Merge remote-tracking branch 'origin/dev' into beta

7 files changed, 156 insertions, 35 deletions

diff --git a/app/Controllers/configureController.php b/app/Controllers/configureController.php
index 0a403fc2d..70144a8db 100755
--- a/app/Controllers/configureController.php
+++ b/app/Controllers/configureController.php
@@ -66,7 +66,7 @@ class FreshRSS_configure_Controller extends Minz_ActionController {
 		$this->view->feeds = $feedDAO->listFeeds ();
 		$this->view->flux = false;
 
-		Minz_View::prependTitle (Minz_Translate::t ('categories_management') . ' - ');
+		Minz_View::prependTitle (Minz_Translate::t ('categories_management') . ' · ');
 	}
 
 	public function feedAction () {
@@ -133,10 +133,10 @@ class FreshRSS_configure_Controller extends Minz_ActionController {
 					Minz_Request::forward (array ('c' => 'configure', 'a' => 'feed', 'params' => array ('id' => $id)), true);
 				}
 
-				Minz_View::prependTitle (Minz_Translate::t ('rss_feed_management') . ' - ' . $this->view->flux->name () . ' - ');
+				Minz_View::prependTitle (Minz_Translate::t ('rss_feed_management') . ' — ' . $this->view->flux->name () . ' · ');
 			}
 		} else {
-			Minz_View::prependTitle (Minz_Translate::t ('rss_feed_management') . ' - ');
+			Minz_View::prependTitle (Minz_Translate::t ('rss_feed_management') . ' · ');
 		}
 	}
 
@@ -157,7 +157,11 @@ class FreshRSS_configure_Controller extends Minz_ActionController {
 				'scroll' => Minz_Request::param('mark_scroll', false),
 				'reception' => Minz_Request::param('mark_upon_reception', false),
 			));
-			$this->view->conf->_theme(Minz_Request::param('theme', 'default'));
+			$themeId = Minz_Request::param('theme', '');
+			if ($themeId == '') {
+				$themeId = FreshRSS_Themes::defaultTheme;
+			}
+			$this->view->conf->_theme($themeId);
 			$this->view->conf->_topline_read(Minz_Request::param('topline_read', false));
 			$this->view->conf->_topline_favorite(Minz_Request::param('topline_favorite', false));
 			$this->view->conf->_topline_date(Minz_Request::param('topline_date', false));
@@ -185,7 +189,7 @@ class FreshRSS_configure_Controller extends Minz_ActionController {
 
 		$this->view->themes = FreshRSS_Themes::get();
 
-		Minz_View::prependTitle (Minz_Translate::t ('reading_configuration') . ' - ');
+		Minz_View::prependTitle (Minz_Translate::t ('reading_configuration') . ' · ');
 	}
 
 	public function sharingAction () {
@@ -212,7 +216,7 @@ class FreshRSS_configure_Controller extends Minz_ActionController {
 			Minz_Request::forward (array ('c' => 'configure', 'a' => 'sharing'), true);
 		}
 
-		Minz_View::prependTitle (Minz_Translate::t ('sharing_management') . ' - ');
+		Minz_View::prependTitle (Minz_Translate::t ('sharing') . ' · ');
 	}
 
 	public function importExportAction () {
@@ -277,7 +281,7 @@ class FreshRSS_configure_Controller extends Minz_ActionController {
 		// au niveau de la vue, permet de ne pas voir un flux sélectionné dans la liste
 		$this->view->flux = false;
 
-		Minz_View::prependTitle (Minz_Translate::t ('import_export_opml') . ' - ');
+		Minz_View::prependTitle (Minz_Translate::t ('import_export_opml') . ' · ');
 	}
 
 	public function shortcutAction () {
@@ -313,11 +317,11 @@ class FreshRSS_configure_Controller extends Minz_ActionController {
 			Minz_Request::forward (array ('c' => 'configure', 'a' => 'shortcut'), true);
 		}
 
-		Minz_View::prependTitle (Minz_Translate::t ('shortcuts_management') . ' - ');
+		Minz_View::prependTitle (Minz_Translate::t ('shortcuts') . ' · ');
 	}
 
 	public function usersAction() {
-		Minz_View::prependTitle(Minz_Translate::t ('users') . ' - ');
+		Minz_View::prependTitle(Minz_Translate::t ('users') . ' · ');
 	}
 
 	public function archivingAction () {
@@ -339,7 +343,7 @@ class FreshRSS_configure_Controller extends Minz_ActionController {
 			Minz_Request::forward(array('c' => 'configure', 'a' => 'archiving'), true);
 		}
 
-		Minz_View::prependTitle(Minz_Translate::t('archiving_configuration') . ' - ');
+		Minz_View::prependTitle(Minz_Translate::t('archiving_configuration') . ' · ');
 
 		$entryDAO = new FreshRSS_EntryDAO();
 		$this->view->nb_total = $entryDAO->count();
diff --git a/app/Controllers/entryController.php b/app/Controllers/entryController.php
index a24dfe6d6..1756c91e5 100755
--- a/app/Controllers/entryController.php
+++ b/app/Controllers/entryController.php
@@ -10,6 +10,11 @@ class FreshRSS_entry_Controller extends Minz_ActionController {
 		}
 
 		$this->params = array ();
+		$output = Minz_Request::param('output', '');
+		if (($output != '') && ($this->view->conf->view_mode !== $output)) {
+			$this->params['output'] = $output;
+		}
+
 		$this->redirect = false;
 		$ajax = Minz_Request::param ('ajax');
 		if ($ajax) {
@@ -34,13 +39,10 @@ class FreshRSS_entry_Controller extends Minz_ActionController {
 		$this->redirect = true;
 
 		$id = Minz_Request::param ('id');
-		$is_read = Minz_Request::param ('is_read');
 		$get = Minz_Request::param ('get');
 		$nextGet = Minz_Request::param ('nextGet', $get); 
 		$idMax = Minz_Request::param ('idMax', 0);
 
-		$is_read = (bool)$is_read;
-
 		$entryDAO = new FreshRSS_EntryDAO ();
 		if ($id == false) {
 			if (!$get) {
@@ -63,7 +65,7 @@ class FreshRSS_entry_Controller extends Minz_ActionController {
 						break;
 				}
 				if ($nextGet !== 'a') {
-					$this->params = array ('get' => $nextGet);
+					$this->params['get'] = $nextGet;
 				}
 			}
 
@@ -73,6 +75,7 @@ class FreshRSS_entry_Controller extends Minz_ActionController {
 			);
 			Minz_Session::_param ('notification', $notif);
 		} else {
+			$is_read = (bool)(Minz_Request::param ('is_read', true));
 			$entryDAO->markRead ($id, $is_read);
 		}
 	}
@@ -83,7 +86,7 @@ class FreshRSS_entry_Controller extends Minz_ActionController {
 		$id = Minz_Request::param ('id');
 		if ($id) {
 			$entryDAO = new FreshRSS_EntryDAO ();
-			$entryDAO->markFavorite ($id, Minz_Request::param ('is_favorite'));
+			$entryDAO->markFavorite ($id, (bool)(Minz_Request::param ('is_favorite', true)));
 		}
 	}
 
diff --git a/app/Controllers/errorController.php b/app/Controllers/errorController.php
index d1c2f8fec..dc9a2ee25 100644
--- a/app/Controllers/errorController.php
+++ b/app/Controllers/errorController.php
@@ -21,6 +21,6 @@ class FreshRSS_error_Controller extends Minz_ActionController {
 		
 		$this->view->logs = Minz_Request::param ('logs');
 		
-		Minz_View::prependTitle ($this->view->code . ' - ');
+		Minz_View::prependTitle ($this->view->code . ' · ');
 	}
 }
diff --git a/app/Controllers/feedController.php b/app/Controllers/feedController.php
index 2d7c0ab43..c40b3c400 100755
--- a/app/Controllers/feedController.php
+++ b/app/Controllers/feedController.php
@@ -30,8 +30,8 @@ class FreshRSS_feed_Controller extends Minz_ActionController {
 				$cat = $def_cat->id ();
 			}
 
-			$user = Minz_Request::param ('username');
-			$pass = Minz_Request::param ('password');
+			$user = Minz_Request::param ('http_user');
+			$pass = Minz_Request::param ('http_pass');
 			$params = array ();
 
 			$transactionStarted = false;
@@ -164,6 +164,7 @@ class FreshRSS_feed_Controller extends Minz_ActionController {
 		$feedDAO = new FreshRSS_FeedDAO ();
 		$entryDAO = new FreshRSS_EntryDAO ();
 
+		Minz_Session::_param('actualize_feeds', false);
 		$id = Minz_Request::param ('id');
 		$force = Minz_Request::param ('force', false);
 
diff --git a/app/Controllers/indexController.php b/app/Controllers/indexController.php
index 690ca57be..45ded6fd4 100755
--- a/app/Controllers/indexController.php
+++ b/app/Controllers/indexController.php
@@ -46,12 +46,8 @@ class FreshRSS_index_Controller extends Minz_ActionController {
 			// no layout for RSS output
 			$this->view->_useLayout (false);
 			header('Content-Type: application/rss+xml; charset=utf-8');
-		} else {
-			Minz_View::appendScript (Minz_Url::display ('/scripts/shortcut.js?' . @filemtime(PUBLIC_PATH . '/scripts/shortcut.js')));
-
-			if ($output === 'global') {
-				Minz_View::appendScript (Minz_Url::display ('/scripts/global_view.js?' . @filemtime(PUBLIC_PATH . '/scripts/global_view.js')));
-			}
+		} elseif ($output === 'global') {
+			Minz_View::appendScript (Minz_Url::display ('/scripts/global_view.js?' . @filemtime(PUBLIC_PATH . '/scripts/global_view.js')));
 		}
 
 		$this->view->cat_aside = $this->catDAO->listCategories ();
@@ -83,7 +79,7 @@ class FreshRSS_index_Controller extends Minz_ActionController {
 		Minz_View::prependTitle (
 			$this->view->currentName .
 			($this->nb_not_read_cat > 0 ? ' (' . $this->nb_not_read_cat . ')' : '') .
-			' - '
+			' · '
 		);
 
 		// On récupère les différents éléments de filtrage
@@ -204,7 +200,7 @@ class FreshRSS_index_Controller extends Minz_ActionController {
 	}
 
 	public function aboutAction () {
-		Minz_View::prependTitle (Minz_Translate::t ('about') . ' - ');
+		Minz_View::prependTitle (Minz_Translate::t ('about') . ' · ');
 	}
 
 	public function logsAction () {
@@ -215,7 +211,7 @@ class FreshRSS_index_Controller extends Minz_ActionController {
 			);
 		}
 
-		Minz_View::prependTitle (Minz_Translate::t ('logs') . ' - ');
+		Minz_View::prependTitle (Minz_Translate::t ('logs') . ' · ');
 
 		if (Minz_Request::isPost ()) {
 			FreshRSS_LogDAO::truncate();
@@ -290,8 +286,56 @@ class FreshRSS_index_Controller extends Minz_ActionController {
 	}
 
 	public function logoutAction () {
-		$this->view->_useLayout (false);
-		Minz_Session::_param ('mail');
+		$this->view->_useLayout(false);
+		invalidateHttpCache();
+		Minz_Session::_param('currentUser');
+		Minz_Session::_param('mail');
+		Minz_Session::_param('passwordHash');
+	}
+
+	public function formLoginAction () {
+		if (Minz_Request::isPost()) {
+			$ok = false;
+			$nonce = Minz_Session::param('nonce');
+			$username = Minz_Request::param('username', '');
+			$c = Minz_Request::param('challenge', '');
+			if (ctype_alnum($username) && ctype_graph($c) && ctype_alnum($nonce)) {
+				if (!function_exists('password_verify')) {
+					include_once(LIB_PATH . '/password_compat.php');
+				}
+				try {
+					$conf = new FreshRSS_Configuration($username);
+					$s = $conf->passwordHash;
+					$ok = password_verify($nonce . $s, $c);
+					if ($ok) {
+						Minz_Session::_param('currentUser', $username);
+						Minz_Session::_param('passwordHash', $s);
+					} else {
+						Minz_Log::record('Password mismatch for user ' . $username . ', nonce=' . $nonce . ', c=' . $c, Minz_Log::WARNING);
+					}
+				} catch (Minz_Exception $me) {
+					Minz_Log::record('Login failure: ' . $me->getMessage(), Minz_Log::WARNING);
+				}
+			}
+			if (!$ok) {
+				$notif = array(
+					'type' => 'bad',
+					'content' => Minz_Translate::t('invalid_login')
+				);
+				Minz_Session::_param('notification', $notif);
+			}
+			$this->view->_useLayout(false);
+			Minz_Request::forward(array('c' => 'index', 'a' => 'index'), true);
+		}
+		invalidateHttpCache();
+	}
+
+	public function formLogoutAction () {
+		$this->view->_useLayout(false);
 		invalidateHttpCache();
+		Minz_Session::_param('currentUser');
+		Minz_Session::_param('mail');
+		Minz_Session::_param('passwordHash');
+		Minz_Request::forward(array('c' => 'index', 'a' => 'index'), true);
 	}
 }
diff --git a/app/Controllers/javascriptController.php b/app/Controllers/javascriptController.php
index e7e25f656..02e424437 100755
--- a/app/Controllers/javascriptController.php
+++ b/app/Controllers/javascriptController.php
@@ -3,11 +3,44 @@
 class FreshRSS_javascript_Controller extends Minz_ActionController {
 	public function firstAction () {
 		$this->view->_useLayout (false);
-		header('Content-type: text/javascript');
 	}
 
 	public function actualizeAction () {
+		header('Content-Type: text/javascript; charset=UTF-8');
 		$feedDAO = new FreshRSS_FeedDAO ();
 		$this->view->feeds = $feedDAO->listFeeds ();
 	}
+
+	public function nbUnreadsPerFeedAction() {
+		header('Content-Type: application/json; charset=UTF-8');
+		$catDAO = new FreshRSS_CategoryDAO();
+		$this->view->categories = $catDAO->listCategories(true, false);
+	}
+
+	//For Web-form login
+	public function nonceAction() {
+		header('Content-Type: application/json; charset=UTF-8');
+		header('Last-Modified: ' . gmdate('D, d M Y H:i:s \G\M\T'));
+		header('Expires: 0');
+		header('Cache-Control: private, no-cache, no-store, must-revalidate');
+		header('Pragma: no-cache');
+
+		$user = isset($_GET['user']) ? $_GET['user'] : '';
+		if (ctype_alnum($user)) {
+			try {
+				$conf = new FreshRSS_Configuration($user);
+				$s = $conf->passwordHash;
+				if (strlen($s) >= 60) {
+					$this->view->salt1 = substr($s, 0, 29);	//CRYPT_BLOWFISH Salt: "$2a$", a two digit cost parameter, "$", and 22 characters from the alphabet "./0-9A-Za-z".
+					$this->view->nonce = sha1(Minz_Configuration::salt() . uniqid(mt_rand(), true));
+					Minz_Session::_param('nonce', $this->view->nonce);
+					return;	//Success
+				}
+			} catch (Minz_Exception $me) {
+				Minz_Log::record('Login failure: ' . $me->getMessage(), Minz_Log::WARNING);
+			}
+		}
+		$this->view->nonce = '';	//Failure
+		$this->view->salt1 = '';
+	}
 }
diff --git a/app/Controllers/usersController.php b/app/Controllers/usersController.php
index 482e35c3e..a044cd25b 100644
--- a/app/Controllers/usersController.php
+++ b/app/Controllers/usersController.php
@@ -1,6 +1,9 @@
 <?php
 
 class FreshRSS_users_Controller extends Minz_ActionController {
+
+	const BCRYPT_COST = 9;	//Will also have to be computed client side on mobile devices, so do not use a too high cost
+
 	public function firstAction() {
 		if (!$this->view->loginOk) {
 			Minz_Error::error(
@@ -14,13 +17,29 @@ class FreshRSS_users_Controller extends Minz_ActionController {
 		if (Minz_Request::isPost()) {
 			$ok = true;
 
-			$mail = Minz_Request::param('mail_login', false);
-			$this->view->conf->_mail_login($mail);
-			$ok &= $this->view->conf->save();
+			$passwordPlain = Minz_Request::param('passwordPlain', false);
+			if ($passwordPlain != '') {
+				Minz_Request::_param('passwordPlain');	//Discard plain-text password ASAP
+				$_POST['passwordPlain'] = '';
+				if (!function_exists('password_hash')) {
+					include_once(LIB_PATH . '/password_compat.php');
+				}
+				$passwordHash = password_hash($passwordPlain, PASSWORD_BCRYPT, array('cost' => self::BCRYPT_COST));
+				$passwordPlain = '';
+				$passwordHash = preg_replace('/^\$2[xy]\$/', '\$2a\$', $passwordHash);	//Compatibility with bcrypt.js
+				$ok &= ($passwordHash != '');
+				$this->view->conf->_passwordHash($passwordHash);
+			}
+			Minz_Session::_param('passwordHash', $this->view->conf->passwordHash);
 
+			if (Minz_Configuration::isAdmin(Minz_Session::param('currentUser', '_'))) {
+				$this->view->conf->_mail_login(Minz_Request::param('mail_login', false));
+			}
 			$email = $this->view->conf->mail_login;
 			Minz_Session::_param('mail', $email);
 
+			$ok &= $this->view->conf->save();
+
 			if ($email != '') {
 				$personaFile = DATA_PATH . '/persona/' . $email . '.txt';
 				@unlink($personaFile);
@@ -38,8 +57,8 @@ class FreshRSS_users_Controller extends Minz_ActionController {
 				$auth_type = Minz_Request::param('auth_type', 'none');
 				if ($anon != Minz_Configuration::allowAnonymous() ||
 					$auth_type != Minz_Configuration::authType()) {
-					Minz_Configuration::_allowAnonymous($anon);
 					Minz_Configuration::_authType($auth_type);
+					Minz_Configuration::_allowAnonymous($anon);
 					$ok &= Minz_Configuration::writeFile();
 				}
 			}
@@ -76,10 +95,26 @@ class FreshRSS_users_Controller extends Minz_ActionController {
 				$ok &= !file_exists($configPath);
 			}
 			if ($ok) {
+			
+				$passwordPlain = Minz_Request::param('new_user_passwordPlain', false);
+				$passwordHash = '';
+				if ($passwordPlain != '') {
+					Minz_Request::_param('new_user_passwordPlain');	//Discard plain-text password ASAP
+					$_POST['new_user_passwordPlain'] = '';
+					if (!function_exists('password_hash')) {
+						include_once(LIB_PATH . '/password_compat.php');
+					}
+					$passwordHash = password_hash($passwordPlain, PASSWORD_BCRYPT, array('cost' => self::BCRYPT_COST));
+					$passwordPlain = '';
+					$ok &= ($passwordHash != '');
+				}
+				if (empty($passwordHash)) {
+					$passwordHash = '';
+				}
+
 				$new_user_email = filter_var($_POST['new_user_email'], FILTER_VALIDATE_EMAIL);
 				if (empty($new_user_email)) {
 					$new_user_email = '';
-					$ok &= Minz_Configuration::authType() !== 'persona';
 				} else {
 					$personaFile = DATA_PATH . '/persona/' . $new_user_email . '.txt';
 					@unlink($personaFile);
@@ -89,6 +124,7 @@ class FreshRSS_users_Controller extends Minz_ActionController {
 			if ($ok) {
 				$config_array = array(
 					'language' => $new_user_language,
+					'passwordHash' => $passwordHash,
 					'mail_login' => $new_user_email,
 				);
 				$ok &= (file_put_contents($configPath, "<?php\n return " . var_export($config_array, true) . ';') !== false);