ -20,6 +20,8 @@ class Db_Mysql implements IDb {
 	}
 
 	function escape_string($s, $strip_tags = true) {
+		if ($strip_tags) $s = strip_tags($s);
+
 		return mysql_real_escape_string($s, $this->link);
 	}
 
@@ -54,7 +56,7 @@ class Db_Mysql implements IDb {
 	}
 
 	function last_error() {
-		return mysql_affected_rows($this->link);
+		return mysql_error();
 	}
 
 	function init() {
diff --git a/classes/db/mysqli.php b/classes/db/mysqli.php
new file mode 100644
index 000000000..e82f66300
--- /dev/null
+++ b/classes/db/mysqli.php
@@ -0,0 +1,74 @@
+<?php
+class Db_Mysqli implements IDb {
+	private $link;
+
+	function connect($host, $user, $pass, $db, $port) {
+		$this->link = mysqli_connect($host, $user, $pass, $db, $port);
+
+		if ($this->link) {
+			$this->init();
+
+			return $this->link;
+		} else {
+			die("Unable to connect to database (as $user to $host, database $db): " . mysqli_error());
+		}
+	}
+
+	function escape_string($s, $strip_tags = true) {
+		if ($strip_tags) $s = strip_tags($s);
+
+		return mysqli_real_escape_string($this->link, $s);
+	}
+
+	function query($query, $die_on_error = true) {
+		$result = mysqli_query($this->link, $query);
+		if (!$result) {
+			user_error("Query $query failed: " . ($this->link ? mysqli_error($this->link) : "No connection"),
+				$die_on_error ? E_USER_ERROR : E_USER_WARNING);
+		}
+
+		return $result;
+	}
+
+	function fetch_assoc($result) {
+		return mysqli_fetch_assoc($result);
+	}
+
+
+	function num_rows($result) {
+		return mysqli_num_rows($result);
+	}
+
+	function fetch_result($result, $row, $param) {
+		if (mysqli_data_seek($result, $row)) {
+			$line = mysqli_fetch_assoc($result);
+			return $line[$param];
+		} else {
+			return false;
+		}
+	}
+
+	function close() {
+		return mysqli_close($this->link);
+	}
+
+	function affected_rows($result) {
+		return mysqli_affected_rows($this->link);
+	}
+
+	function last_error() {
+		return mysqli_error();
+	}
+
+	function init() {
+		$this->query("SET time_zone = '+0:0'");
+
+		if (defined('MYSQL_CHARSET') && MYSQL_CHARSET) {
+			$this->query("SET NAMES " . MYSQL_CHARSET);
+		}
+
+		return true;
+	}
+
+}
+?>
diff --git a/install/index.php b/install/index.php
index 1aae5da83..99339aca2 100644
--- a/install/index.php
+++ b/install/index.php
@@ -44,7 +44,7 @@
 			array_push($errors, "PHP support for JSON is required, but was not found.");
 		}
 
-		if ($db_type == "mysql" && !function_exists("mysql_connect")) {
+		if ($db_type == "mysql" && !function_exists("mysql_connect") && !function_exists("mysqli_connect")) {
 			array_push($errors, "PHP support for MySQL is required for configured $db_type in config.php.");
 		}
 
-- 
cgit v1.2.3-54-g00ecf


From bbffc43e4f4c04e5efeb0edcc9851742c2223b1d Mon Sep 17 00:00:00 2001
From: Andrew Dolgov <fox@fakecake.org>
Date: Thu, 18 Apr 2013 16:06:03 +0400
Subject: actually check for DB_PORT in installer, add better hints and use
 mysqli if available

---
 config.php-dist   |  2 +-
 install/index.php | 36 ++++++++++++++++++++++++------------
 utility.css       |  5 +++++
 3 files changed, 30 insertions(+), 13 deletions(-)

(limited to 'install/index.php')

diff --git a/config.php-dist b/config.php-dist
index 4df299786..7cb9d9397 100644
--- a/config.php-dist
+++ b/config.php-dist
@@ -8,7 +8,7 @@
 	define('DB_USER', "fox");
 	define('DB_NAME', "fox");
 	define('DB_PASS', "XXXXXX");
-	//define('DB_PORT', '5432'); // when neeeded, PG-only
+	define('DB_PORT', ''); // usually 5432 for PostgreSQL, 3306 for MySQL
 
 	define('MYSQL_CHARSET', 'UTF8');
 	// Connection charset for MySQL. If you have a legacy database and/or experience
diff --git a/install/index.php b/install/index.php
index 99339aca2..9cbab20f1 100644
--- a/install/index.php
+++ b/install/index.php
@@ -88,7 +88,7 @@
 			<img src=\"../images/sign_info.svg\">$msg</div>";
 	}
 
-	function db_connect($host, $user, $pass, $db, $type) {
+	function db_connect($host, $user, $pass, $db, $type, $port) {
 		if ($type == "pgsql") {
 
 			$string = "dbname=$db user=$user";
@@ -101,8 +101,8 @@
 				$string .= " host=$host";
 			}
 
-			if (defined('DB_PORT')) {
-				$string = "$string port=" . DB_PORT;
+			if ($port) {
+				$string = "$string port=" . $port;
 			}
 
 			$link = pg_connect($string);
@@ -110,10 +110,15 @@
 			return $link;
 
 		} else if ($type == "mysql") {
-			$link = mysql_connect($host, $user, $pass);
-			if ($link) {
-				$result = mysql_select_db($db, $link);
-				if ($result) return $link;
+			if (function_exists("mysqli_connect")) {
+				return mysqli_connect($host, $user, $pass, $db, $port);
+
+			} else {
+				$link = mysql_connect($host, $user, $pass);
+				if ($link) {
+					$result = mysql_select_db($db, $link);
+					if ($result) return $link;
+				}
 			}
 		}
 	}
@@ -173,7 +178,12 @@
 			}
 			return $result;
 		} else if ($type == "mysql") {
-			$result = mysql_query($query, $link);
+
+			if (function_exists("mysqli_connect")) {
+				$result = mysqli_query($link, $query);
+			} else {
+				$result = mysql_query($query, $link);
+			}
 			if (!$result) {
 				$query = htmlspecialchars($query);
 				if ($die_on_error) {
@@ -254,17 +264,19 @@
 
 <fieldset>
 	<label>Database name</label>
-	<input name="DB_NAME" size="20" value="<?php echo $DB_NAME ?>"/>
+	<input required name="DB_NAME" size="20" value="<?php echo $DB_NAME ?>"/>
 </fieldset>
 
 <fieldset>
 	<label>Host name</label>
-	<input  name="DB_HOST" placeholder="if needed" size="20" value="<?php echo $DB_HOST ?>"/>
+	<input name="DB_HOST" size="20" value="<?php echo $DB_HOST ?>"/>
+	<span class="hint">If needed</span>
 </fieldset>
 
 <fieldset>
 	<label>Port</label>
-	<input name="DB_PORT" type="number" placeholder="if needed, PgSQL only" size="20" value="<?php echo $DB_PORT ?>"/>
+	<input name="DB_PORT" type="number" size="20" value="<?php echo $DB_PORT ?>"/>
+	<span class="hint">Usually 3306 for MySQL or 5432 for PostgreSQL</span>
 </fieldset>
 
 <h2>Other settings</h2>
@@ -327,7 +339,7 @@
 	<h2>Checking database</h2>
 
 	<?php
-		$link = db_connect($DB_HOST, $DB_USER, $DB_PASS, $DB_NAME, $DB_TYPE);
+		$link = db_connect($DB_HOST, $DB_USER, $DB_PASS, $DB_NAME, $DB_TYPE, $DB_PORT);
 
 		if (!$link) {
 			print_error("Unable to connect to database using specified parameters.");
diff --git a/utility.css b/utility.css
index 074589f9e..65dc20b1e 100644
--- a/utility.css
+++ b/utility.css
@@ -240,3 +240,8 @@ body.otp div.content {
 	display : inline-block;
 	width : auto;
 }
+
+span.hint {
+	font-size : 10px;
+	color : gray;
+}
-- 
cgit v1.2.3-54-g00ecf


From 3c200461f81250f7e112149bf9b55245943b42c1 Mon Sep 17 00:00:00 2001
From: Andrew Dolgov <fox@madoka.volgo-balt.ru>
Date: Thu, 18 Apr 2013 22:27:05 +0400
Subject: more notice css tweaks

---
 classes/handler/public.php | 2 +-
 include/functions.php      | 6 +++---
 install/index.php          | 5 +++--
 tt-rss.css                 | 5 +++++
 utility.css                | 4 ++++
 5 files changed, 16 insertions(+), 6 deletions(-)

(limited to 'install/index.php')

diff --git a/classes/handler/public.php b/classes/handler/public.php
index 79ed9d0ae..3b373edf5 100644
--- a/classes/handler/public.php
+++ b/classes/handler/public.php
@@ -929,7 +929,7 @@ class Handler_Public extends Handler {
 
 					} else {
 
-						print "<h2>" . "Tiny Tiny RSS database is up to date." . "</h2>";
+						print_notice("Tiny Tiny RSS database is up to date.");
 
 						print "<p><form method=\"GET\" action=\"index.php\">
 							<input type=\"submit\" value=\"".__("Return to Tiny Tiny RSS")."\">
diff --git a/include/functions.php b/include/functions.php
index e0c102b38..0908bf8d3 100644
--- a/include/functions.php
+++ b/include/functions.php
@@ -2925,19 +2925,19 @@
 	function format_warning($msg, $id = "") {
 		global $link;
 		return "<div class=\"warning\" id=\"$id\">
-			<img src=\"images/sign_excl.svg\">$msg</div>";
+			<span><img src=\"images/sign_excl.svg\"></span><span>$msg</span></div>";
 	}
 
 	function format_notice($msg, $id = "") {
 		global $link;
 		return "<div class=\"notice\" id=\"$id\">
-			<img src=\"images/sign_info.svg\">$msg</div>";
+			<span><img src=\"images/sign_info.svg\"></span><span>$msg</span></div>";
 	}
 
 	function format_error($msg, $id = "") {
 		global $link;
 		return "<div class=\"error\" id=\"$id\">
-			<img src=\"images/sign_excl.svg\">$msg</div>";
+			<span><img src=\"images/sign_excl.svg\"></span><span>$msg</span></div>";
 	}
 
 	function print_notice($msg) {
diff --git a/install/index.php b/install/index.php
index 9cbab20f1..416765e8f 100644
--- a/install/index.php
+++ b/install/index.php
@@ -80,12 +80,13 @@
 	}
 
 	function print_error($msg) {
-		print "<div class='error'><img src='../images/sign_excl.svg'> $msg</div>";
+		print "<div class='error'><span><img src='../images/sign_excl.svg'></span>
+			<span>$msg</span></div>";
 	}
 
 	function print_notice($msg) {
 		print "<div class=\"notice\">
-			<img src=\"../images/sign_info.svg\">$msg</div>";
+			<span><img src=\"../images/sign_info.svg\"></span><span>$msg</span></div>";
 	}
 
 	function db_connect($host, $user, $pass, $db, $type, $port) {
diff --git a/tt-rss.css b/tt-rss.css
index 8bf591326..454e2ffd1 100644
--- a/tt-rss.css
+++ b/tt-rss.css
@@ -288,7 +288,12 @@ div.error {
 div.warning img, div.notice img, div.error img {
 	margin-right : 4px;
 	vertical-align : middle;
+}
+
+div.warning span, div.notice span, div.error span {
 	display : table-cell;
+	vertical-align : middle;
+
 }
 
 ul.nomarks {
diff --git a/utility.css b/utility.css
index d4b6d0a02..50a54e154 100644
--- a/utility.css
+++ b/utility.css
@@ -73,6 +73,10 @@ div.error {
 
 div.warning img, div.notice img, div.error img {
 	margin-right : 4px;
+	vertical-align : middle;
+}
+
+div.warning span, div.notice span, div.error span {
 	display : table-cell;
 	vertical-align : middle;
 }
-- 
cgit v1.2.3-54-g00ecf


From 92c9a20cf51c55e9d866427786bc28b2d6ab48fd Mon Sep 17 00:00:00 2001
From: Andrew Dolgov <fox@fakecake.org>
Date: Fri, 19 Apr 2013 10:02:27 +0400
Subject: update installer mysqli_connect to only use port if defined

---
 install/index.php | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

(limited to 'install/index.php')

diff --git a/install/index.php b/install/index.php
index 416765e8f..cd017f995 100644
--- a/install/index.php
+++ b/install/index.php
@@ -112,7 +112,10 @@
 
 		} else if ($type == "mysql") {
 			if (function_exists("mysqli_connect")) {
-				return mysqli_connect($host, $user, $pass, $db, $port);
+				if ($port)
+					return mysqli_connect($host, $user, $pass, $db, $port);
+				else
+					return mysqli_connect($host, $user, $pass, $db);
 
 			} else {
 				$link = mysql_connect($host, $user, $pass);
-- 
cgit v1.2.3-54-g00ecf


From 6f7798b6434f5ef6073447998c436901b507e3df Mon Sep 17 00:00:00 2001
From: Rasmus Lerdorf <rasmus@php.net>
Date: Tue, 7 May 2013 00:35:10 -0700
Subject: Fixing bugs found by static analysis

---
 api/index.php                           |  2 +-
 classes/api.php                         | 77 ++++++++++++++++-----------------
 classes/article.php                     |  2 +-
 classes/auth/base.php                   |  2 +-
 classes/db/pdo.php                      |  2 +-
 classes/handler/public.php              | 17 +++++---
 classes/pluginhost.php                  |  4 +-
 classes/pref/filters.php                |  2 -
 classes/pref/prefs.php                  |  2 +-
 classes/rpc.php                         |  4 +-
 classes/ttrssmailer.php                 |  2 +-
 include/colors.php                      | 10 ++---
 include/functions.php                   |  9 ++--
 include/rssfuncs.php                    |  4 +-
 index.php                               | 10 ++---
 install/index.php                       |  2 +-
 lib/MiniTemplator.class.php             |  4 +-
 lib/phpqrcode/bindings/tcpdf/qrcode.php |  8 ++--
 lib/phpqrcode/phpqrcode.php             | 12 ++---
 lib/phpqrcode/qrencode.php              |  2 +-
 lib/phpqrcode/qrmask.php                |  4 +-
 lib/phpqrcode/qrsplit.php               |  8 ++--
 plugins/af_unburn/init.php              |  2 +-
 plugins/auth_internal/init.php          |  2 +-
 plugins/auth_remote/init.php            |  2 +-
 prefs.php                               | 10 ++---
 update.php                              |  2 +-
 27 files changed, 103 insertions(+), 104 deletions(-)

(limited to 'install/index.php')

diff --git a/api/index.php b/api/index.php
index 9f0d93f69..facdf82c5 100644
--- a/api/index.php
+++ b/api/index.php
@@ -57,7 +57,7 @@
 
 	$method = strtolower($_REQUEST["op"]);
 
-	$handler = new API(Db::get(), $_REQUEST);
+	$handler = new API($_REQUEST);
 
 	if ($handler->before($method)) {
 		if ($method && method_exists($handler, $method)) {
diff --git a/classes/api.php b/classes/api.php
index badd0b564..f5e4a0c5c 100644
--- a/classes/api.php
+++ b/classes/api.php
@@ -14,12 +14,12 @@ class API extends Handler {
 			header("Content-Type: text/json");
 
 			if (!$_SESSION["uid"] && $method != "login" && $method != "isloggedin") {
-				print $this->wrap(self::STATUS_ERR, array("error" => 'NOT_LOGGED_IN'));
+				$this->wrap(self::STATUS_ERR, array("error" => 'NOT_LOGGED_IN'));
 				return false;
 			}
 
 			if ($_SESSION["uid"] && $method != "logout" && !get_pref('ENABLE_API_ACCESS')) {
-				print $this->wrap(self::STATUS_ERR, array("error" => 'API_DISABLED'));
+				$this->wrap(self::STATUS_ERR, array("error" => 'API_DISABLED'));
 				return false;
 			}
 
@@ -38,12 +38,12 @@ class API extends Handler {
 
 	function getVersion() {
 		$rv = array("version" => VERSION);
-		print $this->wrap(self::STATUS_OK, $rv);
+		$this->wrap(self::STATUS_OK, $rv);
 	}
 
 	function getApiLevel() {
 		$rv = array("level" => self::API_LEVEL);
-		print $this->wrap(self::STATUS_OK, $rv);
+		$this->wrap(self::STATUS_OK, $rv);
 	}
 
 	function login() {
@@ -65,33 +65,33 @@ class API extends Handler {
 		}
 
 		if (!$uid) {
-			print $this->wrap(self::STATUS_ERR, array("error" => "LOGIN_ERROR"));
+			$this->wrap(self::STATUS_ERR, array("error" => "LOGIN_ERROR"));
 			return;
 		}
 
 		if (get_pref("ENABLE_API_ACCESS", $uid)) {
 			if (authenticate_user($login, $password)) {               // try login with normal password
-				print $this->wrap(self::STATUS_OK, array("session_id" => session_id(),
+				$this->wrap(self::STATUS_OK, array("session_id" => session_id(),
 					"api_level" => self::API_LEVEL));
 			} else if (authenticate_user($login, $password_base64)) { // else try with base64_decoded password
-				print $this->wrap(self::STATUS_OK,	array("session_id" => session_id(),
+				$this->wrap(self::STATUS_OK,	array("session_id" => session_id(),
 					"api_level" => self::API_LEVEL));
 			} else {                                                         // else we are not logged in
-				print $this->wrap(self::STATUS_ERR, array("error" => "LOGIN_ERROR"));
+				$this->wrap(self::STATUS_ERR, array("error" => "LOGIN_ERROR"));
 			}
 		} else {
-			print $this->wrap(self::STATUS_ERR, array("error" => "API_DISABLED"));
+			$this->wrap(self::STATUS_ERR, array("error" => "API_DISABLED"));
 		}
 
 	}
 
 	function logout() {
 		logout_user();
-		print $this->wrap(self::STATUS_OK, array("status" => "OK"));
+		$this->wrap(self::STATUS_OK, array("status" => "OK"));
 	}
 
 	function isLoggedIn() {
-		print $this->wrap(self::STATUS_OK, array("status" => $_SESSION["uid"] != ''));
+		$this->wrap(self::STATUS_OK, array("status" => $_SESSION["uid"] != ''));
 	}
 
 	function getUnread() {
@@ -99,15 +99,15 @@ class API extends Handler {
 		$is_cat = $this->dbh->escape_string($_REQUEST["is_cat"]);
 
 		if ($feed_id) {
-			print $this->wrap(self::STATUS_OK, array("unread" => getFeedUnread($feed_id, $is_cat)));
+			$this->wrap(self::STATUS_OK, array("unread" => getFeedUnread($feed_id, $is_cat)));
 		} else {
-			print $this->wrap(self::STATUS_OK, array("unread" => getGlobalUnread()));
+			$this->wrap(self::STATUS_OK, array("unread" => getGlobalUnread()));
 		}
 	}
 
 	/* Method added for ttrss-reader for Android */
 	function getCounters() {
-		print $this->wrap(self::STATUS_OK, getAllCounters());
+		$this->wrap(self::STATUS_OK, getAllCounters());
 	}
 
 	function getFeeds() {
@@ -119,7 +119,7 @@ class API extends Handler {
 
 		$feeds = $this->api_get_feeds($cat_id, $unread_only, $limit, $offset, $include_nested);
 
-		print $this->wrap(self::STATUS_OK, $feeds);
+		$this->wrap(self::STATUS_OK, $feeds);
 	}
 
 	function getCategories() {
@@ -176,7 +176,7 @@ class API extends Handler {
 			}
 		}
 
-		print $this->wrap(self::STATUS_OK, $cats);
+		$this->wrap(self::STATUS_OK, $cats);
 	}
 
 	function getHeadlines() {
@@ -219,9 +219,9 @@ class API extends Handler {
 				$include_attachments, $since_id, $search, $search_mode,
 				$include_nested, $sanitize_content);
 
-			print $this->wrap(self::STATUS_OK, $headlines);
+			$this->wrap(self::STATUS_OK, $headlines);
 		} else {
-			print $this->wrap(self::STATUS_ERR, array("error" => 'INCORRECT_USAGE'));
+			$this->wrap(self::STATUS_ERR, array("error" => 'INCORRECT_USAGE'));
 		}
 	}
 
@@ -293,11 +293,11 @@ class API extends Handler {
 				}
 			}
 
-			print $this->wrap(self::STATUS_OK, array("status" => "OK",
+			$this->wrap(self::STATUS_OK, array("status" => "OK",
 				"updated" => $num_updated));
 
 		} else {
-			print $this->wrap(self::STATUS_ERR, array("error" => 'INCORRECT_USAGE'));
+			$this->wrap(self::STATUS_ERR, array("error" => 'INCORRECT_USAGE'));
 		}
 
 	}
@@ -352,7 +352,7 @@ class API extends Handler {
 			}
 		}
 
-		print $this->wrap(self::STATUS_OK, $articles);
+		$this->wrap(self::STATUS_OK, $articles);
 
 	}
 
@@ -370,7 +370,7 @@ class API extends Handler {
 
 		$config["num_feeds"] = (int)$num_feeds;
 
-		print $this->wrap(self::STATUS_OK, $config);
+		$this->wrap(self::STATUS_OK, $config);
 	}
 
 	function updateFeed() {
@@ -380,7 +380,7 @@ class API extends Handler {
 
 		update_rss_feed($feed_id, true);
 
-		print $this->wrap(self::STATUS_OK, array("status" => "OK"));
+		$this->wrap(self::STATUS_OK, array("status" => "OK"));
 	}
 
 	function catchupFeed() {
@@ -389,13 +389,13 @@ class API extends Handler {
 
 		catchup_feed($feed_id, $is_cat);
 
-		print $this->wrap(self::STATUS_OK, array("status" => "OK"));
+		$this->wrap(self::STATUS_OK, array("status" => "OK"));
 	}
 
 	function getPref() {
 		$pref_name = $this->dbh->escape_string($_REQUEST["pref_name"]);
 
-		print $this->wrap(self::STATUS_OK, array("value" => get_pref($pref_name)));
+		$this->wrap(self::STATUS_OK, array("value" => get_pref($pref_name)));
 	}
 
 	function getLabels() {
@@ -432,7 +432,7 @@ class API extends Handler {
 				"checked" => $checked));
 		}
 
-		print $this->wrap(self::STATUS_OK, $rv);
+		$this->wrap(self::STATUS_OK, $rv);
 	}
 
 	function setArticleLabel() {
@@ -460,7 +460,7 @@ class API extends Handler {
 			}
 		}
 
-		print $this->wrap(self::STATUS_OK, array("status" => "OK",
+		$this->wrap(self::STATUS_OK, array("status" => "OK",
 			"updated" => $num_updated));
 
 	}
@@ -471,10 +471,10 @@ class API extends Handler {
 		if ($plugin && method_exists($plugin, $method)) {
 			$reply = $plugin->$method();
 
-			print $this->wrap($reply[0], $reply[1]);
+			$this->wrap($reply[0], $reply[1]);
 
 		} else {
-			print $this->wrap(self::STATUS_ERR, array("error" => 'UNKNOWN_METHOD', "method" => $method));
+			$this->wrap(self::STATUS_ERR, array("error" => 'UNKNOWN_METHOD', "method" => $method));
 		}
 	}
 
@@ -484,9 +484,9 @@ class API extends Handler {
 		$content = $this->dbh->escape_string(strip_tags($_REQUEST["content"]));
 
 		if (Article::create_published_article($title, $url, $content, "", $_SESSION["uid"])) {
-			print $this->wrap(self::STATUS_OK, array("status" => 'OK'));
+			$this->wrap(self::STATUS_OK, array("status" => 'OK'));
 		} else {
-			print $this->wrap(self::STATUS_ERR, array("error" => 'Publishing failed'));
+			$this->wrap(self::STATUS_ERR, array("error" => 'Publishing failed'));
 		}
 	}
 
@@ -714,9 +714,9 @@ class API extends Handler {
 
 		if ($this->dbh->num_rows($result) != 0) {
 			Pref_Feeds::remove_feed($feed_id, $_SESSION["uid"]);
-			print $this->wrap(self::STATUS_OK, array("status" => "OK"));
+			$this->wrap(self::STATUS_OK, array("status" => "OK"));
 		} else {
-			print $this->wrap(self::STATUS_ERR, array("error" => "FEED_NOT_FOUND"));
+			$this->wrap(self::STATUS_ERR, array("error" => "FEED_NOT_FOUND"));
 		}
 	}
 
@@ -727,12 +727,11 @@ class API extends Handler {
 		$password = $this->dbh->escape_string($_REQUEST["password"]);
 
 		if ($feed_url) {
-			$rc = subscribe_to_feed($feed_url, $category_id,
-				$login, $password, false);
+			$rc = subscribe_to_feed($feed_url, $category_id, $login, $password);
 
-			print $this->wrap(self::STATUS_OK, array("status" => $rc));
+			$this->wrap(self::STATUS_OK, array("status" => $rc));
 		} else {
-			print $this->wrap(self::STATUS_ERR, array("error" => 'INCORRECT_USAGE'));
+			$this->wrap(self::STATUS_ERR, array("error" => 'INCORRECT_USAGE'));
 		}
 	}
 
@@ -746,9 +745,9 @@ class API extends Handler {
 
 		if ($pf){
 			$data = $pf->makefeedtree();
-			print $this->wrap(self::STATUS_OK, array("categories" => $data));
+			$this->wrap(self::STATUS_OK, array("categories" => $data));
 		} else {
-			print $this->wrap(self::STATUS_ERR, array("error" =>
+			$this->wrap(self::STATUS_ERR, array("error" =>
 				'UNABLE_TO_INSTANTIATE_OBJECT'));
 		}
 
diff --git a/classes/article.php b/classes/article.php
index 1198eefa9..e9f86f298 100644
--- a/classes/article.php
+++ b/classes/article.php
@@ -215,7 +215,7 @@ class Article extends Handler_Protected {
 		$this->dbh->query("UPDATE ttrss_user_entries SET
 			score = '$score' WHERE ref_id IN ($ids) AND owner_uid = " . $_SESSION["uid"]);
 
-		print json_encode(array("id" => $id,
+		print json_encode(array("id" => $ids,
 			"score_pic" => get_score_pic($score)));
 	}
 
diff --git a/classes/auth/base.php b/classes/auth/base.php
index 83f99d109..c77df5157 100644
--- a/classes/auth/base.php
+++ b/classes/auth/base.php
@@ -16,7 +16,7 @@ class Auth_Base {
 
 	// Auto-creates specified user if allowed by system configuration
 	// Can be used instead of find_user_by_login() by external auth modules
-	function auto_create_user($login) {
+	function auto_create_user($login, $password) {
 		if ($login && defined('AUTH_AUTO_CREATE') && AUTH_AUTO_CREATE) {
 			$user_id = $this->find_user_by_login($login);
 
diff --git a/classes/db/pdo.php b/classes/db/pdo.php
index 59499139d..126f5150a 100644
--- a/classes/db/pdo.php
+++ b/classes/db/pdo.php
@@ -79,7 +79,7 @@ class Db_PDO implements IDb {
 	}
 
 	function last_error() {
-		return join(" ", $pdo->errorInfo());
+		return join(" ", $this->pdo->errorInfo());
 	}
 
 	function init() {
diff --git a/classes/handler/public.php b/classes/handler/public.php
index d5933a18c..7fa744107 100644
--- a/classes/handler/public.php
+++ b/classes/handler/public.php
@@ -382,9 +382,9 @@ class Handler_Public extends Handler {
 		header('Content-Type: text/html; charset=utf-8');
 		print "<html><head><title>Tiny Tiny RSS</title>";
 
-		print stylesheet_tag("utility.css");
-		print javascript_tag("lib/prototype.js");
-		print javascript_tag("lib/scriptaculous/scriptaculous.js?load=effects,dragdrop,controls");
+		stylesheet_tag("utility.css");
+		javascript_tag("lib/prototype.js");
+		javascript_tag("lib/scriptaculous/scriptaculous.js?load=effects,dragdrop,controls");
 		print "<meta http-equiv=\"Content-Type\" content=\"text/html; charset=utf-8\"/>
 			</head><body id='sharepopup'>";
 
@@ -643,6 +643,7 @@ class Handler_Public extends Handler {
 		$feed_url = $this->dbh->escape_string(trim($_REQUEST["feed_url"]));
 		$cat_id = $this->dbh->escape_string($_REQUEST["cat_id"]);
 		$from = $this->dbh->escape_string($_REQUEST["from"]);
+		$feed_urls = array();
 
 		/* only read authentication information from POST */
 
@@ -666,8 +667,10 @@ class Handler_Public extends Handler {
 			break;
 		case 4:
 			print_notice(__("Multiple feed URLs found."));
-
-			$feed_urls = get_feeds_from_html($feed_url);
+ 			$contents = @fetch_file_contents($url, false, $auth_login, $auth_pass);
+			if (is_html($contents)) {
+				$feed_urls = get_feeds_from_html($url, $contents);
+			}
 			break;
 		case 5:
 			print_error(T_sprintf("Could not subscribe to <b>%s</b>.<br>Can't download the Feed URL.", $feed_url));
@@ -732,8 +735,8 @@ class Handler_Public extends Handler {
 		header('Content-Type: text/html; charset=utf-8');
 		print "<html><head><title>Tiny Tiny RSS</title>";
 
-		print stylesheet_tag("utility.css");
-		print javascript_tag("lib/prototype.js");
+		stylesheet_tag("utility.css");
+		javascript_tag("lib/prototype.js");
 
 		print "<meta http-equiv=\"Content-Type\" content=\"text/html; charset=utf-8\"/>
 			</head><body id='forgotpass'>";
diff --git a/classes/pluginhost.php b/classes/pluginhost.php
index 8e2aefcf1..bc5dc96be 100644
--- a/classes/pluginhost.php
+++ b/classes/pluginhost.php
@@ -186,7 +186,7 @@ class PluginHost {
 		}
 	}
 
-	function del_handler($handler, $method) {
+	function del_handler($handler, $method, $sender) {
 		$handler = str_replace("-", "_", strtolower($handler));
 		$method = strtolower($method);
 
@@ -252,8 +252,6 @@ class PluginHost {
 
 	function load_data($force = false) {
 		if ($this->owner_uid)  {
-			$plugin = $this->dbh->escape_string($plugin);
-
 			$result = $this->dbh->query("SELECT name, content FROM ttrss_plugin_storage
 				WHERE owner_uid = '".$this->owner_uid."'");
 
diff --git a/classes/pref/filters.php b/classes/pref/filters.php
index 4dbee5906..bcc7b5aec 100644
--- a/classes/pref/filters.php
+++ b/classes/pref/filters.php
@@ -83,8 +83,6 @@ class Pref_Filters extends Handler_Protected {
 			}
 		}
 
-		$feed_title = getFeedTitle($feed);
-
 		$qfh_ret = queryFeedHeadlines(-4, 30, "", false, false, false,
 			"date_entered DESC", 0, $_SESSION["uid"], $filter);
 
diff --git a/classes/pref/prefs.php b/classes/pref/prefs.php
index ba83a9900..fb6795957 100644
--- a/classes/pref/prefs.php
+++ b/classes/pref/prefs.php
@@ -747,7 +747,7 @@ class Pref_Prefs extends Handler_Protected {
 		$system_enabled = array_map("trim", explode(",", PLUGINS));
 		$user_enabled = array_map("trim", explode(",", get_pref("_ENABLED_PLUGINS")));
 
-		$tmppluginhost = new PluginHost(Db::get());
+		$tmppluginhost = new PluginHost();
 		$tmppluginhost->load_all($tmppluginhost::KIND_ALL, $_SESSION["uid"]);
 		$tmppluginhost->load_data(true);
 
diff --git a/classes/rpc.php b/classes/rpc.php
index 2b07bbf91..46583feb5 100644
--- a/classes/rpc.php
+++ b/classes/rpc.php
@@ -291,7 +291,7 @@ class RPC extends Handler_Protected {
 
 		$reply = array();
 
-		if ($seq) $reply['seq'] = $seq;
+		if (!empty($_REQUEST['seq'])) $reply['seq'] = (int) $_REQUEST['seq'];
 
 		if ($last_article_id != getLastArticleId()) {
 			$reply['counters'] = getAllCounters();
@@ -464,7 +464,7 @@ class RPC extends Handler_Protected {
 			$id = 0;
 		}
 
-		print_feed_cat_select("cat_id", $id);
+		print_feed_cat_select("cat_id", $id, '');
 	}
 
 	// Silent
diff --git a/classes/ttrssmailer.php b/classes/ttrssmailer.php
index fd7f969aa..1e8d07723 100644
--- a/classes/ttrssmailer.php
+++ b/classes/ttrssmailer.php
@@ -28,7 +28,7 @@ class ttrssMailer extends PHPMailer {
 			$this->Host = $pair[0];
 			$this->Port = $pair[1];
 
-			if (!$Port) $Port = 25;
+			if (!$this->Port) $this->Port = 25;
 		} else {
 			$this->Host = '';
 			$this->Port = '';
diff --git a/include/colors.php b/include/colors.php
index 7cf1a6af0..41bf7b819 100644
--- a/include/colors.php
+++ b/include/colors.php
@@ -237,16 +237,16 @@ function rgb2hsl($arr) {
    } else {
       $s = $del_Max / $var_Max;
 
-      $del_R = ((($max - $var_R ) / 6 ) + ($del_Max / 2 ) ) / $del_Max;
-      $del_G = ((($max - $var_G ) / 6 ) + ($del_Max / 2 ) ) / $del_Max;
-      $del_B = ((($max - $var_B ) / 6 ) + ($del_Max / 2 ) ) / $del_Max;
+      $del_R = ((($var_Max - $var_R ) / 6 ) + ($del_Max / 2 ) ) / $del_Max;
+      $del_G = ((($var_Max - $var_G ) / 6 ) + ($del_Max / 2 ) ) / $del_Max;
+      $del_B = ((($var_Max - $var_B ) / 6 ) + ($del_Max / 2 ) ) / $del_Max;
 
       if      ($var_R == $var_Max) $h = $del_B - $del_G;
       else if ($var_G == $var_Max) $h = (1 / 3 ) + $del_R - $del_B;
       else if ($var_B == $var_Max) $h = (2 / 3 ) + $del_G - $del_R;
 
-      if ($H < 0) $h++;
-      if ($H > 1) $h--;
+      if ($h < 0) $h++;
+      if ($h > 1) $h--;
    }
 
    return array($h, $s, $v);
diff --git a/include/functions.php b/include/functions.php
index 15a875746..414196e9c 100644
--- a/include/functions.php
+++ b/include/functions.php
@@ -1162,7 +1162,7 @@
 
 		$data = array_merge($data, getVirtCounters());
 		$data = array_merge($data, getLabelCounters());
-		$data = array_merge($data, getFeedCounters($active_feed));
+		$data = array_merge($data, getFeedCounters());
 		$data = array_merge($data, getCategoryCounters());
 
 		return $data;
@@ -1286,7 +1286,7 @@
 
 			return $unread;
 		} else if ($cat == -1) {
-			return getFeedUnread(-1) + getFeedUnread($link, -2) + getFeedUnread($link, -3) + getFeedUnread($link, 0);
+			return getFeedUnread(-1) + getFeedUnread(-2) + getFeedUnread(-3) + getFeedUnread(0);
 		} else if ($cat == -2) {
 
 			$result = db_query("
@@ -1726,7 +1726,8 @@
 			}
 
 			if (!$root_id) {
-				$is_selected = ($default_id == "CAT:0") ? "selected=\"1\"" : "";
+				$default_is_cat = ($default_id == "CAT:0");
+				$is_selected = $default_is_cat ? "selected=\"1\"" : "";
 
 				printf("<option $is_selected value='CAT:0'>%s</option>",
 					__("Uncategorized"));
@@ -4099,7 +4100,7 @@
 				preg_match("/(Location:|URI:)[^(\n)]*/", $header, $matches);
 				$url = trim(str_replace($matches[1],"",$matches[0]));
 				$url_parsed = parse_url($url);
-				return (isset($url_parsed))? geturl($url, $referer):'';
+				return (isset($url_parsed))? geturl($url):'';
 			}
 			$oline='';
 			foreach($status as $key=>$eline){$oline.='['.$key.']'.$eline.' ';}
diff --git a/include/rssfuncs.php b/include/rssfuncs.php
index 61f6ee6a0..612c914c0 100644
--- a/include/rssfuncs.php
+++ b/include/rssfuncs.php
@@ -334,7 +334,7 @@
 		}
 
 		$pluginhost = new PluginHost();
-		$pluginhost->set_debug($debug_enabled, $debug_enabled);
+		$pluginhost->set_debug($debug_enabled);
 		$user_plugins = get_pref("_ENABLED_PLUGINS", $owner_uid);
 
 		$pluginhost->load(PLUGINS, PluginHost::KIND_ALL);
@@ -411,7 +411,7 @@
 
 				_debug("checking favicon...", $debug_enabled);
 
-				check_feed_favicon($site_url, $feed, $link);
+				check_feed_favicon($site_url, $feed);
 				$favicon_modified_new = @filemtime($favicon_file);
 
 				if ($favicon_modified_new > $favicon_modified)
diff --git a/index.php b/index.php
index 6a34be5e8..29b8b173d 100644
--- a/index.php
+++ b/index.php
@@ -56,14 +56,14 @@
 <head>
 	<title>Tiny Tiny RSS</title>
 
-	<?php echo stylesheet_tag("lib/dijit/themes/claro/claro.css"); ?>
-	<?php echo stylesheet_tag("tt-rss.css"); ?>
-	<?php echo stylesheet_tag("cdm.css"); ?>
+	<?php stylesheet_tag("lib/dijit/themes/claro/claro.css"); ?>
+	<?php stylesheet_tag("tt-rss.css"); ?>
+	<?php stylesheet_tag("cdm.css"); ?>
 
 	<?php if ($_SESSION["uid"]) {
 		$theme = get_pref( "USER_CSS_THEME", $_SESSION["uid"], false);
 		if ($theme) {
-			echo stylesheet_tag("themes/$theme");
+			stylesheet_tag("themes/$theme");
 		}
 	}
 	?>
@@ -91,7 +91,7 @@
 				"lib/dojo/tt-rss-layer.js",
 				"errors.php?mode=js") as $jsfile) {
 
-		echo javascript_tag($jsfile);
+		javascript_tag($jsfile);
 
 	} ?>
 
diff --git a/install/index.php b/install/index.php
index cd017f995..6cb2ace4f 100644
--- a/install/index.php
+++ b/install/index.php
@@ -89,7 +89,7 @@
 			<span><img src=\"../images/sign_info.svg\"></span><span>$msg</span></div>";
 	}
 
-	function db_connect($host, $user, $pass, $db, $type, $port) {
+	function db_connect($host, $user, $pass, $db, $type, $port = false) {
 		if ($type == "pgsql") {
 
 			$string = "dbname=$db user=$user";
diff --git a/lib/MiniTemplator.class.php b/lib/MiniTemplator.class.php
index 69281cb5e..a139473f9 100644
--- a/lib/MiniTemplator.class.php
+++ b/lib/MiniTemplator.class.php
@@ -336,7 +336,7 @@ function processBeginBlockCmd ($parms, $cmdTPosBegin, $cmdTPosEnd) {
    $this->openBlocksTab[$this->currentNestingLevel] = $blockNo;
    $this->currentNestingLevel += 1;
    if ($this->currentNestingLevel > $this->maxNestingLevel) {
-      $trhis->triggerError ("Block nesting overflow in template at offset $cmdTPosBegin.");
+      $this->triggerError ("Block nesting overflow in template at offset $cmdTPosBegin.");
       return false; }
    return true; }
 
@@ -844,7 +844,7 @@ function readFileIntoString ($fileName, &$s) {
    $fh = fopen($fileName,"rb");
    if ($fh === false) return false;
    $fileSize = filesize($fileName);
-   if ($fileSize === false) {close ($fh); return false; }
+   if ($fileSize === false) {fclose ($fh); return false; }
    $s = fread($fh,$fileSize);
    fclose ($fh);
    if (strlen($s) != $fileSize) return false;
diff --git a/lib/phpqrcode/bindings/tcpdf/qrcode.php b/lib/phpqrcode/bindings/tcpdf/qrcode.php
index 7995460b5..9001e3a2e 100644
--- a/lib/phpqrcode/bindings/tcpdf/qrcode.php
+++ b/lib/phpqrcode/bindings/tcpdf/qrcode.php
@@ -1101,7 +1101,7 @@ if (!class_exists('QRcode', false)) {
 		 protected function makeMaskNo($maskNo, $width, $s, &$d, $maskGenOnly=false) {
 			$b = 0;
 			$bitMask = array();
-			$bitMask = $this->generateMaskNo($maskNo, $width, $s, $d);
+			$bitMask = $this->generateMaskNo($maskNo, $width, $s);
 			if ($maskGenOnly) {
 				return;
 			}
@@ -1399,7 +1399,7 @@ if (!class_exists('QRcode', false)) {
 				$p += 2;
 			}
 			$this->items = $this->appendNewInputItem($this->items, QR_MODE_KJ, $p, str_split($this->dataStr));
-			return $run;
+			return $p;
 		}
 
 		/**
@@ -1470,7 +1470,7 @@ if (!class_exists('QRcode', false)) {
 						break;
 					}
 					case QR_MODE_KJ: {
-						if ($hint == QR_MODE_KJ) {
+						if ($this->hint == QR_MODE_KJ) {
 							$length = $this->eatKanji();
 						} else {
 							$length = $this->eat8();
@@ -1499,7 +1499,7 @@ if (!class_exists('QRcode', false)) {
 			$stringLen = strlen($this->dataStr);
 			$p = 0;
 			while ($p < $stringLen) {
-				$mode = $this->identifyMode(substr($this->dataStr, $p), $this->hint);
+				$mode = $this->identifyMode(substr($this->dataStr, $p));
 				if ($mode == QR_MODE_KJ) {
 					$p += 2;
 				} else {
diff --git a/lib/phpqrcode/phpqrcode.php b/lib/phpqrcode/phpqrcode.php
index 80adb9df2..02b877639 100644
--- a/lib/phpqrcode/phpqrcode.php
+++ b/lib/phpqrcode/phpqrcode.php
@@ -2195,7 +2195,7 @@
                     case QR_MODE_NUM: $length = $this->eatNum(); break;
                     case QR_MODE_AN:  $length = $this->eatAn(); break;
                     case QR_MODE_KANJI:
-                        if ($hint == QR_MODE_KANJI)
+                        if ($this->modeHint == QR_MODE_KANJI)
                                 $length = $this->eatKanji();
                         else    $length = $this->eat8();
                         break;
@@ -2217,7 +2217,7 @@
             $p = 0;
             
             while ($p<$stringLen) {
-                $mode = self::identifyMode(substr($this->dataStr, $p), $this->modeHint);
+                $mode = self::identifyMode(substr($this->dataStr, $p));
                 if($mode == QR_MODE_KANJI) {
                     $p += 2;
                 } else {
@@ -2621,13 +2621,13 @@
                 if (file_exists($fileName)) {
                     $bitMask = self::unserial(file_get_contents($fileName));
                 } else {
-                    $bitMask = $this->generateMaskNo($maskNo, $width, $s, $d);
+                    $bitMask = $this->generateMaskNo($maskNo, $width, $s);
                     if (!file_exists(QR_CACHE_DIR.'mask_'.$maskNo))
                         mkdir(QR_CACHE_DIR.'mask_'.$maskNo);
                     file_put_contents($fileName, self::serial($bitMask));
                 }
             } else {
-                $bitMask = $this->generateMaskNo($maskNo, $width, $s, $d);
+                $bitMask = $this->generateMaskNo($maskNo, $width, $s);
             }
 
             if ($maskGenOnly)
@@ -2937,7 +2937,7 @@
         //----------------------------------------------------------------------
         public function getCode()
         {
-            $ret;
+            $ret = 0;
 
             if($this->count < $this->dataLength) {
                 $row = $this->count % $this->blocks;
@@ -3059,7 +3059,7 @@
             $input = new QRinput($version, $level);
             if($input == NULL) return NULL;
 
-            $ret = $input->append($input, QR_MODE_8, strlen($string), str_split($string));
+            $ret = $input->append(QR_MODE_8, strlen($string), str_split($string));
             if($ret < 0) {
                 unset($input);
                 return NULL;
diff --git a/lib/phpqrcode/qrencode.php b/lib/phpqrcode/qrencode.php
index 4b77a5bdd..5bdeaec20 100644
--- a/lib/phpqrcode/qrencode.php
+++ b/lib/phpqrcode/qrencode.php
@@ -129,7 +129,7 @@
         //----------------------------------------------------------------------
         public function getCode()
         {
-            $ret;
+            $ret = 0;
 
             if($this->count < $this->dataLength) {
                 $row = $this->count % $this->blocks;
diff --git a/lib/phpqrcode/qrmask.php b/lib/phpqrcode/qrmask.php
index b14d7ae16..43d653ce3 100644
--- a/lib/phpqrcode/qrmask.php
+++ b/lib/phpqrcode/qrmask.php
@@ -149,13 +149,13 @@
                 if (file_exists($fileName)) {
                     $bitMask = self::unserial(file_get_contents($fileName));
                 } else {
-                    $bitMask = $this->generateMaskNo($maskNo, $width, $s, $d);
+                    $bitMask = $this->generateMaskNo($maskNo, $width, $s);
                     if (!file_exists(QR_CACHE_DIR.'mask_'.$maskNo))
                         mkdir(QR_CACHE_DIR.'mask_'.$maskNo);
                     file_put_contents($fileName, self::serial($bitMask));
                 }
             } else {
-                $bitMask = $this->generateMaskNo($maskNo, $width, $s, $d);
+                $bitMask = $this->generateMaskNo($maskNo, $width, $s);
             }
 
             if ($maskGenOnly)
diff --git a/lib/phpqrcode/qrsplit.php b/lib/phpqrcode/qrsplit.php
index d75b82737..1f9f65c3b 100644
--- a/lib/phpqrcode/qrsplit.php
+++ b/lib/phpqrcode/qrsplit.php
@@ -186,7 +186,7 @@
             if($ret < 0)
                 return -1;
 
-            return $run;
+            return $ret;
         }
 
         //----------------------------------------------------------------------
@@ -258,7 +258,7 @@
                     case QR_MODE_NUM: $length = $this->eatNum(); break;
                     case QR_MODE_AN:  $length = $this->eatAn(); break;
                     case QR_MODE_KANJI:
-                        if ($hint == QR_MODE_KANJI)
+                        if ($this->modeHint == QR_MODE_KANJI)
                                 $length = $this->eatKanji();
                         else    $length = $this->eat8();
                         break;
@@ -280,7 +280,7 @@
             $p = 0;
             
             while ($p<$stringLen) {
-                $mode = self::identifyMode(substr($this->dataStr, $p), $this->modeHint);
+                $mode = self::identifyMode(substr($this->dataStr, $p));
                 if($mode == QR_MODE_KANJI) {
                     $p += 2;
                 } else {
@@ -308,4 +308,4 @@
                 
             return $split->splitString();
         }
-    }
\ No newline at end of file
+    }
diff --git a/plugins/af_unburn/init.php b/plugins/af_unburn/init.php
index 62b3b4dcf..a97502b12 100644
--- a/plugins/af_unburn/init.php
+++ b/plugins/af_unburn/init.php
@@ -114,7 +114,7 @@ class Af_Unburn extends Plugin {
 				preg_match("/(Location:|URI:)[^(\n)]*/", $header, $matches);
 				$url = trim(str_replace($matches[1],"",$matches[0]));
 				$url_parsed = parse_url($url);
-				return (isset($url_parsed))? geturl($url, $referer):'';
+				return (isset($url_parsed))? geturl($url):'';
 			}
 			$oline='';
 			foreach($status as $key=>$eline){$oline.='['.$key.']'.$eline.' ';}
diff --git a/plugins/auth_internal/init.php b/plugins/auth_internal/init.php
index 79a8e8cb3..87c8555c0 100644
--- a/plugins/auth_internal/init.php
+++ b/plugins/auth_internal/init.php
@@ -51,7 +51,7 @@ class Auth_Internal extends Plugin implements IAuthModule {
 							$return = urlencode($_REQUEST["return"]);
 							?><html>
 								<head><title>Tiny Tiny RSS</title></head>
-								<?php echo stylesheet_tag("utility.css") ?>
+								<?php stylesheet_tag("utility.css") ?>
 							<body class="otp"><div class="content">
 							<form action="public.php?return=<?php echo $return ?>"
 									method="POST" class="otpform">
diff --git a/plugins/auth_remote/init.php b/plugins/auth_remote/init.php
index 2bf090d54..2ec2c87b2 100644
--- a/plugins/auth_remote/init.php
+++ b/plugins/auth_remote/init.php
@@ -45,7 +45,7 @@ class Auth_Remote extends Plugin implements IAuthModule {
 #	  	if (!$try_login) $try_login = "test_qqq";
 
 		if ($try_login) {
-			$user_id = $this->base->auto_create_user($try_login);
+			$user_id = $this->base->auto_create_user($try_login, $password);
 
 			if ($user_id) {
 				$_SESSION["fake_login"] = $try_login;
diff --git a/prefs.php b/prefs.php
index 9bf610a53..b617d94bc 100644
--- a/prefs.php
+++ b/prefs.php
@@ -32,14 +32,14 @@
 <head>
 	<title>Tiny Tiny RSS : <?php echo __("Preferences") ?></title>
 
-	<?php echo stylesheet_tag("lib/dijit/themes/claro/claro.css"); ?>
-	<?php echo stylesheet_tag("tt-rss.css"); ?>
-	<?php echo stylesheet_tag("prefs.css"); ?>
+	<?php stylesheet_tag("lib/dijit/themes/claro/claro.css"); ?>
+	<?php stylesheet_tag("tt-rss.css"); ?>
+	<?php stylesheet_tag("prefs.css"); ?>
 
 	<?php if ($_SESSION["uid"]) {
 		$theme = get_pref( "USER_CSS_THEME", $_SESSION["uid"], false);
 		if ($theme) {
-			echo stylesheet_tag("themes/$theme");
+			stylesheet_tag("themes/$theme");
 		}
 	}
 	?>
@@ -58,7 +58,7 @@
 				"lib/dojo/tt-rss-layer.js",
 				"errors.php?mode=js") as $jsfile) {
 
-		echo javascript_tag($jsfile);
+		javascript_tag($jsfile);
 
 	} ?>
 
diff --git a/update.php b/update.php
index d4160c7ba..f542a390b 100755
--- a/update.php
+++ b/update.php
@@ -321,7 +321,7 @@
 	}
 
 	if (isset($options["list-plugins"])) {
-		$tmppluginhost = new PluginHost(Db::get());
+		$tmppluginhost = new PluginHost();
 		$tmppluginhost->load_all($tmppluginhost::KIND_ALL);
 		$enabled = array_map("trim", explode(",", PLUGINS));
 
-- 
cgit v1.2.3-54-g00ecf