852613dece
Merge pull request #100 from virtualtam/daily-timestamp
...
daily: display link timestamps
2015-01-26 13:40:37 +01:00
04751e0441
w3c: fix HTML syntax errors
...
Fixes #64
All pages:
- add `urlencode` when passing the version to a custom stylesheet;
- set meaningful values of `alt` and `title` for QR-Code images.
Install page:
- the form's `action` attribute must be non-empty;
- the `valign` attribute is deprecated.
Signed-off-by: VirtualTam <virtualtam@flibidi.org>
2015-01-20 02:53:53 +01:00
38a2d03e34
daily: display link timestamps
...
Fixes #26
Signed-off-by: VirtualTam <virtualtam@flibidi.org>
2015-01-15 00:05:26 +01:00
2f32d0746b
Fixes Port/server config problems - see: https://github.com/shaarli/Shaarli/issues/17
...
* Use SERVER_NAME instead of HTTP_HOST to define current URL (in serverUrl()
* Use SERVER_NAME instead of HTTP_HOST while setting up cookies
2015-01-09 11:46:25 +01:00
fe16b01edb
* removed the language attribute on the script element since it is obsolete and we can safely omit it.
...
* make QRCode JS works with IE :
* behave as a normal link if canvas aren't supported (<=IE8)
* default parameter values in JS aren't widely supported (see: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Functions/Default_parameters ), use this method instead: http://stackoverflow.com/a/148918/1484919
* dataset isn't supported in IE9 use getAttribute instead
* addEventListener works with IE9+ and other browsers
2015-01-09 09:47:48 +01:00
657837af11
Redirect to home page after deleting a link
...
Fixes issue 87
2015-01-04 15:19:14 -05:00
f8d83b35b6
Merge pull request #85 from nodiscc/tagcloud-scaling
...
improve tag cloud font size scaling
2014-12-29 03:00:25 +01:00
1e3b2740e5
improve tag cloud font size scaling
...
* use logarithmic scales
* remove bold style
2014-12-29 02:59:35 +01:00
3259f1a814
Merge pull request #82 from pikzen/fix-search
...
Made tag/title search unicode aware, fixes #75
2014-12-25 01:21:39 +01:00
cae64e52e4
Refactored the daily column generation (only one loop)
2014-12-25 01:10:58 +01:00
2e45fdd8ff
Made tag/title search unicode aware, fixes #75
2014-12-22 16:43:37 +01:00
60b83e7cf7
fix quoting error introduced in 712501812b
2014-12-16 19:52:06 +01:00
509762236b
prevent disclosing PHP version on PHP version check error
...
* fixes https://github.com/shaarli/Shaarli/issues/78
* fixes https://github.com/sebsauvage/Shaarli/issues/214
2014-12-16 19:24:37 +01:00
569be2e8d5
prevent disclosing full path when raising "Shaarli directory not writeable" error
...
* work on https://github.com/shaarli/Shaarli/issues/78
2014-12-16 19:23:36 +01:00
e5aab50ac4
Fix issue #66 by adding space before "selected"
2014-12-02 23:42:23 +01:00
aedc912d36
Prevents ?do=addlink from generating a 404 if the user is not logged in
...
Fixes https://github.com/shaarli/Shaarli/issue/47
2014-11-21 18:31:49 +01:00
732e683bda
Do not add a tag to the search if it's already being searched for
2014-11-21 18:19:37 +01:00
d2f517638c
make archive.org integration optional (ARCHIVE_ORG option, defaults to false)
2014-11-08 18:21:19 +01:00
01ec179148
index.html: add warning message about hostname/cookie storage problems
...
* Fixes https://github.com/sebsauvage/Shaarli/issues/196
* Fixes https://github.com/sebsauvage/Shaarli/issues/97
2014-11-03 13:21:14 +01:00
39e41053ad
Merge pull request #36 from nodiscc/https-thumbnails
...
thumbnails: force HTTPS for youtube, imgur, vimeo
2014-10-23 20:06:29 +02:00
1a663a0f2c
thumbnails: force HTTPS for youtube, imgur, vimeo
...
* other services also provide thumbs over HTTPS, but the rewrite expression is more complex, so left out for now
2014-10-23 18:00:21 +02:00
1099d8fcad
Make ATOM toolbar button optional
...
* ATOM button display is now configurable using the SHOW_ATOM variable in index.php or data/options.php (defaults to false)
* Fixes https://github.com/shaarli/Shaarli/issues/24
2014-10-23 17:47:30 +02:00
b11bc5b6f9
update check: check against last version available on github.com/shaarli/Shaarli
...
* fixes https://github.com/shaarli/Shaarli/issues/5
2014-10-21 18:11:16 +02:00
27646ca5b4
add link: in case of empty URL (self-post), prepend "Note: " to the title
...
* Thanks to qwertygc (https://github.com/shaarli/Shaarli/pull/23 )
* Fix small typo
2014-10-21 16:18:25 +02:00
2f2aa06b95
fix: add missing slash when defining RainTPL's temp dir
...
Signed-off-by: VirtualTam <virtualtam@flibidi.org>
2014-10-19 00:57:41 +02:00
e0cbb07872
Merge pull request #19 from nodiscc/master
...
bookmarklet: use selected text as description when adding a new link
2014-08-19 21:52:36 +02:00
abc98ab39d
Merge pull request #20 from nodiscc/fix-typos
...
Fix grammar, punctuation, spelling, trailing whitepaces and newlines; Fix typo in css
2014-08-19 21:33:53 +02:00
ad6c27b7b8
Fix grammar, punctuation, spelling, trailing whitepaces and newlines; Fix typo in css
...
Based on respencer's work at https://github.com/respencer/Shaarli/
Closes https://github.com/sebsauvage/Shaarli/pull/103
2014-08-19 18:01:15 +02:00
a1795ddcf3
bookmarklet: use selected text as description when adding a new link
...
* Based on romnGit's work at https://github.com/sebsauvage/Shaarli/pull/104
* Fixes https://github.com/shaarli/Shaarli/issues/18
* Closes https://github.com/sebsauvage/Shaarli/pull/104
* Fixes https://github.com/sebsauvage/Shaarli/issues/53
* Fixes https://github.com/sebsauvage/Shaarli/issues/129
* Fixes https://github.com/sebsauvage/Shaarli/issues/33
2014-08-11 00:13:29 +02:00
3bb684f59f
Removes htaccess file creation and adds them in the repository
...
I also removed the previously created placeholders, which after all, have no more utility.
2014-08-04 00:42:49 +02:00
e7416aba2c
Adds empty directories: cache, data, pagecache and tmp. Removes mkdirs.
...
They are still in .gitignore because their future content will still be ignored.
2014-08-04 00:41:55 +02:00
c614a35db8
Removed redundant check on RAINTPL_TMP directory
...
The same test is already on line 93
2014-07-31 23:31:58 +02:00
25f5c59db6
Adds configuration variables, TPL and TMP, for RainTPL
...
The path for templates and temporary files are now part of the configuration.
For a custom install, it's possible to put these writable directories elsewhere than in the read-only source code.
2014-07-31 23:31:58 +02:00
ebb2880dfc
Adds a configuration variable "titleLink" which allows to customize the
...
link on the title.
2014-07-27 23:32:41 +02:00
4ade7393a3
Release version 0.0.42 beta
2014-07-27 22:57:30 +02:00
ae00595b1c
A real "Stay signed in": keep the connection
...
Instead of trusting the php session, it uses a cookie. The php session
sooner or later is distroyed if not used. It depends upon the server
settings. Using a cookie ensures that one really stays signed in.
Dev notes: I wanted to avoid merge conflicts, stay with the main
developper standards and keep the "index.php" in one file. That's why
the code may not be that nice. My own dev level my also explain.
2013-12-05 22:26:04 +01:00
ab0638edb0
Merge pull request #145 from Alkarex/patch-1
...
smallHash: simplified and improved performance
2013-11-29 13:01:08 -08:00
53da201749
XSS flaw correction
...
Closes issue https://github.com/sebsauvage/Shaarli/issues/134
2013-11-29 21:53:20 +01:00
c002ca9c6b
smallHash: simplified and improved performance
...
Unchanged behaviour
2013-11-10 22:50:34 +01:00
7b2186a63e
Corrected field focus in bookmarklet
...
Focus was not properly given to description field when it's empty.
2013-09-27 17:08:31 +02:00
58a8f4cab4
Default example private link changed
...
Default example private link changed from pastebin to ZeroBin.
2013-09-25 10:41:31 +02:00
c677013b93
Added nb=all to get all links in RSS/ATOM feed.
2013-09-24 22:39:40 +02:00
eea58b3d5a
Merge pull request #87 from LionelMartin/3385af123f6b4dfc59aeaa69f180381307b64368
...
Added a json_encode implementation for PHP < 5.2 (free.fr)
2013-09-24 02:20:06 -07:00
3fac0a5257
Added tags+private in shaarli URL
...
Manually merged pull request https://github.com/sebsauvage/Shaarli/pull/99
2013-09-24 11:17:22 +02:00
85c0205876
Merge pull request #112 from BoboTiG/master
...
RSS/Atom: add a parameter to print only the N last links
2013-09-24 02:10:18 -07:00
0b88c6022d
Merge pull request #118 from Alkarex/patch-1
...
Corrected error message for lack of write access in ./data
2013-09-24 02:07:21 -07:00
c4bbb01064
Merge pull request #125 from broncowdd/master
...
Added the possibility to put a description in the bookmarklet's URL
2013-09-24 02:03:26 -07:00
fdc3c114d1
Merge pull request #126 from Alkarex/Milliseconds
...
Import: add compatibility for milliseconds in NETSCAPE-Bookmark
2013-09-24 02:02:33 -07:00
fc93ae1d1a
Import NETSCAPE-Bookmark compatible milliseconds
...
NETSCAPE-Bookmark sometimes contains dates as milliseconds instead of
seconds.
For instance, this is the case of the files gererated for Google +1s by
Google Takeout.
This patch make these files compatible.
2013-09-21 18:15:41 +02:00
3057373a25
Added the possibility to put a description in the bookmarklet's URL
2013-09-16 10:32:02 +02:00
03545ef691
Ajout d’un UA lors de la récupération d’une page externe (certains site veulent un UA)
2013-09-03 15:55:13 +02:00
ff63b7d111
Corrected error message for lack of write access in ./data
2013-08-23 17:02:15 +02:00
002ef0e5c8
Better encoding handling in title parsing
...
Thanks to a patch from Le Hollandais Volant.
2013-08-03 22:10:04 +02:00
f6a6ca0aec
SERVER_NAME changed to HTTP_HOST
...
SERVER_NAME changed to HTTP_HOST because SERVER_NAME can cause problems
on some misconfigured hosts. HTTP_HOST is usually more reliable with
those servers. (cf.
http://stackoverflow.com/questions/2297403/http-host-vs-server-name ).
This should cause less problem on most hosts.
2013-08-03 22:00:09 +02:00
fbd9e52716
RSS/Atom: add a parameter to print only the N last links
2013-07-26 08:57:19 +02:00
3385af123f
Added json_encode implementation for php<5.2
2013-05-20 19:00:28 +02:00
87e3d65023
Merge pull request #42 from matchab/master
...
Timezone par défaut
2013-03-11 01:59:48 -07:00
a908244cc4
Fix bug producing invalid HTML
2013-03-10 19:03:34 +01:00
cb49ab945f
Avoid a strict standard error when php.ini do not define the default
...
timezone.
2013-03-10 14:06:12 +01:00
310f3ca007
Version 0.0.41 beta
2013-03-08 10:14:31 +01:00
75e199d606
Correction for login problem with webkit browsers on sub-domain hosted Shaarli.
2013-03-06 23:31:18 +01:00
979d6334e7
Added second check to write rights.
...
(Because on some hosts is_writable() is not reliable.)
2013-03-04 21:26:06 +01:00
f2cb5f95a9
Check that Shaarli has the right to write in its own directory.
...
Because some user forget to check this at installation.
2013-03-04 21:14:07 +01:00
8a80e4fe07
Got rid of small display bugs before installation.
2013-03-04 21:02:24 +01:00
bb8f712db6
[add] https://github.com/sebsauvage/Shaarli/issues/20 New links created as private by default.
2013-03-04 10:18:39 +01:00
dd064cc315
Added https to list of authorized protocols.
2013-03-03 22:49:10 +01:00
feebc6d466
Corrected vulnerabilities (see report below)
...
Title : Shaarli Vulnerabilities
Author : @erwan_lr | @_WPScan_
Vendor : http://sebsauvage.net/wiki/doku.php?id=php:shaarli
Download : https://github.com/sebsauvage/Shaarli/archive/master.zip |
http://sebsauvage.net/files/shaarli_0.0.40beta.zip
Affected versions : master-705F835, 0.0.40-beta (versions below may also
be vulnerable)
Vulnerabilities : Persistent XSS & Unvalidated Redirects and Forwards
Persistent XSS :
- During the instalation or configuration modification, the title field
is vulnerable. e.g <script>alert(1)</script>
Quotes can not be used because of var_export(), but String.fromCharCode
works
- The url field of a link is vulnerable :
When there is no redirector : javascript:alert(1)
Then, the code is triggered when a user click the url of a link
Or with a classic XSS : "><script>alert(1)</script>
Unvalidated Redirects and Forwards :
A request with the param linksperpage or privateonly can be used to
redirect a user to an arbitrary referer
e.g
GET /Audit/Shaarli/master-705f835/?linksperpage=10 HTTP/1.1
Host: 127.0.0.1
Referer: https://duckduckgo.com
History :
March 2, 2013
- Vendor contacted
2013-03-03 22:15:38 +01:00
705f8355a9
Proper redirect in popup when login fails.
...
This corrects issue https://github.com/sebsauvage/Shaarli/issues/10
2013-03-02 14:07:00 +01:00
858c5c2b43
Added option to disable jQuery and heavy javascript
...
Shaarli uses light Javascript in its normal operation, and some jQuery
for some features (autocomplete in tags, QR-Code popup...).
jQuery can be slow on small computers. An option has been added in
configuration screen to disable javascript features which are hard on
CPU.
(Note that the Picture Wall is awfully heavy *without* jQuery.)
(Side note: A *LOT* of users want Shaarli to work without javasript at
all, if possible. That's why I try to use as few javascript as possible:
It keeps Shaarli pages fast.)
2013-03-01 22:21:10 +01:00
58046a19ae
URL source in cached RSS feeds.
2013-03-01 17:43:20 +01:00
dd62b9ba2a
Sort tags
2013-03-01 17:09:52 +01:00
925f6108ba
Corrected: "Nothing found" when logging out when only private links were displayed.
...
This closes the issues https://github.com/sebsauvage/Shaarli/issues/25
2013-03-01 16:57:34 +01:00
3e0ef647a3
RSS patch for Thunderbird (and some RSS clients).
...
In the RSS specifications, the "link" tags contains the URL to follow,
and the "guid" contains a unique identifier (which may or may not be an
URL).
RSS clients should always use "link" to follow the link (and most do),
but Thunderbird uses the "guid" if it find a valid URL inside (and only
falls back to "link" if "guid" is not an URL).
I have patched the RSS feed so that Thunderbird ignores the URL in guid.
2013-02-28 14:48:11 +01:00
f37664a2b8
Check that sessions work before installation.
...
This is necessary because some hosts do not have a properly set
session.save_path parameter in php config, or do not have write access
to the directory.
2013-02-28 10:37:43 +01:00
a1f5a6ec17
Improved token security
...
...by adding salt. These token are used in form which act on data to
prevent CSRF attacks.
This closes issue https://github.com/sebsauvage/Shaarli/issues/24
2013-02-28 09:19:00 +01:00
9e8209064d
Corrected thumbnail creation.
...
Because some systems do not allow file overwriting when doing a
rename().
2013-02-27 21:24:41 +01:00
b342b2a4c7
After clicking save/cancel on a link, scroll to the link itself.
2013-02-27 18:24:07 +01:00
9e975d86e4
Remove script name from URL if it's index.php
...
(for better looking URLs, eg. http://mysite.com/shaarli/?abcde instead
of http://mysite.com/shaarli/index.php?abcde )
2013-02-27 16:52:32 +01:00
2abd39052d
Link in description & option to invert link/permalink.
...
Patch for issue https://github.com/sebsauvage/Shaarli/issues/19
Now:
* The (perma)link is added at the bottom of description.
* If "permalinks" is added in URL parameters, link/permalinks will be
swapped.
eg.
* Normal link in title + permalink in description:
http://mysite.com/shaarli/?do=rss
* Permalink in title + normal link in description :
http://mysite.com/shaarli/?do=rss&permalinks
It works for the ATOM feed too.
(Happy ? :-D )
2013-02-27 16:39:16 +01:00
30b0672d04
Support for magnet links in description.
2013-02-27 15:49:32 +01:00
64bf914aea
Corrected bug in cache purge.
2013-02-26 16:03:47 +01:00
543e0c7b56
Typo correction.
2013-02-26 15:01:15 +01:00
2d9fab88be
Login problem correction
...
This corrects the session problem with some browsers when Shaarli is
hosted on a sub-domain. Please tell me if this corrects login problems
if you had one.
2013-02-26 14:47:47 +01:00
450342737c
Initial commit (version 0.0.40 beta)
2013-02-26 10:09:41 +01:00
nodiscc
VirtualTam
ArthurHoaro
Emilien Klein
Florian Eula
Sbgodin
Christophe HENRY
Sébastien SAUVAGE
Alexandre Alapetite
Bronco
lehollandaisvolant
BoboTiG
Lionel Martin
David Sferruzza
Mathieu Chabanon
Knah Tsaeb