New feature: shareable user query (#6052)

* New feature: shareable user query
Share the output of a user query by RSS / HTML / OPML with other people through unique URLs.
Replaces the global admin token, which was the only option (but unsafe) to share RSS outputs with other people.
Also add a new HTML output for people without an RSS reader.

fix https://github.com/FreshRSS/FreshRSS/issues/3066#issuecomment-648977890
fix https://github.com/FreshRSS/FreshRSS/issues/3178#issuecomment-769435504

* Remove unused method

* Fix token saving

* Implement HTML view

* Update i18n for master token

* Revert i18n get_favorite

* Fix missing i18n for user queries from before this PR

* Remove irrelevant tests

* Add link to RSS version

* Fix getGet

* Fix getState

* Fix getSearch

* Alternative getSearch

* Default getOrder

* Explicit default state

* Fix test

* Add OPML sharing

* Remove many redundant SQL queries from original implementation of user queries

* Fix article tags

* Use default user settings

* Prepare public search

* Fixes

* Allow user search on article tags

* Implement user search

* Revert filter bug

* Revert wrong SQL left outer join change

* Implement checkboxes

* Safe check of OPML

* Fix label

* Remove RSS button to favour new sharing method
That sharing button was using a global admin token

* First version of HTTP 304

* Disallow some recusrivity
fix https://github.com/FreshRSS/FreshRSS/issues/6086

* Draft of nav

* Minor httpConditional

* Add support for offset for pagination

* Fix offset pagination

* Fix explicit order ASC

* Add documentation

* Help links i18n

* Note about deprecated master token

* Typo

* Doc about format

1 files changed, 19 insertions, 15 deletions

diff --git a/app/Models/BooleanSearch.php b/app/Models/BooleanSearch.php
index 78b7593b2..dd8b95efb 100644
--- a/app/Models/BooleanSearch.php
+++ b/app/Models/BooleanSearch.php
@@ -16,14 +16,12 @@ class FreshRSS_BooleanSearch {
 	private string $operator;
 
 	/** @param 'AND'|'OR'|'AND NOT' $operator */
-	public function __construct(string $input, int $level = 0, string $operator = 'AND') {
+	public function __construct(string $input, int $level = 0, string $operator = 'AND', bool $allowUserQueries = true) {
 		$this->operator = $operator;
 		$input = trim($input);
 		if ($input === '') {
 			return;
 		}
-		$this->raw_input = $input;
-
 		if ($level === 0) {
 			$input = preg_replace('/:"(.*?)"/', ':"\1"', $input);
 			if (!is_string($input)) {
@@ -34,9 +32,11 @@ class FreshRSS_BooleanSearch {
 				return;
 			}
 
-			$input = $this->parseUserQueryNames($input);
-			$input = $this->parseUserQueryIds($input);
+			$input = $this->parseUserQueryNames($input, $allowUserQueries);
+			$input = $this->parseUserQueryIds($input, $allowUserQueries);
+			$input = trim($input);
 		}
+		$this->raw_input = $input;
 
 		// Either parse everything as a series of BooleanSearch’s combined by implicit AND
 		// or parse everything as a series of Search’s combined by explicit OR
@@ -46,7 +46,7 @@ class FreshRSS_BooleanSearch {
 	/**
 	 * Parse the user queries (saved searches) by name and expand them in the input string.
 	 */
-	private function parseUserQueryNames(string $input): string {
+	private function parseUserQueryNames(string $input, bool $allowUserQueries = true): string {
 		$all_matches = [];
 		if (preg_match_all('/\bsearch:(?P<delim>[\'"])(?P<search>.*)(?P=delim)/U', $input, $matchesFound)) {
 			$all_matches[] = $matchesFound;
@@ -60,7 +60,7 @@ class FreshRSS_BooleanSearch {
 			/** @var array<string,FreshRSS_UserQuery> */
 			$queries = [];
 			foreach (FreshRSS_Context::userConf()->queries as $raw_query) {
-				$query = new FreshRSS_UserQuery($raw_query);
+				$query = new FreshRSS_UserQuery($raw_query, FreshRSS_Context::categories(), FreshRSS_Context::labels());
 				$queries[$query->getName()] = $query;
 			}
 
@@ -74,7 +74,11 @@ class FreshRSS_BooleanSearch {
 					$name = trim($matches['search'][$i]);
 					if (!empty($queries[$name])) {
 						$fromS[] = $matches[0][$i];
-						$toS[] = '(' . trim($queries[$name]->getSearch()->getRawInput()) . ')';
+						if ($allowUserQueries) {
+							$toS[] = '(' . trim($queries[$name]->getSearch()->getRawInput()) . ')';
+						} else {
+							$toS[] = '';
+						}
 					}
 				}
 			}
@@ -87,7 +91,7 @@ class FreshRSS_BooleanSearch {
 	/**
 	 * Parse the user queries (saved searches) by ID and expand them in the input string.
 	 */
-	private function parseUserQueryIds(string $input): string {
+	private function parseUserQueryIds(string $input, bool $allowUserQueries = true): string {
 		$all_matches = [];
 
 		if (preg_match_all('/\bS:(?P<search>\d+)/', $input, $matchesFound)) {
@@ -95,14 +99,10 @@ class FreshRSS_BooleanSearch {
 		}
 
 		if (!empty($all_matches)) {
-			$category_dao = FreshRSS_Factory::createCategoryDao();
-			$feed_dao = FreshRSS_Factory::createFeedDao();
-			$tag_dao = FreshRSS_Factory::createTagDao();
-
 			/** @var array<string,FreshRSS_UserQuery> */
 			$queries = [];
 			foreach (FreshRSS_Context::userConf()->queries as $raw_query) {
-				$query = new FreshRSS_UserQuery($raw_query, $feed_dao, $category_dao, $tag_dao);
+				$query = new FreshRSS_UserQuery($raw_query, FreshRSS_Context::categories(), FreshRSS_Context::labels());
 				$queries[] = $query;
 			}
 
@@ -117,7 +117,11 @@ class FreshRSS_BooleanSearch {
 					$id = (int)(trim($matches['search'][$i])) - 1;
 					if (!empty($queries[$id])) {
 						$fromS[] = $matches[0][$i];
-						$toS[] = '(' . trim($queries[$id]->getSearch()->getRawInput()) . ')';
+						if ($allowUserQueries) {
+							$toS[] = '(' . trim($queries[$id]->getSearch()->getRawInput()) . ')';
+						} else {
+							$toS[] = '';
+						}
 					}
 				}
 			}