diff --git a/miniflux/index.php b/miniflux/index.php index 8a72626..2c53592 100644 --- a/miniflux/index.php +++ b/miniflux/index.php @@ -22,7 +22,7 @@ Router\before(function($action) { if ($action !== 'login' && ! isset($_SESSION['user'])) { - PicoFarad\Response\redirect('?action=login'); + Response\redirect('?action=login'); } Response\csp(array( diff --git a/miniflux/vendor/PicoFeed/Filter.php b/miniflux/vendor/PicoFeed/Filter.php index 2c9454e..65206e4 100644 --- a/miniflux/vendor/PicoFeed/Filter.php +++ b/miniflux/vendor/PicoFeed/Filter.php @@ -55,8 +55,11 @@ class Filter 'http://', 'https://', 'ftp://', - 'mailto://', - '//' + 'mailto:', + '//', + 'data:image/png;base64,', + 'data:image/gif;base64,', + 'data:image/jpg;base64,' ); public $protocol_attributes = array( @@ -169,6 +172,14 @@ class Filter } else if ($this->isAllowedProtocol($value) && ! $this->isBlacklistMedia($value)) { + if ($attribute == 'src' && + isset($attributes['data-src']) && + $this->isAllowedProtocol($attributes['data-src']) && + ! $this->isBlacklistMedia($attributes['data-src'])) { + + $value = $attributes['data-src']; + } + $attr_data .= ' '.$attribute.'="'.$value.'"'; $used_attributes[] = $attribute; } @@ -264,6 +275,8 @@ class Filter public function isRelativePath($value) { + if (strpos($value, 'data:') === 0) return false; + return strpos($value, '://') === false && strpos($value, '//') !== 0; } diff --git a/miniflux/vendor/PicoFeed/Parsers/Rss20.php b/miniflux/vendor/PicoFeed/Parsers/Rss20.php index 7ac6595..bc04d84 100644 --- a/miniflux/vendor/PicoFeed/Parsers/Rss20.php +++ b/miniflux/vendor/PicoFeed/Parsers/Rss20.php @@ -19,8 +19,25 @@ class Rss20 extends Parser $namespaces = $xml->getNamespaces(true); + if ($xml->channel->link->count() > 1) { + + foreach ($xml->channel->link as $xml_link) { + + $link = (string) $xml_link; + + if ($link !== '') { + + $this->url = (string) $link; + break; + } + } + } + else { + + $this->url = (string) $xml->channel->link; + } + $this->title = (string) $xml->channel->title; - $this->url = (string) $xml->channel->link; $this->id = $this->url; $this->updated = isset($xml->channel->pubDate) ? (string) $xml->channel->pubDate : (string) $xml->channel->lastBuildDate; $this->updated = $this->updated ? strtotime($this->updated) : time();