Changeset 1301 for branches

Timestamp:

02/21/06 16:29:49 (3 years ago)

Author:

kdz13

Message:

svn merge -r1278:1300 http://svn.gregarius.net/svn/trunk/rss

Location:

branches/new-themes-model/rss

Files:

• INSTALL (modified) (1 diff)
• admin/channels.php (modified) (1 diff)
• admin/config.php (modified) (4 diffs)
• admin/folders.php (modified) (6 diffs)
• cls/search.php (modified) (2 diffs)
• cls/wrappers/searchform.php (modified) (1 diff)
• constants.php (modified) (1 diff)
• feed.php (modified) (3 diffs)
• index.php (modified) (1 diff)
• schema.php (modified) (5 diffs)
• tags.php (modified) (1 diff)
• themes/default/rss/item.php (modified) (1 diff)
• themes/default/web/media/installer (added)
• themes/default/web/media/installer/codename.jpg (added)
• util.php (modified) (7 diffs)

branches/new-themes-model/rss/INSTALL

@@ -66 +66 @@
     
     
-   7.   Point your browser to the URL corresponding the install location
-    and click "Admin". You can start adding feeds by pasting URLs of
-    RSS or RDF feeds into the "Add a feed" field. Alternatively you
-    can import a whole structure of items using the OPML import
-    feature.
+   7.   Point your browser to the URL corresponding the install
+    location and click "Admin". After selecting a new password,
+    you can start adding feeds by pasting URLs of RSS or RDF feeds
+    into the "Add a feed" field. Alternatively you can import a
+    list of feeds using the OPML import feature.
    
-   8.   You may wish to password-protect the administration section of
-    your fresh gregarius installation, to prevent unauthorized users
-    from messing with your subscriptions and breaking stuff. 
+   8.   This version of Gregarius comes with default password
+    protection, however you may wish to to strengthen it by using
+    a .htaccess file. 
         
-    See http://wiki.gregarius.net/index.php/Password_Protection for
-    this purpose.
+    See http://wiki.gregarius.net/index.php/Password_Protection
+    for this purpose.

branches/new-themes-model/rss/admin/channels.php

@@ -535 +535 @@
         rss_plugin_hook('rss.plugins.admin.feed.properties.submit', null);
         // TBD
-        $title= rss_real_escape_string(real_strip_slashes($_POST['c_name']));
+        $title= strip_tags(rss_real_escape_string(real_strip_slashes($_POST['c_name'])));
         $url= rss_real_escape_string($_POST['c_url']);
         $siteurl= rss_real_escape_string($_POST['c_siteurl']);
         $parent= rss_real_escape_string($_POST['c_parent']);
-        $descr= rss_real_escape_string(real_strip_slashes($_POST['c_descr']));
+        $descr= strip_tags(rss_real_escape_string(real_strip_slashes($_POST['c_descr'])));
         $icon = rss_real_escape_string($_POST['c_icon']);
         $priv = (array_key_exists('c_private',$_POST) && $_POST['c_private'] == '1');

branches/new-themes-model/rss/admin/config.php

@@ -49 +49 @@
         $class_ = (($cntr++ % 2 == 0)?"even":"odd");
 
-        // Fix for #279. Plugins have their own section.
-        if ($row['key_'] == 'rss.config.plugins' or $row['key_'] ==
-                'rss.output.theme' or $row['key_'] == 'rss.output.barefrontpage'
-                or $row['key_'] == 'rss.output.noreaditems' or $row['key_'] == 'rss.output.numitemsonpage') {
+        // Don't show old/moved config keys in the main config list
+        if ($row['key_'] == 'rss.config.plugins' or 
+        $row['key_'] == 'rss.output.theme' or 
+        $row['key_'] == 'rss.output.barefrontpage' or 
+        $row['key_'] == 'rss.output.noreaditems' or 
+        $row['key_'] == 'rss.output.cachedir' or
+        $row['key_'] == 'rss.output.numitemsonpage') {
             continue;
         }
@@ -90 +93 @@
             . preg_replace('/ /',' ',date("g:i A",mktime()+$value*3600))
             .")";
-            break;
-        case 'rss.output.cachedir':
-            echo $value;
-            if (!is_writable($value)) {
-                echo "<br />"
-                ."<span class=\"error\">Warning: this isn't a writable directory!</span>";
-            }
             break;
         default:
@@ -299 +295 @@
             echo "</select>\n";
             break;
-        case 'rss.output.cachedir':
-            if (!is_writable($value)) {
-                echo "</p><p class=\"error\">"
-                ."Warning! The current value ($value) is not a writable directory!<br />"
-                ."See <a href=\"http://wiki.gregarius.net/index.php/MagpieRSS\">here</a> "
-                ."why it is important you provide a valid, writable directory."
-                ."</p><p>\n";
-            } else {
-                echo "</p><p>"
-                ."The current value ($value) is a valid, writable directory!"
-                ."</p><p>\n";
-            }
-            // no break: fall back into the normal handling
         default:
 
@@ -381 +364 @@
         $value = sanitize($_POST['value'], RSS_SANITIZER_SIMPLE_SQL);
 
+                
+                // sanitizine routines for values
+                switch ($key) {
+                    case 'rss.output.title':
+                    $value = strip_tags($value);
+                    break;
+                    
+                    case 'rss.config.robotsmeta':
+                    $value = preg_replace('#[^a-zA-Z,\s]#','',$value);
+                    break;
+                }
+                
+                
         switch ($key) {
 

branches/new-themes-model/rss/admin/folders.php

@@ -189 +189 @@
             $sql = "update " . getTable("channels") ." set parent=" . getRootFolder() . " where parent=$fid";
             rss_query($sql);
+            rss_invalidate_cache();
         }
         elseif (array_key_exists(CST_ADMIN_CONFIRMED,$_REQUEST) && $_REQUEST[CST_ADMIN_CONFIRMED] == LBL_ADMIN_NO) {
@@ -212 +213 @@
     case CST_ADMIN_SUBMIT_EDIT:
         // TBD
-        $new_label = rss_real_escape_string($_REQUEST['f_name']);
+        $new_label = sanitize($_REQUEST['f_name'], RSS_SANITIZER_CHARACTERS_EXT);
         if (is_numeric($fid) && strlen($new_label) > 0) {
 
@@ -222 +223 @@
             }
             rss_query("update " .getTable("folders") ." set name='$new_label' where id=$fid");
+            rss_invalidate_cache();
         }
         break;
@@ -227 +229 @@
     case LBL_ADMIN_ADD:
     case 'LBL_ADMIN_ADD':
-        $label=sanitize($_REQUEST['new_folder'],RSS_SANITIZER_SIMPLE_SQL);
+        $label=sanitize($_REQUEST['new_folder'],RSS_SANITIZER_CHARACTERS_EXT);
         assert(strlen($label) > 0);
         create_folder($label);
@@ -271 +273 @@
             rss_query( "update " . getTable("folders") ." set position = $switch_with_position where id=$fid" );
             rss_query( "update " . getTable("folders") ." set position = $position where id=$switch_with_id" );
+            rss_invalidate_cache();
         }
         break;
@@ -303 +306 @@
         }
         rss_query("insert into " .getTable("folders") ." (name,position) values ('" . rss_real_escape_string($label) ."', $np)");
+        rss_invalidate_cache();
     }
 

branches/new-themes-model/rss/cls/search.php

@@ -106 +106 @@
         }
 
-        $this->query = $_REQUEST[QUERY_PRM];
+                // fixme: this probably breaks on queries with weird characters, depending
+                // on the locale. 
+                // see: http://php.benscom.com/manual/en/reference.pcre.pattern.syntax.php
+        $this->query = trim(preg_replace('#[^\w\s]#','',$_REQUEST[QUERY_PRM]));
+        
         if (!$this->query) {
             return;
         }
 
-        $this->matchMode = (!array_key_exists(QUERY_MATCH_MODE, $_REQUEST) ? QUERY_MATCH_AND : $_REQUEST[QUERY_MATCH_MODE]);
-        $this->channelId = (array_key_exists(QUERY_CHANNEL, $_REQUEST)) ? (int) $_REQUEST[QUERY_CHANNEL] : ALL_CHANNELS_ID;
-
-        $this->resultsPerPage = (array_key_exists(QUERY_RESULTS, $_REQUEST)) ? (int) $_REQUEST[QUERY_RESULTS] : INFINE_RESULTS;
-        $this->currentPage = (array_key_exists(QUERY_CURRENT_PAGE, $_REQUEST) ? (int) $_REQUEST[QUERY_CURRENT_PAGE] : 0);
+        $this->matchMode = sanitize(
+                (!array_key_exists(QUERY_MATCH_MODE, $_REQUEST) ? QUERY_MATCH_AND : $_REQUEST[QUERY_MATCH_MODE]), 
+            RSS_SANITIZER_CHARACTERS_EXT);
+            
+        $this->channelId = sanitize(
+            ((array_key_exists(QUERY_CHANNEL, $_REQUEST)) ? $_REQUEST[QUERY_CHANNEL] : ALL_CHANNELS_ID),
+            RSS_SANITIZER_NUMERIC);
+
+        $this->resultsPerPage = sanitize(
+            ((array_key_exists(QUERY_RESULTS, $_REQUEST)) ? $_REQUEST[QUERY_RESULTS] : INFINE_RESULTS),
+            RSS_SANITIZER_NUMERIC);
+        
+        $this->currentPage = sanitize(
+            (array_key_exists(QUERY_CURRENT_PAGE, $_REQUEST) ? $_REQUEST[QUERY_CURRENT_PAGE] : 0),
+            RSS_SANITIZER_NUMERIC);
 
         $this->startItem = $this->resultsPerPage * $this->currentPage;
@@ -125 +139 @@
         }
 
-        $this->orderBy = (array_key_exists(QUERY_ORDER_BY, $_REQUEST) ? $_REQUEST[QUERY_ORDER_BY] : QUERY_ORDER_BY_DATE);
+        $this->orderBy = sanitize(
+            (array_key_exists(QUERY_ORDER_BY, $_REQUEST) ? $_REQUEST[QUERY_ORDER_BY] : QUERY_ORDER_BY_DATE),
+            RSS_SANITIZER_CHARACTERS_EXT);
+            
         $qWhere = "";
         $this->regMatch = "";

branches/new-themes-model/rss/cls/wrappers/searchform.php

@@ -104 +104 @@
         $sql .=" and not(c.mode & " . RSS_MODE_PRIVATE_STATE .") ";       
     }
-              
+
+    
+    $sql .=" and not(c.mode & " . RSS_MODE_DELETED_STATE .") ";       
+    
     $sql .= " order by "
          .((getConfig('rss.config.absoluteordering'))?"f.position asc, c.position asc":"f.name asc, c.title asc");

branches/new-themes-model/rss/constants.php

@@ -165 +165 @@
 define ('RSS_SANITIZER_NUMERIC', 0x04);
 define ('RSS_SANITIZER_CHARACTERS',0x08);
+define ('RSS_SANITIZER_CHARACTERS_EXT',0x10);
 
 // Profiling 

branches/new-themes-model/rss/feed.php

@@ -169 +169 @@
 }
 elseif (array_key_exists('channel',$_REQUEST) || array_key_exists('folder',$_REQUEST) || array_key_exists('vfolder',$_REQUEST)) {
-    $cid= (array_key_exists('channel',$_REQUEST))?sanitize($_REQUEST['channel'],RSS_SANITIZER_NO_SPACES):"";
-    $iid= (array_key_exists('iid',$_REQUEST))?sanitize($_REQUEST['iid'],RSS_SANITIZER_NO_SPACES):"";
-    $fid= (array_key_exists('folder',$_REQUEST))?sanitize($_REQUEST['folder'],RSS_SANITIZER_NO_SPACES):"";
-    $vfid= (array_key_exists('vfolder',$_REQUEST))?sanitize($_REQUEST['vfolder'],RSS_SANITIZER_NO_SPACES):"";
+    $cid= (array_key_exists('channel',$_REQUEST))?sanitize($_REQUEST['channel'],RSS_SANITIZER_NUMERIC):"";
+    $iid= (array_key_exists('iid',$_REQUEST))?sanitize($_REQUEST['iid'],RSS_SANITIZER_NUMERIC):"";
+    $fid= (array_key_exists('folder',$_REQUEST))?sanitize($_REQUEST['folder'],RSS_SANITIZER_NUMERIC):"";
+    $vfid= (array_key_exists('vfolder',$_REQUEST))?sanitize($_REQUEST['vfolder'],RSS_SANITIZER_NUMERIC):"";
     
     $y= (array_key_exists('y',$_REQUEST))?sanitize($_REQUEST['y'],RSS_SANITIZER_NUMERIC):"0";
@@ -415 +415 @@
         // folder
     case 'LBL_MARK_FOLDER_READ':
-        $fid = $_REQUEST['folder'];
+        $fid = sanitize($_REQUEST['folder'],RSS_SANITIZER_NUMERIC);
         $sql = "update " .getTable('item') . " i, " . getTable('channels') . " c "
                . " set i.unread = i.unread & ".SET_MODE_READ_STATE
@@ -476 +476 @@
         // virtual folder - code extremely similar to LBL_MARK_FOLDER_READ
     case 'LBL_MARK_VFOLDER_READ':
-        $vfid = $_REQUEST['vfolder'];
+        $vfid = sanitize($_REQUEST['vfolder'],RSS_SANITIZER_NUMERIC);
         $sql = "update " .getTable('item') . " i, " . getTable('metatag') . " m"
                . " set i.unread = i.unread & ".SET_MODE_READ_STATE

branches/new-themes-model/rss/index.php

@@ -68 +68 @@
 if (array_key_exists('logout',$_GET)) {
     logoutUserCookie();
+    rss_redirect('');
 }
 

branches/new-themes-model/rss/schema.php

@@ -224 +224 @@
             }
         break;
+        
+        case 'userips':
+        case 'i.userips':
+        // users.userips: list of valid IP subnets the user has logged in from
+        rss_query('alter table ' . getTable('users') . ' add column userips text default \'\'');
+            if (rss_is_sql_error(RSS_SQL_ERROR_NO_ERROR)) {
+                $updated++;
+                rss_error('updated schema for table ' . getTable('users'), RSS_ERROR_NOTICE);
+            } else {
+                rss_error('Failed updating schema for table ' . getTable('users') . ': '
+                    . rss_sql_error_message(), RSS_ERROR_ERROR);
+            }
+        break;
+        
+        
         case 'i.md5sum':
         case 'md5sum':
@@ -248 +263 @@
                     . rss_sql_error_message(), RSS_ERROR_ERROR);
             }
+        
         break;
     }
@@ -413 +429 @@
     rss_error('inserting some default config values...', RSS_ERROR_NOTICE);
     $defaults = array (
-        "rss.output.cachedir"       =>      array("/tmp/magpierss","/tmp/magpierss","string","Where should magpie store its temporary files? (Apache needs write permissions on this dir.)","MAGPIE_CACHE_DIR"),
         "rss.output.encoding"       =>      array("UTF-8","UTF-8","string","Output encoding for the PHP XML parser.","MAGPIE_OUTPUT_ENCODING"),
         "rss.output.itemsinchannelview"=>array("10","10","num","Number of read items shown on for a single channel.",NULL),
@@ -426 +441 @@
         "rss.config.markreadonupdate"=> array("false","false","boolean","Mark all old unread feeds as read when updating if new unread feeds are found.",NULL),
         "rss.output.lang"           =>      array("en,es,fr,dk,it,pt_BR,se,0","en,es,fr,dk,it,pt_BR,se,0","enum","Language pack to use.",NULL),
-        "rss.config.absoluteordering"=> array("true","true","boolean","Allow ordering of channels and folders in the admin section. If false, channels and folders will be organized by their titles.",NULL),
+        "rss.config.absoluteordering"=> array("true","true","boolean","Allow ordering of channels and folders in the admin section. If false, channels and folders will be organized alphabetically by their titles.",NULL),
         "rss.config.robotsmeta"     =>      array("noindex,follow","noindex,follow","string","How should spiders crawl us? (see http://www.robotstxt.org/wc/meta-user.html for more info).",NULL),
         "rss.config.serverpush"     =>      array("true","true","boolean","Use server push on update.php for a more user-friendly experience. This is only supported by Mozilla browsers (Netscape, Mozilla, Firefox,...) and Opera. These browsers will be autodetected. If you\'re not using one of these (you should) you can as well turn this off.",NULL),
@@ -633 +648 @@
           realname varchar(255) default NULL,                 
           lastip varchar(255) default NULL,                       
+          userips TEXT default '',        
           lastlogin datetime NULL default '0000-00-00 00:00:00',
           PRIMARY KEY  (uid),

branches/new-themes-model/rss/tags.php

@@ -84 +84 @@
 if (array_key_exists('tag', $_GET)) {
     // while this one displays a list of items for the requested tag(s)
-    $tag = $_GET['tag'];
+    $tag = strip_tags($_GET['tag']);
     $twhere = "";
     $tarr = explode(" ", $tag);

branches/new-themes-model/rss/themes/default/rss/item.php

@@ -1 +1 @@
 <item>
-        <title><?php echo rss_feed_escaped_title(); ?>: <?php echo rss_item_escaped_title(); ?></title>
+        <title><?php echo rss_htmlspecialchars(rss_feed_title()); ?>: <?php echo rss_htmlspecialchars(rss_item_title()); ?></title>
         <link><?php echo rss_item_url(); ?></link>
         <pubDate><?php echo rss_item_date_with_format('r'); ?></pubDate>

branches/new-themes-model/rss/util.php

@@ -792 +792 @@
                     'realname' => null,
                     'lastip' => null,
+                    'userips' => null,
                     'lastlogin' => null
                 );
@@ -804 +805 @@
             $sql = "select * from " . getTable('users') . " where uname='"
                    .rss_real_escape_string($cuname) ."' and password='"
-                   .rss_real_escape_string($chash) ."'";
+                   .preg_replace('#[^a-zA-Z0-9]#','',$chash) ."'";
             $rs = rss_query($sql);
             if (rss_num_rows($rs) == 1) {
-                $user = rss_fetch_assoc($rs);
-                unset($user['password']);
+                $tmp = rss_fetch_assoc($rs);
+                if (isset($tmp['userips'])) {
+                    $tmp['userips'] = explode(' ',$tmp['userips']);
+                } else {
+                    $tmp['userips'] = array();
+                }
+                
+                unset($tmp['password']);
+                $subnet = preg_replace('#^([0-9]+\.[0-9]+\.[0-9]+)\.[0-9]+$#','\1',$_SERVER['REMOTE_ADDR']);
+                     if (array_search($subnet, $tmp['userips']) !== FALSE) {
+                        // success: password hash was checked and the user's IP 
+                        // address subnet is registered 
+                        $user = $tmp;
+                     }
             }
         }
@@ -826 +839 @@
 function logoutUserCookie() {
     if (array_key_exists(RSS_USER_COOKIE, $_COOKIE)) {
-        unset($_COOKIE[RSS_USER_COOKIE]);
-        setcookie(RSS_USER_COOKIE, "", -1, getPath());
+    
+            // remove the user's IP subnet from the list of valid addresses
+            $user = rss_getUser();
+           $subnet = preg_replace('#^([0-9]+\.[0-9]+\.[0-9]+)\.[0-9]+$#','\1',$_SERVER['REMOTE_ADDR']);
+           
+            if (($idx = array_search($subnet, $user['userips'])) !== FALSE) {
+                $cnt = count($user['userips']);
+                unset($user['userips'][$idx]);
+                $uname = trim($user['uname']);
+                if ($uname && ($cnt > count($user['userips']))) {
+                    $sql = "update " .getTable('users') 
+                        . " set userips = '" . implode(' ',$user['userips']) ."'"
+                        ." where uname = '$uname' ";
+                    rss_query($sql);
+                }
+            }
+           
+           // get rid of the cookie
+         unset($_COOKIE[RSS_USER_COOKIE]);
+         setcookie(RSS_USER_COOKIE, "", -1, getPath());
+            rss_invalidate_cache();
+        
     }
 }
@@ -835 +868 @@
     if ($ret === null) {
         $ret = !rss_check_user_level(RSS_USER_LEVEL_PRIVATE);
-        ;
     }
 
@@ -847 +879 @@
 
 function __exp_login($uname,$pass,$cb) {
-    $sql ="select uname,ulevel from " .getTable('users') . "where uname='"
+    $sql ="select uname,ulevel,userips from " .getTable('users') . "where uname='"
           .rss_real_escape_string($uname)."' and password='$pass'";
-    list($uname,$ulevel) = rss_fetch_row(rss_query($sql));
+    list($uname,$ulevel,$userips) = rss_fetch_row(rss_query($sql));
     if ($ulevel == '') {
         $ulevel = RSS_USER_LEVEL_NOLEVEL;
     } else {
+            // is the user's IP subnet in the database, already?
+            $subnet = preg_replace('#^([0-9]+\.[0-9]+\.[0-9]+)\.[0-9]+$#','\1',$_SERVER['REMOTE_ADDR']);
+            $useripsArray = explode(' ',$userips);
+            if (array_search($subnet, $useripsArray) === FALSE) {
+                $useripsArray[] = $subnet;
+                $sql = "update " .getTable('users') 
+                    . " set userips = '" . implode(' ',$useripsArray) ."'"
+                    ." where uname = '$uname' ";
+                rss_query($sql);
+            }
+            
+            
         //setcookie(RSS_USER_COOKIE,$uname ."|". $pass,time()+3600*365,getPath());
         rss_invalidate_cache();
@@ -1128 +1172 @@
         $theme = preg_replace('/[^a-zA-Z0-9_]/','',$_GET['theme']);
     }
+
+    $theme = sanitize($theme,RSS_SANITIZER_CHARACTERS);
     
     // Media
     $media = getThemeMedia();
-    
-    
     
     $ret = array($theme,$media);
@@ -1212 +1256 @@
     if ($rules & RSS_SANITIZER_NO_SPACES) {
         $ret = preg_replace('#\s#','',$ret);
+        // also strip out SQL comments
+        $ret = preg_replace('#/\*.*\*/#','',$ret);
     }
     if ($rules & RSS_SANITIZER_NUMERIC) {
-        $ret = preg_replace('#[^0-9\.]#','',$ret);
+        $ret = preg_replace('#[^0-9\.-]#','',$ret);
     }   
     if ($rules & RSS_SANITIZER_CHARACTERS) {
         $ret = preg_replace('#[^a-zA-Z]#','',$ret);
     }
+    if ($rules & RSS_SANITIZER_CHARACTERS_EXT) {
+        $ret = preg_replace('#[^a-zA-Z_]#','',$ret);
+    }
     return $ret;
 }