Merge remote-tracking branch 'FreshRSS/master' into dev

1 files changed, 14 insertions, 6 deletions

diff --git a/app/Controllers/javascriptController.php b/app/Controllers/javascriptController.php
index 62f413989..00a7b5c38 100755
--- a/app/Controllers/javascriptController.php
+++ b/app/Controllers/javascriptController.php
@@ -6,9 +6,9 @@ class FreshRSS_javascript_Controller extends Minz_ActionController {
 	}
 
 	public function actualizeAction() {
-		header('Content-Type: text/javascript; charset=UTF-8');
+		header('Content-Type: application/json; charset=UTF-8');
 		$feedDAO = FreshRSS_Factory::createFeedDao();
-		$this->view->feeds = $feedDAO->listFeedsOrderUpdate(FreshRSS_Context::$conf->ttl_default);
+		$this->view->feeds = $feedDAO->listFeedsOrderUpdate(FreshRSS_Context::$user_conf->ttl_default);
 	}
 
 	public function nbUnreadsPerFeedAction() {
@@ -28,19 +28,27 @@ class FreshRSS_javascript_Controller extends Minz_ActionController {
 		$user = isset($_GET['user']) ? $_GET['user'] : '';
 		if (ctype_alnum($user)) {
 			try {
-				$conf = new FreshRSS_Configuration($user);
+				$salt = FreshRSS_Context::$system_conf->salt;
+				$conf = get_user_configuration($user);
 				$s = $conf->passwordHash;
 				if (strlen($s) >= 60) {
 					$this->view->salt1 = substr($s, 0, 29);	//CRYPT_BLOWFISH Salt: "$2a$", a two digit cost parameter, "$", and 22 characters from the alphabet "./0-9A-Za-z".
-					$this->view->nonce = sha1(Minz_Configuration::salt() . uniqid(mt_rand(), true));
+					$this->view->nonce = sha1($salt . uniqid(mt_rand(), true));
 					Minz_Session::_param('nonce', $this->view->nonce);
 					return;	//Success
 				}
 			} catch (Minz_Exception $me) {
 				Minz_Log::warning('Nonce failure: ' . $me->getMessage());
 			}
+		} else {
+			Minz_Log::notice('Nonce failure due to invalid username!');
+		}
+		//Failure: Return random data.
+		$this->view->salt1 = sprintf('$2a$%02d$', FreshRSS_user_Controller::BCRYPT_COST);
+		$alphabet = './ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789';
+		for ($i = 22; $i > 0; $i--) {
+			$this->view->salt1 .= $alphabet[rand(0, 63)];
 		}
-		$this->view->nonce = '';	//Failure
-		$this->view->salt1 = '';
+		$this->view->nonce = sha1(rand());
 	}
 }