This page lists files in the current directory. You can view content, get download/execute commands for Wget, Curl, or PowerShell, or filter the list using wildcards (e.g., `*.sh`).
wget 'https://lists2.roe3.org/FreshRSS/p/api/.htaccess'<IfModule mod_setenvif.c>
SetEnvIfNoCase "Authorization" "(.*)" HTTP_AUTHORIZATION=$1
</IfModule>
<IfModule !mod_setenvif.c>
<IfModule mod_rewrite.c>
RewriteEngine on
RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]
</IfModule>
</IfModule>
wget 'https://lists2.roe3.org/FreshRSS/p/api/fever.php'<?php
declare(strict_types=1);
/**
* Fever API for FreshRSS
* Version 0.1
* Author: Kevin Papst / https://github.com/kevinpapst
* Documentation: https://feedafever.com/api
*
* Inspired by:
* TinyTinyRSS Fever API plugin @dasmurphy
* See https://github.com/dasmurphy/tinytinyrss-fever-plugin
*/
// ================================================================================================
// BOOTSTRAP FreshRSS
require(__DIR__ . '/../../constants.php');
require(LIB_PATH . '/lib_rss.php'); //Includes class autoloader
FreshRSS_Context::initSystem();
// check if API is enabled globally
if (!FreshRSS_Context::hasSystemConf() || !FreshRSS_Context::systemConf()->api_enabled) {
Minz_Log::warning('Fever API: service unavailable!');
Minz_Log::debug('Fever API: serviceUnavailable() ' . debugInfo(), API_LOG);
header('HTTP/1.1 503 Service Unavailable');
header('Content-Type: text/plain; charset=UTF-8');
die('Service Unavailable!');
}
Minz_Session::init('FreshRSS', true);
// ================================================================================================
// <Debug>
$ORIGINAL_INPUT = file_get_contents('php://input', false, null, 0, 1_048_576) ?: '';;
function debugInfo(): string {
if (function_exists('getallheaders')) {
$ALL_HEADERS = getallheaders();
} else { //nginx http://php.net/getallheaders#84262
$ALL_HEADERS = [];
foreach ($_SERVER as $name => $value) {
if (substr($name, 0, 5) === 'HTTP_') {
$ALL_HEADERS[str_replace(' ', '-', ucwords(strtolower(str_replace('_', ' ', substr($name, 5)))))] = $value;
}
}
}
global $ORIGINAL_INPUT;
$log = sensitive_log([
'date' => date('c'),
'headers' => $ALL_HEADERS,
'_SERVER' => $_SERVER,
'_GET' => $_GET,
'_POST' => $_POST,
'_COOKIE' => $_COOKIE,
'INPUT' => $ORIGINAL_INPUT,
]);
return print_r($log, true);
}
//Minz_Log::debug('----------------------------------------------------------------', API_LOG);
//Minz_Log::debug(debugInfo(), API_LOG);
// </Debug>
final class FeverDAO extends Minz_ModelPdo
{
/**
* @param array<string|int> $values
* @param array<string,string|int> $bindArray
*/
private function bindParamArray(string $prefix, array $values, array &$bindArray): string {
$str = '';
for ($i = 0; $i < count($values); $i++) {
$str .= ':' . $prefix . $i . ',';
$bindArray[$prefix . $i] = $values[$i];
}
return rtrim($str, ',');
}
/**
* @param array<string|int> $feed_ids
* @param array<string> $entry_ids
* @return FreshRSS_Entry[]
*/
public function findEntries(array $feed_ids, array $entry_ids, string $max_id, string $since_id): array {
$values = [];
$order = '';
$entryDAO = FreshRSS_Factory::createEntryDao();
$sql = 'SELECT id, guid, title, author, '
. ($entryDAO::isCompressed() ? 'UNCOMPRESS(content_bin) AS content' : 'content')
. ', link, date, is_read, is_favorite, id_feed, attributes '
. 'FROM `_entry` WHERE';
if (!empty($entry_ids)) {
$bindEntryIds = $this->bindParamArray('id', $entry_ids, $values);
$sql .= " id IN($bindEntryIds)";
} elseif ($max_id != '') {
$sql .= ' id < :id';
$values[':id'] = $max_id;
$order = ' ORDER BY id DESC';
} elseif ($since_id != '') {
$sql .= ' id > :id';
$values[':id'] = $since_id;
$order = ' ORDER BY id ASC';
} else {
$sql .= ' 1=1';
}
if (!empty($feed_ids)) {
$bindFeedIds = $this->bindParamArray('feed', $feed_ids, $values);
$sql .= " AND id_feed IN($bindFeedIds)";
}
$sql .= $order;
$sql .= ' LIMIT 50';
$stm = $this->pdo->prepare($sql);
if ($stm !== false && $stm->execute($values)) {
$result = $stm->fetchAll(PDO::FETCH_ASSOC);
$entries = [];
foreach ($result as $dao) {
$entries[] = FreshRSS_Entry::fromArray($dao);
}
return $entries;
}
return [];
}
}
/**
* Class FeverAPI
*/
final class FeverAPI
{
public const API_LEVEL = 3;
public const STATUS_OK = 1;
public const STATUS_ERR = 0;
private FreshRSS_EntryDAO $entryDAO;
private FreshRSS_FeedDAO $feedDAO;
/**
* Authenticate the user
*
* API Password sent from client is the result of the md5 sum of
* your FreshRSS "username:your-api-password" combination
*/
private function authenticate(): bool {
FreshRSS_Context::clearUserConf();
Minz_User::change();
$feverKey = empty($_POST['api_key']) ? '' : substr(trim($_POST['api_key']), 0, 128);
if (ctype_xdigit($feverKey)) {
$feverKey = strtolower($feverKey);
$username = @file_get_contents(DATA_PATH . '/fever/.key-' . sha1(FreshRSS_Context::systemConf()->salt) . '-' . $feverKey . '.txt', false);
if ($username != false) {
$username = trim($username);
FreshRSS_Context::initUser($username);
if ($feverKey === FreshRSS_Context::userConf()->feverKey && FreshRSS_Context::userConf()->enabled) {
Minz_Translate::init(FreshRSS_Context::userConf()->language);
$this->entryDAO = FreshRSS_Factory::createEntryDao();
$this->feedDAO = FreshRSS_Factory::createFeedDao();
return true;
} else {
Minz_Translate::init();
}
Minz_Log::error('Fever API: Reset API password for user: ' . $username, API_LOG);
Minz_Log::error('Fever API: Please reset your API password!');
Minz_User::change();
}
Minz_Log::warning('Fever API: wrong credentials! ' . $feverKey, API_LOG);
}
return false;
}
public function isAuthenticatedApiUser(): bool {
$this->authenticate();
return FreshRSS_Context::hasUserConf();
}
/**
* This does all the processing, since the fever api does not have a specific variable that specifies the operation
* @return array<string,mixed>
* @throws Exception
*/
public function process(): array {
$response_arr = [];
if (!$this->isAuthenticatedApiUser()) {
throw new Exception('No user given or user is not allowed to access API');
}
if (isset($_REQUEST['groups'])) {
$response_arr['groups'] = $this->getGroups();
$response_arr['feeds_groups'] = $this->getFeedsGroup();
}
if (isset($_REQUEST['feeds'])) {
$response_arr['feeds'] = $this->getFeeds();
$response_arr['feeds_groups'] = $this->getFeedsGroup();
}
if (isset($_REQUEST['favicons'])) {
$response_arr['favicons'] = $this->getFavicons();
}
if (isset($_REQUEST['items'])) {
$response_arr['total_items'] = $this->getTotalItems();
$response_arr['items'] = $this->getItems();
}
if (isset($_REQUEST['links'])) {
$response_arr['links'] = $this->getLinks();
}
if (isset($_REQUEST['unread_item_ids'])) {
$response_arr['unread_item_ids'] = $this->getUnreadItemIds();
}
if (isset($_REQUEST['saved_item_ids'])) {
$response_arr['saved_item_ids'] = $this->getSavedItemIds();
}
if (isset($_REQUEST['mark'], $_REQUEST['as'], $_REQUEST['id']) && ctype_digit($_REQUEST['id'])) {
$id = (string)$_REQUEST['id'];
$before = (int)($_REQUEST['before'] ?? '0');
switch (strtolower($_REQUEST['mark'])) {
case 'item':
switch ($_REQUEST['as']) {
case 'read':
$this->setItemAsRead($id);
break;
case 'saved':
$this->setItemAsSaved($id);
break;
case 'unread':
$this->setItemAsUnread($id);
break;
case 'unsaved':
$this->setItemAsUnsaved($id);
break;
}
break;
case 'feed':
switch ($_REQUEST['as']) {
case 'read':
$this->setFeedAsRead((int)$id, $before);
break;
}
break;
case 'group':
switch ($_REQUEST['as']) {
case 'read':
$this->setGroupAsRead((int)$id, $before);
break;
}
break;
}
switch ($_REQUEST['as']) {
case 'read':
case 'unread':
$response_arr['unread_item_ids'] = $this->getUnreadItemIds();
break;
case 'saved':
case 'unsaved':
$response_arr['saved_item_ids'] = $this->getSavedItemIds();
break;
}
}
return $response_arr;
}
/**
* Returns the complete JSON, with 'api_version' and status as 'auth'.
* @param array<string,mixed> $reply
*/
public function wrap(int $status, array $reply = []): string {
$arr = ['api_version' => self::API_LEVEL, 'auth' => $status];
if ($status === self::STATUS_OK) {
$arr['last_refreshed_on_time'] = $this->lastRefreshedOnTime();
$arr = array_merge($arr, $reply);
}
return json_encode($arr) ?: '';
}
/**
* every authenticated method includes last_refreshed_on_time
*/
private function lastRefreshedOnTime(): int {
$lastUpdate = 0;
$entries = $this->feedDAO->listFeedsOrderUpdate(-1, 1);
$feed = current($entries);
if (!empty($feed)) {
$lastUpdate = $feed->lastUpdate();
}
return $lastUpdate;
}
/** @return array<array<string,string|int>> */
private function getFeeds(): array {
$feeds = [];
$myFeeds = $this->feedDAO->listFeeds();
/** @var FreshRSS_Feed $feed */
foreach ($myFeeds as $feed) {
$feeds[] = [
'id' => $feed->id(),
'favicon_id' => $feed->id(),
'title' => escapeToUnicodeAlternative($feed->name(), true),
'url' => htmlspecialchars_decode($feed->url(), ENT_QUOTES),
'site_url' => htmlspecialchars_decode($feed->website(), ENT_QUOTES),
'is_spark' => 0,
// unsupported
'last_updated_on_time' => $feed->lastUpdate(),
];
}
return $feeds;
}
/** @return array<array<string,int|string>> */
private function getGroups(): array {
$groups = [];
$categoryDAO = FreshRSS_Factory::createCategoryDao();
$categories = $categoryDAO->listCategories(false, false) ?: [];
foreach ($categories as $category) {
$groups[] = [
'id' => $category->id(),
'title' => escapeToUnicodeAlternative($category->name(), true)
];
}
return $groups;
}
/** @return array<array<string,int|string>> */
private function getFavicons(): array {
if (!FreshRSS_Context::hasSystemConf()) {
return [];
}
require_once(LIB_PATH . '/favicons.php');
$favicons = [];
$salt = FreshRSS_Context::systemConf()->salt;
$myFeeds = $this->feedDAO->listFeeds();
foreach ($myFeeds as $feed) {
$id = hash('crc32b', $salt . $feed->url());
$filename = DATA_PATH . '/favicons/' . $id . '.ico';
if (!file_exists($filename)) {
continue;
}
$favicons[] = [
'id' => $feed->id(),
'data' => contentType($filename) . ';base64,' . base64_encode(file_get_contents($filename) ?: '')
];
}
return $favicons;
}
private function getTotalItems(): int {
return $this->entryDAO->count();
}
/**
* @return array<array<string,int|string>>
*/
private function getFeedsGroup(): array {
$groups = [];
$ids = [];
$myFeeds = $this->feedDAO->listFeeds();
foreach ($myFeeds as $feed) {
$ids[$feed->categoryId()][] = $feed->id();
}
foreach ($ids as $category => $feedIds) {
$groups[] = [
'group_id' => $category,
'feed_ids' => implode(',', $feedIds)
];
}
return $groups;
}
/**
* AFAIK there is no 'hot links' alternative in FreshRSS
* @return array<string>
*/
private function getLinks(): array {
return [];
}
/**
* @param array<numeric-string> $ids
*/
private function entriesToIdList(array $ids = []): string {
return implode(',', array_values($ids));
}
private function getUnreadItemIds(): string {
$entries = $this->entryDAO->listIdsWhere('a', 0, FreshRSS_Entry::STATE_NOT_READ, 'ASC', 0) ?? [];
return $this->entriesToIdList($entries);
}
private function getSavedItemIds(): string {
$entries = $this->entryDAO->listIdsWhere('a', 0, FreshRSS_Entry::STATE_FAVORITE, 'ASC', 0) ?? [];
return $this->entriesToIdList($entries);
}
/**
* @param numeric-string $id
* @return int|false
*/
private function setItemAsRead(string $id) {
return $this->entryDAO->markRead($id, true);
}
/**
* @param numeric-string $id
* @return int|false
*/
private function setItemAsUnread(string $id) {
return $this->entryDAO->markRead($id, false);
}
/**
* @param numeric-string $id
* @return int|false
*/
private function setItemAsSaved(string $id) {
return $this->entryDAO->markFavorite($id, true);
}
/**
* @param numeric-string $id
* @return int|false
*/
private function setItemAsUnsaved(string $id) {
return $this->entryDAO->markFavorite($id, false);
}
/** @return array<array<string,string|int>> */
private function getItems(): array {
$feed_ids = [];
$entry_ids = [];
$max_id = '';
$since_id = '';
if (isset($_REQUEST['feed_ids']) || isset($_REQUEST['group_ids'])) {
if (isset($_REQUEST['feed_ids'])) {
$feed_ids = explode(',', $_REQUEST['feed_ids']);
}
if (isset($_REQUEST['group_ids'])) {
$categoryDAO = FreshRSS_Factory::createCategoryDao();
$group_ids = explode(',', $_REQUEST['group_ids']);
$feeds = [];
foreach ($group_ids as $id) {
$category = $categoryDAO->searchById((int)$id); //TODO: Transform to SQL query without loop! Consider FreshRSS_CategoryDAO::listCategories(true)
if ($category == null) {
continue;
}
foreach ($category->feeds() as $feed) {
$feeds[] = $feed->id();
}
}
$feed_ids = array_unique($feeds);
}
}
if (isset($_REQUEST['max_id'])) {
// use the max_id argument to request the previous $item_limit items
$max_id = '' . $_REQUEST['max_id'];
if (!ctype_digit($max_id)) {
$max_id = '';
}
} elseif (isset($_REQUEST['with_ids'])) {
$entry_ids = explode(',', $_REQUEST['with_ids']);
} elseif (isset($_REQUEST['since_id'])) {
// use the since_id argument to request the next $item_limit items
$since_id = '' . $_REQUEST['since_id'];
if (!ctype_digit($since_id)) {
$since_id = '';
}
}
$items = [];
$feverDAO = new FeverDAO();
$entries = $feverDAO->findEntries($feed_ids, $entry_ids, $max_id, $since_id);
// Load list of extensions and enable the "system" ones.
Minz_ExtensionManager::init();
foreach ($entries as $item) {
/** @var FreshRSS_Entry $entry */
$entry = Minz_ExtensionManager::callHook('entry_before_display', $item);
if ($entry == null) {
continue;
}
$items[] = [
'id' => $entry->id(),
'feed_id' => $entry->feedId(),
'title' => escapeToUnicodeAlternative($entry->title(), false),
'author' => escapeToUnicodeAlternative(trim($entry->authors(true), '; '), false),
'html' => $entry->content(), 'url' => htmlspecialchars_decode($entry->link(), ENT_QUOTES),
'is_saved' => $entry->isFavorite() ? 1 : 0,
'is_read' => $entry->isRead() ? 1 : 0,
'created_on_time' => $entry->date(true),
];
}
return $items;
}
/**
* TODO replace by a dynamic fetch for id <= $before timestamp
* @return numeric-string
*/
private function convertBeforeToId(int $beforeTimestamp): string {
return $beforeTimestamp == 0 ? '0' : $beforeTimestamp . '000000';
}
/**
* @return int|false
*/
private function setFeedAsRead(int $id, int $before) {
$before = $this->convertBeforeToId($before);
return $this->entryDAO->markReadFeed($id, $before);
}
/**
* @return int|false
*/
private function setGroupAsRead(int $id, int $before) {
$before = $this->convertBeforeToId($before);
// special case to mark all items as read
if ($id == 0) {
return $this->entryDAO->markReadEntries($before);
}
return $this->entryDAO->markReadCat($id, $before);
}
}
// ================================================================================================
// refresh is not allowed yet, probably we find a way to support it later
if (isset($_REQUEST['refresh'])) {
Minz_Log::warning('Fever API: Refresh items - notImplemented()', API_LOG);
header('HTTP/1.1 501 Not Implemented');
header('Content-Type: text/plain; charset=UTF-8');
die('Not Implemented!');
}
// Start the Fever API handling
$handler = new FeverAPI();
header('Content-Type: application/json; charset=UTF-8');
if (!$handler->isAuthenticatedApiUser()) {
echo $handler->wrap(FeverAPI::STATUS_ERR, []);
} else {
echo $handler->wrap(FeverAPI::STATUS_OK, $handler->process());
}
wget 'https://lists2.roe3.org/FreshRSS/p/api/greader.php'<?php
declare(strict_types=1);
/**
== Description ==
Server-side API compatible with Google Reader API layer 2
for the FreshRSS project https://freshrss.org
== Credits ==
* 2014-03: Released by Alexandre Alapetite https://alexandre.alapetite.fr
under GNU AGPL 3 license http://www.gnu.org/licenses/agpl-3.0.html
== Documentation ==
* http://code.google.com/p/pyrfeed/wiki/GoogleReaderAPI
* https://web.archive.org/web/20130718025427/http://undoc.in/
* http://ranchero.com/downloads/GoogleReaderAPI-2009.pdf
* http://code.google.com/p/google-reader-api/w/list
* https://web.archive.org/web/20210126115837/https://blog.martindoms.com/2009/10/16/using-the-google-reader-api-part-2/
* https://github.com/noinnion/newsplus/blob/master/extensions/GoogleReaderCloneExtension/src/com/noinnion/android/newsplus/extension/google_reader/GoogleReaderClient.java
* https://github.com/ericmann/gReader-Library/blob/master/greader.class.php
* https://github.com/devongovett/reader
* https://github.com/theoldreader/api
* https://www.inoreader.com/developers/
* https://feedhq.readthedocs.io/en/latest/api/index.html
* https://github.com/bazqux/bazqux-api
*/
require(__DIR__ . '/../../constants.php');
require(LIB_PATH . '/lib_rss.php'); //Includes class autoloader
$ORIGINAL_INPUT = file_get_contents('php://input', false, null, 0, 1048576) ?: '';
if (PHP_INT_SIZE < 8) { //32-bit
/** @return numeric-string */
function hex2dec(string $hex): string {
if (!ctype_xdigit($hex)) return '0';
$result = gmp_strval(gmp_init($hex, 16), 10);
/** @var numeric-string $result */
return $result;
}
} else { //64-bit
/** @return numeric-string */
function hex2dec(string $hex): string {
if (!ctype_xdigit($hex)) {
return '0';
}
return '' . hexdec($hex);
}
}
const JSON_OPTIONS = JSON_UNESCAPED_SLASHES | JSON_UNESCAPED_UNICODE;
function headerVariable(string $headerName, string $varName): string {
$header = '';
$upName = 'HTTP_' . strtoupper($headerName);
if (isset($_SERVER[$upName])) {
$header = '' . $_SERVER[$upName];
} elseif (isset($_SERVER['REDIRECT_' . $upName])) {
$header = '' . $_SERVER['REDIRECT_' . $upName];
} elseif (function_exists('getallheaders')) {
$ALL_HEADERS = getallheaders();
if (isset($ALL_HEADERS[$headerName])) {
$header = '' . $ALL_HEADERS[$headerName];
}
}
parse_str($header, $pairs);
if (empty($pairs[$varName])) {
return '';
}
return is_string($pairs[$varName]) ? $pairs[$varName] : '';
}
/** @return array<string> */
function multiplePosts(string $name): array {
//https://bugs.php.net/bug.php?id=51633
global $ORIGINAL_INPUT;
$inputs = explode('&', $ORIGINAL_INPUT);
$result = array();
$prefix = $name . '=';
$prefixLength = strlen($prefix);
foreach ($inputs as $input) {
if (strpos($input, $prefix) === 0) {
$result[] = urldecode(substr($input, $prefixLength));
}
}
return $result;
}
function debugInfo(): string {
if (function_exists('getallheaders')) {
$ALL_HEADERS = getallheaders();
} else { //nginx http://php.net/getallheaders#84262
$ALL_HEADERS = array();
foreach ($_SERVER as $name => $value) {
if (substr($name, 0, 5) === 'HTTP_') {
$ALL_HEADERS[str_replace(' ', '-', ucwords(strtolower(str_replace('_', ' ', substr($name, 5)))))] = $value;
}
}
}
global $ORIGINAL_INPUT;
$log = sensitive_log([
'date' => date('c'),
'headers' => $ALL_HEADERS,
'_SERVER' => $_SERVER,
'_GET' => $_GET,
'_POST' => $_POST,
'_COOKIE' => $_COOKIE,
'INPUT' => $ORIGINAL_INPUT,
]);
return print_r($log, true);
}
final class GReaderAPI {
/** @return never */
private static function noContent() {
header('HTTP/1.1 204 No Content');
exit();
}
/** @return never */
private static function badRequest() {
Minz_Log::warning(__METHOD__, API_LOG);
Minz_Log::debug(__METHOD__ . ' ' . debugInfo(), API_LOG);
header('HTTP/1.1 400 Bad Request');
header('Content-Type: text/plain; charset=UTF-8');
die('Bad Request!');
}
/** @return never */
private static function unauthorized() {
Minz_Log::warning(__METHOD__, API_LOG);
Minz_Log::debug(__METHOD__ . ' ' . debugInfo(), API_LOG);
header('HTTP/1.1 401 Unauthorized');
header('Content-Type: text/plain; charset=UTF-8');
header('Google-Bad-Token: true');
die('Unauthorized!');
}
/** @return never */
private static function internalServerError() {
Minz_Log::warning(__METHOD__, API_LOG);
Minz_Log::debug(__METHOD__ . ' ' . debugInfo(), API_LOG);
header('HTTP/1.1 500 Internal Server Error');
header('Content-Type: text/plain; charset=UTF-8');
die('Internal Server Error!');
}
/** @return never */
private static function notImplemented() {
Minz_Log::warning(__METHOD__, API_LOG);
Minz_Log::debug(__METHOD__ . ' ' . debugInfo(), API_LOG);
header('HTTP/1.1 501 Not Implemented');
header('Content-Type: text/plain; charset=UTF-8');
die('Not Implemented!');
}
/** @return never */
private static function serviceUnavailable() {
Minz_Log::warning(__METHOD__, API_LOG);
Minz_Log::debug(__METHOD__ . ' ' . debugInfo(), API_LOG);
header('HTTP/1.1 503 Service Unavailable');
header('Content-Type: text/plain; charset=UTF-8');
die('Service Unavailable!');
}
/** @return never */
private static function checkCompatibility() {
Minz_Log::warning(__METHOD__, API_LOG);
Minz_Log::debug(__METHOD__ . ' ' . debugInfo(), API_LOG);
header('Content-Type: text/plain; charset=UTF-8');
if (PHP_INT_SIZE < 8 && !function_exists('gmp_init')) {
die('FAIL 64-bit or GMP extension! Wrong PHP configuration.');
}
$headerAuth = headerVariable('Authorization', 'GoogleLogin_auth');
if ($headerAuth == '') {
die('FAIL get HTTP Authorization header! Wrong Web server configuration.');
}
echo 'PASS';
exit();
}
private static function authorizationToUser(): string {
//Input is 'GoogleLogin auth', but PHP replaces spaces by '_' http://php.net/language.variables.external
$headerAuth = headerVariable('Authorization', 'GoogleLogin_auth');
if ($headerAuth != '') {
$headerAuthX = explode('/', $headerAuth, 2);
if (count($headerAuthX) === 2) {
$user = $headerAuthX[0];
if (FreshRSS_user_Controller::checkUsername($user)) {
FreshRSS_Context::initUser($user);
if (!FreshRSS_Context::hasUserConf() || !FreshRSS_Context::hasSystemConf()) {
Minz_Log::warning('Invalid API user ' . $user . ': configuration cannot be found.');
self::unauthorized();
}
if (!FreshRSS_Context::userConf()->enabled) {
Minz_Log::warning('Invalid API user ' . $user . ': configuration cannot be found.');
self::unauthorized();
}
if ($headerAuthX[1] === sha1(FreshRSS_Context::systemConf()->salt . $user . FreshRSS_Context::userConf()->apiPasswordHash)) {
return $user;
} else {
Minz_Log::warning('Invalid API authorisation for user ' . $user);
self::unauthorized();
}
} else {
self::badRequest();
}
}
}
return '';
}
/** @return never */
private static function clientLogin(string $email, string $pass) {
//https://web.archive.org/web/20130604091042/http://undoc.in/clientLogin.html
if (FreshRSS_user_Controller::checkUsername($email)) {
FreshRSS_Context::initUser($email);
if (!FreshRSS_Context::hasUserConf() || !FreshRSS_Context::hasSystemConf()) {
Minz_Log::warning('Invalid API user ' . $email . ': configuration cannot be found.');
self::unauthorized();
}
if (FreshRSS_Context::userConf()->apiPasswordHash != '' && password_verify($pass, FreshRSS_Context::userConf()->apiPasswordHash)) {
header('Content-Type: text/plain; charset=UTF-8');
$auth = $email . '/' . sha1(FreshRSS_Context::systemConf()->salt . $email . FreshRSS_Context::userConf()->apiPasswordHash);
echo 'SID=', $auth, "\n",
'LSID=null', "\n", //Vienna RSS
'Auth=', $auth, "\n";
exit();
} else {
Minz_Log::warning('Password API mismatch for user ' . $email);
self::unauthorized();
}
} else {
self::badRequest();
}
}
/**
* @return never
*/
private static function token(?FreshRSS_UserConfiguration $conf) {
//http://blog.martindoms.com/2009/08/15/using-the-google-reader-api-part-1/
//https://github.com/ericmann/gReader-Library/blob/master/greader.class.php
$user = Minz_User::name();
if ($user === null || $conf === null || !FreshRSS_Context::hasSystemConf()) {
self::unauthorized();
}
//Minz_Log::debug('token('. $user . ')', API_LOG); //TODO: Implement real token that expires
$token = str_pad(sha1(FreshRSS_Context::systemConf()->salt . $user . $conf->apiPasswordHash), 57, 'Z'); //Must have 57 characters
echo $token, "\n";
exit();
}
private static function checkToken(?FreshRSS_UserConfiguration $conf, string $token): bool {
//http://code.google.com/p/google-reader-api/wiki/ActionToken
$user = Minz_User::name();
if ($user === null || $conf === null || !FreshRSS_Context::hasSystemConf()) {
self::unauthorized();
}
if ($user !== Minz_User::INTERNAL_USER && ( //TODO: Check security consequences
$token === '' || //FeedMe
$token === 'x')) { //Reeder
return true;
}
if ($token === str_pad(sha1(FreshRSS_Context::systemConf()->salt . $user . $conf->apiPasswordHash), 57, 'Z')) {
return true;
}
Minz_Log::warning('Invalid POST token: ' . $token, API_LOG);
self::unauthorized();
}
/** @return never */
private static function userInfo() {
//https://github.com/theoldreader/api#user-info
if (!FreshRSS_Context::hasUserConf()) {
self::unauthorized();
}
$user = Minz_User::name();
exit(json_encode(array(
'userId' => $user,
'userName' => $user,
'userProfileId' => $user,
'userEmail' => FreshRSS_Context::userConf()->mail_login,
), JSON_OPTIONS));
}
/** @return never */
private static function tagList() {
header('Content-Type: application/json; charset=UTF-8');
$tags = array(
array('id' => 'user/-/state/com.google/starred'),
//array('id' => 'user/-/state/com.google/broadcast', 'sortid' => '2'),
);
$categoryDAO = FreshRSS_Factory::createCategoryDao();
$categories = $categoryDAO->listCategories(true, false) ?: [];
foreach ($categories as $cat) {
$tags[] = array(
'id' => 'user/-/label/' . htmlspecialchars_decode($cat->name(), ENT_QUOTES),
//'sortid' => $cat->name(),
'type' => 'folder', //Inoreader
);
}
$tagDAO = FreshRSS_Factory::createTagDao();
$labels = $tagDAO->listTags(true) ?: [];
foreach ($labels as $label) {
$tags[] = array(
'id' => 'user/-/label/' . htmlspecialchars_decode($label->name(), ENT_QUOTES),
//'sortid' => $label->name(),
'type' => 'tag', //Inoreader
'unread_count' => $label->nbUnread(), //Inoreader
);
}
echo json_encode(array('tags' => $tags), JSON_OPTIONS), "\n";
exit();
}
/** @return never */
private static function subscriptionExport() {
$user = Minz_User::name() ?? Minz_User::INTERNAL_USER;
$export_service = new FreshRSS_Export_Service($user);
[$filename, $content] = $export_service->generateOpml();
header('Content-Type: application/xml; charset=UTF-8');
header('Content-disposition: attachment; filename="' . $filename . '"');
echo $content;
exit();
}
/** @return never */
private static function subscriptionImport(string $opml) {
$user = Minz_User::name() ?? Minz_User::INTERNAL_USER;
$importService = new FreshRSS_Import_Service($user);
$importService->importOpml($opml);
if ($importService->lastStatus()) {
FreshRSS_feed_Controller::actualizeFeedsAndCommit();
invalidateHttpCache($user);
exit('OK');
} else {
self::badRequest();
}
}
/** @return never */
private static function subscriptionList() {
if (!FreshRSS_Context::hasSystemConf()) {
self::internalServerError();
}
header('Content-Type: application/json; charset=UTF-8');
$salt = FreshRSS_Context::systemConf()->salt;
$faviconsUrl = Minz_Url::display('/f.php?', '', true);
$faviconsUrl = str_replace('/api/greader.php/reader/api/0/subscription', '', $faviconsUrl); //Security if base_url is not set properly
$subscriptions = array();
$categoryDAO = FreshRSS_Factory::createCategoryDao();
foreach ($categoryDAO->listCategories(true, true) ?: [] as $cat) {
foreach ($cat->feeds() as $feed) {
$subscriptions[] = [
'id' => 'feed/' . $feed->id(),
'title' => escapeToUnicodeAlternative($feed->name(), true),
'categories' => [
[
'id' => 'user/-/label/' . htmlspecialchars_decode($cat->name(), ENT_QUOTES),
'label' => htmlspecialchars_decode($cat->name(), ENT_QUOTES),
],
],
//'sortid' => $feed->name(),
//'firstitemmsec' => 0,
'url' => htmlspecialchars_decode($feed->url(), ENT_QUOTES),
'htmlUrl' => htmlspecialchars_decode($feed->website(), ENT_QUOTES),
'iconUrl' => $faviconsUrl . hash('crc32b', $salt . $feed->url()),
];
}
}
echo json_encode(array('subscriptions' => $subscriptions), JSON_OPTIONS), "\n";
exit();
}
/**
* @param array<string> $streamNames
* @param array<string> $titles
* @return never
*/
private static function subscriptionEdit(array $streamNames, array $titles, string $action, string $add = '', string $remove = '') {
//https://github.com/mihaip/google-reader-api/blob/master/wiki/ApiSubscriptionEdit.wiki
switch ($action) {
case 'subscribe':
case 'unsubscribe':
case 'edit':
break;
default:
self::badRequest();
}
$addCatId = 0;
$c_name = '';
if ($add != '' && strpos($add, 'user/') === 0) { //user/-/label/Example ; user/username/label/Example
if (strpos($add, 'user/-/label/') === 0) {
$c_name = substr($add, 13);
} else {
$user = Minz_User::name();
$prefix = 'user/' . $user . '/label/';
if (strpos($add, $prefix) === 0) {
$c_name = substr($add, strlen($prefix));
} else {
$c_name = '';
}
}
$c_name = htmlspecialchars($c_name, ENT_COMPAT, 'UTF-8');
$categoryDAO = FreshRSS_Factory::createCategoryDao();
$cat = $categoryDAO->searchByName($c_name);
$addCatId = $cat == null ? 0 : $cat->id();
} elseif ($remove != '' && strpos($remove, 'user/-/label/') === 0) {
$addCatId = 1; //Default category
}
$feedDAO = FreshRSS_Factory::createFeedDao();
if (count($streamNames) < 1) {
self::badRequest();
}
for ($i = count($streamNames) - 1; $i >= 0; $i--) {
$streamUrl = $streamNames[$i]; //feed/http://example.net/sample.xml ; feed/338
if (strpos($streamUrl, 'feed/') === 0) {
$streamUrl = '' . preg_replace('%^(feed/)+%', '', $streamUrl);
$feedId = 0;
if (is_numeric($streamUrl)) {
if ($action === 'subscribe') {
continue;
}
$feedId = (int)$streamUrl;
} else {
$streamUrl = htmlspecialchars($streamUrl, ENT_COMPAT, 'UTF-8');
$feed = $feedDAO->searchByUrl($streamUrl);
$feedId = $feed == null ? -1 : $feed->id();
}
$title = $titles[$i] ?? '';
$title = htmlspecialchars($title, ENT_COMPAT, 'UTF-8');
switch ($action) {
case 'subscribe':
if ($feedId <= 0) {
$http_auth = '';
try {
$feed = FreshRSS_feed_Controller::addFeed($streamUrl, $title, $addCatId, $c_name, $http_auth);
continue 2;
} catch (Exception $e) {
Minz_Log::error('subscriptionEdit error subscribe: ' . $e->getMessage(), API_LOG);
}
}
self::badRequest();
// Always exits
case 'unsubscribe':
if (!($feedId > 0 && FreshRSS_feed_Controller::deleteFeed($feedId))) {
self::badRequest();
}
break;
case 'edit':
if ($feedId > 0) {
if ($addCatId > 0 || $c_name != '') {
FreshRSS_feed_Controller::moveFeed($feedId, $addCatId, $c_name);
}
if ($title != '') {
FreshRSS_feed_Controller::renameFeed($feedId, $title);
}
} else {
self::badRequest();
}
break;
}
}
}
exit('OK');
}
/** @return never */
private static function quickadd(string $url) {
try {
$url = htmlspecialchars($url, ENT_COMPAT, 'UTF-8');
if (str_starts_with($url, 'feed/')) {
$url = substr($url, 5);
}
$feed = FreshRSS_feed_Controller::addFeed($url);
exit(json_encode(array(
'numResults' => 1,
'query' => $feed->url(),
'streamId' => 'feed/' . $feed->id(),
'streamName' => $feed->name(),
), JSON_OPTIONS));
} catch (Exception $e) {
Minz_Log::error('quickadd error: ' . $e->getMessage(), API_LOG);
die(json_encode(array(
'numResults' => 0,
'error' => $e->getMessage(),
), JSON_OPTIONS));
}
}
/** @return never */
private static function unreadCount() {
//http://blog.martindoms.com/2009/10/16/using-the-google-reader-api-part-2/#unread-count
header('Content-Type: application/json; charset=UTF-8');
$totalUnreads = 0;
$totalLastUpdate = 0;
$categoryDAO = FreshRSS_Factory::createCategoryDao();
$feedDAO = FreshRSS_Factory::createFeedDao();
$feedsNewestItemUsec = $feedDAO->listFeedsNewestItemUsec();
foreach ($categoryDAO->listCategories(true, true) ?: [] as $cat) {
$catLastUpdate = 0;
foreach ($cat->feeds() as $feed) {
$lastUpdate = $feedsNewestItemUsec['f_' . $feed->id()] ?? 0;
$unreadcounts[] = array(
'id' => 'feed/' . $feed->id(),
'count' => $feed->nbNotRead(),
'newestItemTimestampUsec' => '' . $lastUpdate,
);
if ($catLastUpdate < $lastUpdate) {
$catLastUpdate = $lastUpdate;
}
}
$unreadcounts[] = array(
'id' => 'user/-/label/' . htmlspecialchars_decode($cat->name(), ENT_QUOTES),
'count' => $cat->nbNotRead(),
'newestItemTimestampUsec' => '' . $catLastUpdate,
);
$totalUnreads += $cat->nbNotRead();
if ($totalLastUpdate < $catLastUpdate) {
$totalLastUpdate = $catLastUpdate;
}
}
$tagDAO = FreshRSS_Factory::createTagDao();
$tagsNewestItemUsec = $tagDAO->listTagsNewestItemUsec();
foreach ($tagDAO->listTags(true) ?: [] as $label) {
$lastUpdate = $tagsNewestItemUsec['t_' . $label->id()] ?? 0;
$unreadcounts[] = array(
'id' => 'user/-/label/' . htmlspecialchars_decode($label->name(), ENT_QUOTES),
'count' => $label->nbUnread(),
'newestItemTimestampUsec' => '' . $lastUpdate,
);
}
$unreadcounts[] = array(
'id' => 'user/-/state/com.google/reading-list',
'count' => $totalUnreads,
'newestItemTimestampUsec' => '' . $totalLastUpdate,
);
echo json_encode(array(
'max' => $totalUnreads,
'unreadcounts' => $unreadcounts,
), JSON_OPTIONS), "\n";
exit();
}
/**
* @param array<FreshRSS_Entry> $entries
* @return array<array<string,mixed>>
*/
private static function entriesToArray(array $entries): array {
if (empty($entries)) {
return array();
}
$catDAO = FreshRSS_Factory::createCategoryDao();
$categories = $catDAO->listCategories(true) ?: [];
$tagDAO = FreshRSS_Factory::createTagDao();
$entryIdsTagNames = $tagDAO->getEntryIdsTagNames($entries);
$items = array();
foreach ($entries as $item) {
/** @var FreshRSS_Entry $entry */
$entry = Minz_ExtensionManager::callHook('entry_before_display', $item);
if ($entry == null) {
continue;
}
$feed = FreshRSS_Category::findFeed($categories, $entry->feedId());
if ($feed === null) {
continue;
}
$entry->_feed($feed);
$items[] = $entry->toGReader('compat', $entryIdsTagNames['e_' . $entry->id()] ?? []);
}
return $items;
}
/**
* @param 'A'|'c'|'f'|'s' $type
* @param string|int $streamId
* @phpstan-return array{'A'|'c'|'f'|'s'|'t',int,int,FreshRSS_BooleanSearch}
*/
private static function streamContentsFilters(string $type, $streamId,
string $filter_target, string $exclude_target, int $start_time, int $stop_time): array {
switch ($type) {
case 'f': //feed
if ($streamId != '' && is_string($streamId) && !is_numeric($streamId)) {
$feedDAO = FreshRSS_Factory::createFeedDao();
$streamId = htmlspecialchars($streamId, ENT_COMPAT, 'UTF-8');
$feed = $feedDAO->searchByUrl($streamId);
$streamId = $feed == null ? 0 : $feed->id();
}
break;
case 'c': //category or label
$categoryDAO = FreshRSS_Factory::createCategoryDao();
$streamId = htmlspecialchars((string)$streamId, ENT_COMPAT, 'UTF-8');
$cat = $categoryDAO->searchByName($streamId);
if ($cat != null) {
$type = 'c';
$streamId = $cat->id();
} else {
$tagDAO = FreshRSS_Factory::createTagDao();
$tag = $tagDAO->searchByName($streamId);
if ($tag != null) {
$type = 't';
$streamId = $tag->id();
} else {
$type = 'A';
$streamId = -1;
}
}
break;
}
$streamId = (int)$streamId;
switch ($filter_target) {
case 'user/-/state/com.google/read':
$state = FreshRSS_Entry::STATE_READ;
break;
case 'user/-/state/com.google/unread':
$state = FreshRSS_Entry::STATE_NOT_READ;
break;
case 'user/-/state/com.google/starred':
$state = FreshRSS_Entry::STATE_FAVORITE;
break;
default:
$state = FreshRSS_Entry::STATE_ALL;
break;
}
switch ($exclude_target) {
case 'user/-/state/com.google/read':
$state &= FreshRSS_Entry::STATE_NOT_READ;
break;
case 'user/-/state/com.google/unread':
$state &= FreshRSS_Entry::STATE_READ;
break;
case 'user/-/state/com.google/starred':
$state &= FreshRSS_Entry::STATE_NOT_FAVORITE;
break;
}
$searches = new FreshRSS_BooleanSearch('');
if ($start_time != '') {
$search = new FreshRSS_Search('');
$search->setMinDate($start_time);
$searches->add($search);
}
if ($stop_time != '') {
$search = new FreshRSS_Search('');
$search->setMaxDate($stop_time);
$searches->add($search);
}
return array($type, $streamId, $state, $searches);
}
/** @return never */
private static function streamContents(string $path, string $include_target, int $start_time, int $stop_time, int $count,
string $order, string $filter_target, string $exclude_target, string $continuation) {
//http://code.google.com/p/pyrfeed/wiki/GoogleReaderAPI
//http://blog.martindoms.com/2009/10/16/using-the-google-reader-api-part-2/#feed
header('Content-Type: application/json; charset=UTF-8');
switch ($path) {
case 'starred':
$type = 's';
break;
case 'feed':
$type = 'f';
break;
case 'label':
$type = 'c';
break;
case 'reading-list':
default:
$type = 'A';
break;
}
[$type, $include_target, $state, $searches] =
self::streamContentsFilters($type, $include_target, $filter_target, $exclude_target, $start_time, $stop_time);
if ($continuation != '') {
$count++; //Shift by one element
}
$entryDAO = FreshRSS_Factory::createEntryDao();
$entries = $entryDAO->listWhere($type, $include_target, $state, $order === 'o' ? 'ASC' : 'DESC', $count, 0, $continuation, $searches);
$entries = iterator_to_array($entries); //TODO: Improve
$items = self::entriesToArray($entries);
if ($continuation != '') {
array_shift($items); //Discard first element that was already sent in the previous response
$count--;
}
$response = array(
'id' => 'user/-/state/com.google/reading-list',
'updated' => time(),
'items' => $items,
);
if (count($entries) >= $count) {
$entry = end($entries);
if ($entry != false) {
$response['continuation'] = '' . $entry->id();
}
}
unset($entries, $entryDAO, $items);
gc_collect_cycles();
echoJson($response, 2); // $optimisationDepth=2 as we are interested in being memory efficient for {"items":[...]}
exit();
}
/** @return never */
private static function streamContentsItemsIds(string $streamId, int $start_time, int $stop_time, int $count,
string $order, string $filter_target, string $exclude_target, string $continuation) {
//http://code.google.com/p/google-reader-api/wiki/ApiStreamItemsIds
//http://code.google.com/p/pyrfeed/wiki/GoogleReaderAPI
//http://blog.martindoms.com/2009/10/16/using-the-google-reader-api-part-2/#feed
$type = 'A';
if ($streamId === 'user/-/state/com.google/reading-list') {
$type = 'A';
} elseif ($streamId === 'user/-/state/com.google/starred') {
$type = 's';
} elseif (strpos($streamId, 'feed/') === 0) {
$type = 'f';
$streamId = substr($streamId, 5);
} elseif (strpos($streamId, 'user/-/label/') === 0) {
$type = 'c';
$streamId = substr($streamId, 13);
}
[$type, $id, $state, $searches] = self::streamContentsFilters($type, $streamId, $filter_target, $exclude_target, $start_time, $stop_time);
if ($continuation != '') {
$count++; //Shift by one element
}
$entryDAO = FreshRSS_Factory::createEntryDao();
$ids = $entryDAO->listIdsWhere($type, $id, $state, $order === 'o' ? 'ASC' : 'DESC', $count, 0, $continuation, $searches);
if ($ids === null) {
self::internalServerError();
}
if ($continuation != '') {
array_shift($ids); //Discard first element that was already sent in the previous response
$count--;
}
if (empty($ids) && isset($_GET['client']) && $_GET['client'] === 'newsplus') {
$ids = [ 0 ]; //For News+ bug https://github.com/noinnion/newsplus/issues/84#issuecomment-57834632
}
$itemRefs = array();
foreach ($ids as $entryId) {
$itemRefs[] = array(
'id' => '' . $entryId, //64-bit decimal
);
}
$response = array(
'itemRefs' => $itemRefs,
);
if (count($ids) >= $count) {
$entryId = end($ids);
if ($entryId != false) {
$response['continuation'] = '' . $entryId;
}
}
echo json_encode($response, JSON_OPTIONS), "\n";
exit();
}
/**
* @param array<string> $e_ids
* @return never
*/
private static function streamContentsItems(array $e_ids, string $order) {
header('Content-Type: application/json; charset=UTF-8');
foreach ($e_ids as $i => $e_id) {
// https://feedhq.readthedocs.io/en/latest/api/terminology.html#items
if (!ctype_digit($e_id) || $e_id[0] === '0') {
$e_ids[$i] = hex2dec(basename($e_id)); //Strip prefix 'tag:google.com,2005:reader/item/'
}
}
/** @var array<numeric-string> $e_ids */
$entryDAO = FreshRSS_Factory::createEntryDao();
$entries = $entryDAO->listByIds($e_ids, $order === 'o' ? 'ASC' : 'DESC');
$entries = iterator_to_array($entries); //TODO: Improve
$items = self::entriesToArray($entries);
$response = array(
'id' => 'user/-/state/com.google/reading-list',
'updated' => time(),
'items' => $items,
);
unset($entries, $entryDAO, $items);
gc_collect_cycles();
echoJson($response, 2); // $optimisationDepth=2 as we are interested in being memory efficient for {"items":[...]}
exit();
}
/**
* @param array<string> $e_ids
* @return never
*/
private static function editTag(array $e_ids, string $a, string $r): void {
foreach ($e_ids as $i => $e_id) {
if (!ctype_digit($e_id) || $e_id[0] === '0') {
$e_ids[$i] = hex2dec(basename($e_id)); //Strip prefix 'tag:google.com,2005:reader/item/'
}
}
/** @var array<numeric-string> $e_ids */
$entryDAO = FreshRSS_Factory::createEntryDao();
$tagDAO = FreshRSS_Factory::createTagDao();
switch ($a) {
case 'user/-/state/com.google/read':
$entryDAO->markRead($e_ids, true);
break;
case 'user/-/state/com.google/starred':
$entryDAO->markFavorite($e_ids, true);
break;
/*case 'user/-/state/com.google/tracking-kept-unread':
break;
case 'user/-/state/com.google/like':
break;
case 'user/-/state/com.google/broadcast':
break;*/
default:
$tagName = '';
if (strpos($a, 'user/-/label/') === 0) {
$tagName = substr($a, 13);
} else {
$user = Minz_User::name() ?? '';
$prefix = 'user/' . $user . '/label/';
if (strpos($a, $prefix) === 0) {
$tagName = substr($a, strlen($prefix));
}
}
if ($tagName != '') {
$tagName = htmlspecialchars($tagName, ENT_COMPAT, 'UTF-8');
$tag = $tagDAO->searchByName($tagName);
if ($tag == null) {
$tagDAO->addTag(array('name' => $tagName));
$tag = $tagDAO->searchByName($tagName);
}
if ($tag != null) {
foreach ($e_ids as $e_id) {
$tagDAO->tagEntry($tag->id(), $e_id, true);
}
}
}
break;
}
switch ($r) {
case 'user/-/state/com.google/read':
$entryDAO->markRead($e_ids, false);
break;
case 'user/-/state/com.google/starred':
$entryDAO->markFavorite($e_ids, false);
break;
default:
if (strpos($r, 'user/-/label/') === 0) {
$tagName = substr($r, 13);
$tagName = htmlspecialchars($tagName, ENT_COMPAT, 'UTF-8');
$tag = $tagDAO->searchByName($tagName);
if ($tag != null) {
foreach ($e_ids as $e_id) {
$tagDAO->tagEntry($tag->id(), $e_id, false);
}
}
}
break;
}
exit('OK');
}
/** @return never */
private static function renameTag(string $s, string $dest) {
if ($s != '' && strpos($s, 'user/-/label/') === 0 &&
$dest != '' && strpos($dest, 'user/-/label/') === 0) {
$s = substr($s, 13);
$s = htmlspecialchars($s, ENT_COMPAT, 'UTF-8');
$dest = substr($dest, 13);
$dest = htmlspecialchars($dest, ENT_COMPAT, 'UTF-8');
$categoryDAO = FreshRSS_Factory::createCategoryDao();
$cat = $categoryDAO->searchByName($s);
if ($cat != null) {
$categoryDAO->updateCategory($cat->id(), [
'name' => $dest, 'kind' => $cat->kind(), 'attributes' => $cat->attributes()
]);
exit('OK');
} else {
$tagDAO = FreshRSS_Factory::createTagDao();
$tag = $tagDAO->searchByName($s);
if ($tag != null) {
$tagDAO->updateTagName($tag->id(), $dest);
exit('OK');
}
}
}
self::badRequest();
}
/** @return never */
private static function disableTag(string $s) {
if ($s != '' && strpos($s, 'user/-/label/') === 0) {
$s = substr($s, 13);
$s = htmlspecialchars($s, ENT_COMPAT, 'UTF-8');
$categoryDAO = FreshRSS_Factory::createCategoryDao();
$cat = $categoryDAO->searchByName($s);
if ($cat != null) {
$feedDAO = FreshRSS_Factory::createFeedDao();
$feedDAO->changeCategory($cat->id(), 0);
if ($cat->id() > 1) {
$categoryDAO->deleteCategory($cat->id());
}
exit('OK');
} else {
$tagDAO = FreshRSS_Factory::createTagDao();
$tag = $tagDAO->searchByName($s);
if ($tag != null) {
$tagDAO->deleteTag($tag->id());
exit('OK');
}
}
}
self::badRequest();
}
/**
* @param numeric-string $olderThanId
* @return never
*/
private static function markAllAsRead(string $streamId, string $olderThanId) {
$entryDAO = FreshRSS_Factory::createEntryDao();
if (strpos($streamId, 'feed/') === 0) {
$f_id = basename($streamId);
if (!is_numeric($f_id)) {
self::badRequest();
}
$f_id = (int)$f_id;
$entryDAO->markReadFeed($f_id, $olderThanId);
} elseif (strpos($streamId, 'user/-/label/') === 0) {
$c_name = substr($streamId, 13);
$c_name = htmlspecialchars($c_name, ENT_COMPAT, 'UTF-8');
$categoryDAO = FreshRSS_Factory::createCategoryDao();
$cat = $categoryDAO->searchByName($c_name);
if ($cat != null) {
$entryDAO->markReadCat($cat->id(), $olderThanId);
} else {
$tagDAO = FreshRSS_Factory::createTagDao();
$tag = $tagDAO->searchByName($c_name);
if ($tag != null) {
$entryDAO->markReadTag($tag->id(), $olderThanId);
} else {
self::badRequest();
}
}
} elseif ($streamId === 'user/-/state/com.google/reading-list') {
$entryDAO->markReadEntries($olderThanId, false);
} else {
self::badRequest();
}
exit('OK');
}
/** @return never */
public static function parse() {
global $ORIGINAL_INPUT;
header('Access-Control-Allow-Headers: Authorization');
header('Access-Control-Allow-Methods: GET, POST');
header('Access-Control-Allow-Origin: *');
header('Access-Control-Max-Age: 600');
if (($_SERVER['REQUEST_METHOD'] ?? '') === 'OPTIONS') {
self::noContent();
}
$pathInfo = '';
if (empty($_SERVER['PATH_INFO'])) {
if (!empty($_SERVER['ORIG_PATH_INFO'])) {
// Compatibility https://php.net/reserved.variables.server
$pathInfo = $_SERVER['ORIG_PATH_INFO'];
}
} else {
$pathInfo = $_SERVER['PATH_INFO'];
}
$pathInfo = urldecode($pathInfo);
$pathInfo = '' . preg_replace('%^(/api)?(/greader\.php)?%', '', $pathInfo); //Discard common errors
if ($pathInfo == '' && empty($_SERVER['QUERY_STRING'])) {
exit('OK');
}
$pathInfos = explode('/', $pathInfo);
if (count($pathInfos) < 3) {
self::badRequest();
}
FreshRSS_Context::initSystem();
//Minz_Log::debug('----------------------------------------------------------------', API_LOG);
//Minz_Log::debug(debugInfo(), API_LOG);
if (!FreshRSS_Context::hasSystemConf() || !FreshRSS_Context::systemConf()->api_enabled) {
self::serviceUnavailable();
} elseif ($pathInfos[1] === 'check' && $pathInfos[2] === 'compatibility') {
self::checkCompatibility();
}
Minz_Session::init('FreshRSS', true);
if ($pathInfos[1] !== 'accounts') {
self::authorizationToUser();
}
if (FreshRSS_Context::hasUserConf()) {
Minz_Translate::init(FreshRSS_Context::userConf()->language);
Minz_ExtensionManager::init();
Minz_ExtensionManager::enableByList(FreshRSS_Context::userConf()->extensions_enabled, 'user');
} else {
Minz_Translate::init();
}
if ($pathInfos[1] === 'accounts') {
if (($pathInfos[2] === 'ClientLogin') && isset($_REQUEST['Email']) && isset($_REQUEST['Passwd'])) {
self::clientLogin($_REQUEST['Email'], $_REQUEST['Passwd']);
}
} elseif (isset($pathInfos[3], $pathInfos[4]) && $pathInfos[1] === 'reader' && $pathInfos[2] === 'api' && $pathInfos[3] === '0') {
if (Minz_User::name() === null) {
self::unauthorized();
}
$timestamp = isset($_GET['ck']) ? (int)$_GET['ck'] : 0; //ck=[unix timestamp] : Use the current Unix time here, helps Google with caching.
switch ($pathInfos[4]) {
case 'stream':
/* xt=[exclude target] : Used to exclude certain items from the feed.
* For example, using xt=user/-/state/com.google/read will exclude items
* that the current user has marked as read, or xt=feed/[feedurl] will
* exclude items from a particular feed (obviously not useful in this
* request, but xt appears in other listing requests). */
$exclude_target = $_GET['xt'] ?? '';
$filter_target = $_GET['it'] ?? '';
//n=[integer] : The maximum number of results to return.
$count = isset($_GET['n']) ? (int)$_GET['n'] : 20;
//r=[d|n|o] : Sort order of item results. d or n gives items in descending date order, o in ascending order.
$order = $_GET['r'] ?? 'd';
/* ot=[unix timestamp] : The time from which you want to retrieve
* items. Only items that have been crawled by Google Reader after
* this time will be returned. */
$start_time = isset($_GET['ot']) ? (int)$_GET['ot'] : 0;
$stop_time = isset($_GET['nt']) ? (int)$_GET['nt'] : 0;
/* Continuation token. If a StreamContents response does not represent
* all items in a timestamp range, it will have a continuation attribute.
* The same request can be re-issued with the value of that attribute put
* in this parameter to get more items */
$continuation = isset($_GET['c']) ? trim($_GET['c']) : '';
if (!ctype_digit($continuation)) {
$continuation = '';
}
if (isset($pathInfos[5]) && $pathInfos[5] === 'contents') {
if (!isset($pathInfos[6]) && isset($_GET['s'])) {
// Compatibility BazQux API https://github.com/bazqux/bazqux-api#fetching-streams
$streamIdInfos = explode('/', $_GET['s']);
foreach ($streamIdInfos as $streamIdInfo) {
$pathInfos[] = $streamIdInfo;
}
}
if (isset($pathInfos[6]) && isset($pathInfos[7])) {
if ($pathInfos[6] === 'feed') {
$include_target = $pathInfos[7];
if ($include_target != '' && !is_numeric($include_target)) {
$include_target = empty($_SERVER['REQUEST_URI']) ? '' : $_SERVER['REQUEST_URI'];
if (preg_match('#/reader/api/0/stream/contents/feed/([A-Za-z0-9\'!*()%$_.~+-]+)#', $include_target, $matches) === 1) {
$include_target = urldecode($matches[1]);
} else {
$include_target = '';
}
}
self::streamContents($pathInfos[6], $include_target, $start_time, $stop_time,
$count, $order, $filter_target, $exclude_target, $continuation);
} elseif (isset($pathInfos[8], $pathInfos[9]) && $pathInfos[6] === 'user') {
if ($pathInfos[8] === 'state') {
if ($pathInfos[9] === 'com.google' && isset($pathInfos[10])) {
if ($pathInfos[10] === 'reading-list' || $pathInfos[10] === 'starred') {
$include_target = '';
self::streamContents($pathInfos[10], $include_target, $start_time, $stop_time, $count, $order,
$filter_target, $exclude_target, $continuation);
}
}
} elseif ($pathInfos[8] === 'label') {
$include_target = $pathInfos[9];
self::streamContents($pathInfos[8], $include_target, $start_time, $stop_time,
$count, $order, $filter_target, $exclude_target, $continuation);
}
}
} else { //EasyRSS, FeedMe
$include_target = '';
self::streamContents('reading-list', $include_target, $start_time, $stop_time,
$count, $order, $filter_target, $exclude_target, $continuation);
}
} elseif ($pathInfos[5] === 'items') {
if ($pathInfos[6] === 'ids' && isset($_GET['s'])) {
/* StreamId for which to fetch the item IDs. The parameter may
* be repeated to fetch the item IDs from multiple streams at once
* (more efficient from a backend perspective than multiple requests). */
$streamId = $_GET['s'];
self::streamContentsItemsIds($streamId, $start_time, $stop_time, $count, $order, $filter_target, $exclude_target, $continuation);
} elseif ($pathInfos[6] === 'contents' && isset($_POST['i'])) { //FeedMe
$e_ids = multiplePosts('i'); //item IDs
self::streamContentsItems($e_ids, $order);
}
}
break;
case 'tag':
if (isset($pathInfos[5]) && $pathInfos[5] === 'list') {
$output = $_GET['output'] ?? '';
if ($output !== 'json') self::notImplemented();
self::tagList();
}
break;
case 'subscription':
if (isset($pathInfos[5])) {
switch ($pathInfos[5]) {
case 'export':
self::subscriptionExport();
// Always exits
case 'import':
if (isset($_SERVER['REQUEST_METHOD']) && $_SERVER['REQUEST_METHOD'] === 'POST' && $ORIGINAL_INPUT != '') {
self::subscriptionImport($ORIGINAL_INPUT);
}
break;
case 'list':
$output = $_GET['output'] ?? '';
if ($output !== 'json') self::notImplemented();
self::subscriptionList();
// Always exits
case 'edit':
if (isset($_REQUEST['s'], $_REQUEST['ac'])) {
//StreamId to operate on. The parameter may be repeated to edit multiple subscriptions at once
$streamNames = empty($_POST['s']) && isset($_GET['s']) ? array($_GET['s']) : multiplePosts('s');
/* Title to use for the subscription. For the `subscribe` action,
* if not specified then the feed’s current title will be used. Can
* be used with the `edit` action to rename a subscription */
$titles = empty($_POST['t']) && isset($_GET['t']) ? array($_GET['t']) : multiplePosts('t');
$action = $_REQUEST['ac']; //Action to perform on the given StreamId. Possible values are `subscribe`, `unsubscribe` and `edit`
$add = $_REQUEST['a'] ?? ''; //StreamId to add the subscription to (generally a user label)
$remove = $_REQUEST['r'] ?? ''; //StreamId to remove the subscription from (generally a user label)
self::subscriptionEdit($streamNames, $titles, $action, $add, $remove);
}
break;
case 'quickadd': //https://github.com/theoldreader/api
if (isset($_REQUEST['quickadd'])) {
self::quickadd($_REQUEST['quickadd']);
}
break;
}
}
break;
case 'unread-count':
$output = $_GET['output'] ?? '';
if ($output !== 'json') self::notImplemented();
self::unreadCount();
// Always exits
case 'edit-tag': //http://blog.martindoms.com/2010/01/20/using-the-google-reader-api-part-3/
$token = isset($_POST['T']) ? trim($_POST['T']) : '';
self::checkToken(FreshRSS_Context::userConf(), $token);
$a = $_POST['a'] ?? ''; //Add: user/-/state/com.google/read user/-/state/com.google/starred
$r = $_POST['r'] ?? ''; //Remove: user/-/state/com.google/read user/-/state/com.google/starred
$e_ids = multiplePosts('i'); //item IDs
self::editTag($e_ids, $a, $r);
// Always exits
case 'rename-tag': //https://github.com/theoldreader/api
$token = isset($_POST['T']) ? trim($_POST['T']) : '';
self::checkToken(FreshRSS_Context::userConf(), $token);
$s = $_POST['s'] ?? ''; //user/-/label/Folder
$dest = $_POST['dest'] ?? ''; //user/-/label/NewFolder
self::renameTag($s, $dest);
// Always exits
case 'disable-tag': //https://github.com/theoldreader/api
$token = isset($_POST['T']) ? trim($_POST['T']) : '';
self::checkToken(FreshRSS_Context::userConf(), $token);
$s_s = multiplePosts('s');
foreach ($s_s as $s) {
self::disableTag($s); //user/-/label/Folder
}
// Always exits
case 'mark-all-as-read':
$token = isset($_POST['T']) ? trim($_POST['T']) : '';
self::checkToken(FreshRSS_Context::userConf(), $token);
$streamId = trim($_POST['s'] ?? '');
$ts = trim($_POST['ts'] ?? '0'); //Older than timestamp in nanoseconds
if (!ctype_digit($ts)) {
self::badRequest();
}
self::markAllAsRead($streamId, $ts);
// Always exits
case 'token':
self::token(FreshRSS_Context::userConf());
// Always exits
case 'user-info':
self::userInfo();
// Always exits
}
}
self::badRequest();
}
}
GReaderAPI::parse();
wget 'https://lists2.roe3.org/FreshRSS/p/api/pshb.php'<?php
declare(strict_types=1);
require(__DIR__ . '/../../constants.php');
require(LIB_PATH . '/lib_rss.php'); //Includes class autoloader
const MAX_PAYLOAD = 3_145_728;
header('Content-Type: text/plain; charset=UTF-8');
header('X-Content-Type-Options: nosniff');
$ORIGINAL_INPUT = file_get_contents('php://input', false, null, 0, MAX_PAYLOAD) ?: '';
FreshRSS_Context::initSystem();
if (!FreshRSS_Context::hasSystemConf()) {
header('HTTP/1.1 500 Internal Server Error');
die('Invalid system init!');
}
FreshRSS_Context::systemConf()->auth_type = 'none'; // avoid necessity to be logged in (not saved!)
//Minz_Log::debug(print_r(array('_SERVER' => $_SERVER, '_GET' => $_GET, '_POST' => $_POST, 'INPUT' => $ORIGINAL_INPUT), true), PSHB_LOG);
$key = isset($_GET['k']) ? substr($_GET['k'], 0, 128) : '';
if (!ctype_xdigit($key)) {
header('HTTP/1.1 422 Unprocessable Entity');
die('Invalid feed key format!');
}
chdir(PSHB_PATH);
$canonical = @file_get_contents('keys/' . $key . '.txt');
if ($canonical === false) {
if (!empty($_REQUEST['hub_mode']) && $_REQUEST['hub_mode'] === 'unsubscribe') {
Minz_Log::warning('Warning: Accept unknown unsubscribe', PSHB_LOG);
header('Connection: close');
exit($_REQUEST['hub_challenge'] ?? '');
}
// https://github.com/w3c/websub/issues/106 , https://w3c.github.io/websub/#content-distribution
header('HTTP/1.1 410 Gone');
Minz_Log::warning('Warning: Feed key not found!: ' . $key, PSHB_LOG);
die('Feed key not found!');
}
$canonical = trim($canonical);
$canonicalHash = sha1($canonical);
$hubFile = @file_get_contents('feeds/' . $canonicalHash . '/!hub.json');
if ($hubFile === false) {
header('HTTP/1.1 410 Gone');
unlink('keys/' . $key . '.txt');
Minz_Log::error('Error: Feed info not found!: ' . $canonical, PSHB_LOG);
die('Feed info not found!');
}
$hubJson = json_decode($hubFile, true);
if (!is_array($hubJson) || empty($hubJson['key']) || $hubJson['key'] !== $key) {
header('HTTP/1.1 500 Internal Server Error');
Minz_Log::error('Error: Invalid key cross-check!: ' . $key, PSHB_LOG);
die('Invalid key cross-check!');
}
chdir('feeds/' . $canonicalHash);
$users = glob('*.txt', GLOB_NOSORT);
if (empty($users)) {
header('HTTP/1.1 410 Gone');
Minz_Log::warning('Warning: Nobody subscribes to this feed anymore!: ' . $canonical, PSHB_LOG);
unlink('../../keys/' . $key . '.txt');
$feed = new FreshRSS_Feed($canonical);
$feed->pubSubHubbubSubscribe(false);
unlink('!hub.json');
chdir('..');
recursive_unlink('feeds/' . $canonicalHash);
die('Nobody subscribes to this feed anymore!');
}
if (!empty($_REQUEST['hub_mode']) && $_REQUEST['hub_mode'] === 'subscribe') {
$leaseSeconds = empty($_REQUEST['hub_lease_seconds']) ? 0 : (int)$_REQUEST['hub_lease_seconds'];
if ($leaseSeconds > 60) {
$hubJson['lease_end'] = time() + $leaseSeconds;
} else {
unset($hubJson['lease_end']);
}
$hubJson['lease_start'] = time();
if (!isset($hubJson['error'])) {
$hubJson['error'] = true; //Do not assume that WebSub works until the first successful push
}
file_put_contents('./!hub.json', json_encode($hubJson));
header('Connection: close');
exit($_REQUEST['hub_challenge'] ?? '');
}
if (!empty($_REQUEST['hub_mode']) && $_REQUEST['hub_mode'] === 'unsubscribe') {
if (empty($hubJson['lease_end']) || $hubJson['lease_end'] < time()) {
header('Connection: close');
exit($_REQUEST['hub_challenge'] ?? '');
} else {
header('HTTP/1.1 422 Unprocessable Entity');
die('We did not ask to unsubscribe!');
}
}
if ($ORIGINAL_INPUT == '') {
header('HTTP/1.1 422 Unprocessable Entity');
die('Missing XML payload!');
}
$simplePie = customSimplePie();
$simplePie->set_raw_data($ORIGINAL_INPUT);
$simplePie->init();
unset($ORIGINAL_INPUT);
$links = $simplePie->get_links('self');
$self = $links[0] ?? null;
if ($self !== $canonical) {
//header('HTTP/1.1 422 Unprocessable Entity');
Minz_Log::warning('Warning: Self URL [' . $self . '] does not match registered canonical URL!: ' . $canonical, PSHB_LOG);
//die('Self URL does not match registered canonical URL!');
$self = $canonical;
}
Minz_ExtensionManager::init();
Minz_Translate::init();
$nb = 0;
foreach ($users as $userFilename) {
$username = basename($userFilename, '.txt');
if (!file_exists(USERS_PATH . '/' . $username . '/config.php')) {
Minz_Log::warning('Warning: Removing broken user link: ' . $username . ' for ' . $self, PSHB_LOG);
unlink($userFilename);
continue;
}
try {
FreshRSS_Context::initUser($username);
if (!FreshRSS_Context::hasUserConf() || !FreshRSS_Context::userConf()->enabled) {
Minz_Log::warning('FreshRSS skip disabled user ' . $username);
continue;
}
Minz_ExtensionManager::enableByList(FreshRSS_Context::userConf()->extensions_enabled, 'user');
Minz_Translate::reset(FreshRSS_Context::userConf()->language);
[$nbUpdatedFeeds, ] = FreshRSS_feed_Controller::actualizeFeedsAndCommit(null, $self, null, $simplePie);
if ($nbUpdatedFeeds > 0) {
$nb++;
} else {
Minz_Log::warning('Warning: User ' . $username . ' does not subscribe anymore to ' . $self, PSHB_LOG);
unlink($userFilename);
}
} catch (Exception $e) {
Minz_Log::error('Error: ' . $e->getMessage() . ' for user ' . $username . ' and feed ' . $self, PSHB_LOG);
}
}
$simplePie->__destruct(); //http://simplepie.org/wiki/faq/i_m_getting_memory_leaks
unset($simplePie);
if ($nb === 0) {
header('HTTP/1.1 410 Gone');
Minz_Log::warning('Warning: Nobody subscribes to this feed anymore after all!: ' . $self, PSHB_LOG);
die('Nobody subscribes to this feed anymore after all!');
} elseif (!empty($hubJson['error'])) {
$hubJson['error'] = false;
file_put_contents('./!hub.json', json_encode($hubJson));
}
Minz_Log::notice('WebSub ' . $self . ' done: ' . $nb, PSHB_LOG);
exit('Done: ' . $nb . "\n");
wget 'https://lists2.roe3.org/FreshRSS/p/api/query.php'<?php
declare(strict_types=1);
require(__DIR__ . '/../../constants.php');
require(LIB_PATH . '/lib_rss.php'); //Includes class autoloader
Minz_Request::init();
$token = Minz_Request::paramString('t');
if (!ctype_alnum($token)) {
header('HTTP/1.1 422 Unprocessable Entity');
header('Content-Type: text/plain; charset=UTF-8');
die('Invalid token `t`!' . $token);
}
$format = Minz_Request::paramString('f');
if (!in_array($format, ['atom', 'greader', 'html', 'json', 'opml', 'rss'], true)) {
header('HTTP/1.1 422 Unprocessable Entity');
header('Content-Type: text/plain; charset=UTF-8');
die('Invalid format `f`!');
}
$user = Minz_Request::paramString('user');
if (!FreshRSS_user_Controller::checkUsername($user)) {
header('HTTP/1.1 422 Unprocessable Entity');
header('Content-Type: text/plain; charset=UTF-8');
die('Invalid user!');
}
Minz_Session::init('FreshRSS', true);
FreshRSS_Context::initSystem();
if (!FreshRSS_Context::hasSystemConf() || !FreshRSS_Context::systemConf()->api_enabled) {
header('HTTP/1.1 503 Service Unavailable');
header('Content-Type: text/plain; charset=UTF-8');
die('Service Unavailable!');
}
FreshRSS_Context::initUser($user);
if (!FreshRSS_Context::hasUserConf() || !FreshRSS_Context::userConf()->enabled) {
usleep(rand(100, 10000)); //Primitive mitigation of scanning for users
header('HTTP/1.1 404 Not Found');
header('Content-Type: text/plain; charset=UTF-8');
die('User not found!');
} else {
usleep(rand(20, 200));
}
if (!file_exists(DATA_PATH . '/no-cache.txt')) {
require(LIB_PATH . '/http-conditional.php');
$dateLastModification = max(
FreshRSS_UserDAO::ctime($user),
FreshRSS_UserDAO::mtime($user),
@filemtime(DATA_PATH . '/config.php') ?: 0
);
// TODO: Consider taking advantage of $feedMode, only for monotonous queries {all, categories, feeds} and not dynamic ones {read/unread, favourites, user labels}
if (httpConditional($dateLastModification ?: time(), 0, 0, false, PHP_COMPRESSION, false)) {
exit(); //No need to send anything
}
}
Minz_Translate::init(FreshRSS_Context::userConf()->language);
Minz_ExtensionManager::init();
Minz_ExtensionManager::enableByList(FreshRSS_Context::userConf()->extensions_enabled, 'user');
$query = null;
$userSearch = null;
foreach (FreshRSS_Context::userConf()->queries as $raw_query) {
if (!empty($raw_query['token']) && $raw_query['token'] === $token) {
switch ($format) {
case 'atom':
case 'greader':
case 'html':
case 'json':
case 'rss':
if (empty($raw_query['shareRss'])) {
continue 2;
}
break;
case 'opml':
if (empty($raw_query['shareOpml'])) {
continue 2;
}
break;
default:
continue 2;
}
$query = new FreshRSS_UserQuery($raw_query, FreshRSS_Context::categories(), FreshRSS_Context::labels());
Minz_Request::_param('get', $query->getGet());
if (Minz_Request::paramString('order') === '') {
Minz_Request::_param('order', $query->getOrder());
}
Minz_Request::_param('state', (string)$query->getState());
$search = $query->getSearch()->getRawInput();
// Note: we disallow references to user queries in public user search to avoid sniffing internal user queries
$userSearch = new FreshRSS_BooleanSearch(Minz_Request::paramString('search'), 0, 'AND', false);
if ($userSearch->getRawInput() !== '') {
if ($search === '') {
$search = $userSearch->getRawInput();
} else {
$search .= ' (' . $userSearch->getRawInput() . ')';
}
}
Minz_Request::_param('search', $search);
break;
}
}
if ($query === null || $userSearch === null) {
usleep(rand(100, 10000));
header('HTTP/1.1 404 Not Found');
header('Content-Type: text/plain; charset=UTF-8');
die('User query not found!');
}
$view = new FreshRSS_View();
try {
FreshRSS_Context::updateUsingRequest(false);
Minz_Request::_param('search', $userSearch->getRawInput()); // Restore user search
$view->entries = FreshRSS_index_Controller::listEntriesByContext();
} catch (Minz_Exception $e) {
Minz_Error::error(400, 'Bad user query!');
die();
}
$get = FreshRSS_Context::currentGet(true);
$type = (string)$get[0];
$id = (int)$get[1];
switch ($type) {
case 'c': // Category
$cat = FreshRSS_Context::categories()[$id] ?? null;
if ($cat === null) {
Minz_Error::error(404, "Category {$id} not found!");
die();
}
$view->categories = [ $cat->id() => $cat ];
break;
case 'f': // Feed
$feed = FreshRSS_Category::findFeed(FreshRSS_Context::categories(), $id);
if ($feed === null) {
Minz_Error::error(404, "Feed {$id} not found!");
die();
}
$view->feeds = [ $feed->id() => $feed ];
$view->categories = [];
break;
default:
$view->categories = FreshRSS_Context::categories();
break;
}
$view->disable_aside = true;
$view->excludeMutedFeeds = true;
$view->internal_rendering = true;
$view->userQuery = $query;
$view->html_url = $query->sharedUrlHtml();
$view->rss_url = $query->sharedUrlRss();
$view->rss_title = $query->getName();
$view->image_url = $query->getImageUrl();
$view->description = $query->getDescription() ?: _t('index.feed.rss_of', $view->rss_title);
if ($query->getName() != '') {
FreshRSS_View::_title($query->getName());
}
FreshRSS_Context::systemConf()->allow_anonymous = true;
header('Access-Control-Allow-Methods: GET');
header('Access-Control-Allow-Origin: *');
header('Access-Control-Max-Age: 600');
header('Cache-Control: public, max-age=60');
if (($_SERVER['REQUEST_METHOD'] ?? '') === 'OPTIONS') {
header('HTTP/1.1 204 No Content');
exit();
}
if (in_array($format, ['rss', 'atom'], true)) {
header('Content-Type: application/rss+xml; charset=utf-8');
$view->_layout(null);
$view->_path('index/rss.phtml');
} elseif (in_array($format, ['greader', 'json'], true)) {
header('Content-Type: application/json; charset=utf-8');
$view->_layout(null);
$view->type = 'query/' . $token;
$view->list_title = $query->getName();
$view->entryIdsTagNames = []; // Do not export user labels for privacy
$view->_path('helpers/export/articles.phtml');
} elseif ($format === 'opml') {
if (!$query->safeForOpml()) {
Minz_Error::error(404, 'OPML not allowed for this user query!');
die();
}
header('Content-Type: application/xml; charset=utf-8');
$view->_layout(null);
$view->_path('index/opml.phtml');
} else {
$view->_layout('layout');
$view->_path('index/html.phtml');
}
$view->build();