From c8aa451c768a3d4dfce3d19648f3c8420dedb74c Mon Sep 17 00:00:00 2001 From: Alexandre Alapetite Date: Mon, 24 Mar 2014 20:55:18 +0100 Subject: Minz: remove url_rewriting As suggested https://github.com/marienfressinaud/FreshRSS/issues/163#issuecomment-38478669 At the same time, removes a bunch of (almost) dead code such as Minz_Router (the few remaining lines being moved to Minz_FrontController to avoid a class) Contributes to https://github.com/marienfressinaud/FreshRSS/issues/303 --- lib/Minz/Url.php | 13 +++---------- 1 file changed, 3 insertions(+), 10 deletions(-) (limited to 'lib/Minz/Url.php') diff --git a/lib/Minz/Url.php b/lib/Minz/Url.php index 17f1ddece..af48f00f5 100644 --- a/lib/Minz/Url.php +++ b/lib/Minz/Url.php @@ -5,8 +5,7 @@ */ class Minz_Url { /** - * Affiche une Url formatée selon que l'on utilise l'url_rewriting ou non - * si oui, on cherche dans la table de routage la correspondance pour formater + * Affiche une Url formatée * @param $url l'url à formater définie comme un tableau : * $url['c'] = controller * $url['a'] = action @@ -39,13 +38,7 @@ class Minz_Url { } if ($isArray) { - $router = new Minz_Router (); - - if (Minz_Configuration::useUrlRewriting ()) { - $url_string .= $router->printUriRewrited ($url); - } else { - $url_string .= self::printUri ($url, $encodage); - } + $url_string .= self::printUri ($url, $encodage); } else { $url_string .= $url; } @@ -54,7 +47,7 @@ class Minz_Url { } /** - * Construit l'URI d'une URL sans url rewriting + * Construit l'URI d'une URL * @param l'url sous forme de tableau * @param $encodage pour indiquer comment encoder les & (& ou & pour html) * @return l'uri sous la forme ?key=value&key2=value2 -- cgit v1.2.3 From 27b678203b2a9034312fcb5a0c3f923caa26901f Mon Sep 17 00:00:00 2001 From: Marien Fressinaud Date: Sun, 30 Mar 2014 15:42:32 +0200 Subject: Minz_Url separator is "?" instead of "/?" See https://github.com/marienfressinaud/FreshRSS/pull/426 --- lib/Minz/Url.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'lib/Minz/Url.php') diff --git a/lib/Minz/Url.php b/lib/Minz/Url.php index af48f00f5..e9f9a69ba 100644 --- a/lib/Minz/Url.php +++ b/lib/Minz/Url.php @@ -54,7 +54,7 @@ class Minz_Url { */ private static function printUri ($url, $encodage) { $uri = ''; - $separator = '/?'; + $separator = '?'; if($encodage == 'html') { $and = '&'; -- cgit v1.2.3 From 211569ef85f50891035e3e2645ec0c87badec1e1 Mon Sep 17 00:00:00 2001 From: Alexandre Alapetite Date: Wed, 21 Jan 2015 00:44:26 +0100 Subject: Minz: missing URL key/param encoding Caused searches such as "intitle:&" to fail after paging, and possible XSS vulnerabilities. Discovered during https://github.com/FreshRSS/FreshRSS/issues/754 --- app/layout/header.phtml | 3 +-- app/layout/nav_menu.phtml | 3 +-- lib/Minz/Url.php | 34 +++++++++++++++++----------------- 3 files changed, 19 insertions(+), 21 deletions(-) (limited to 'lib/Minz/Url.php') diff --git a/app/layout/header.phtml b/app/layout/header.phtml index 2b968252b..41a63a565 100644 --- a/app/layout/header.phtml +++ b/app/layout/header.phtml @@ -25,8 +25,7 @@ if (FreshRSS_Auth::accessNeedsAction()) { allow_anonymous) { ?>
- - + diff --git a/app/layout/nav_menu.phtml b/app/layout/nav_menu.phtml index d35a0b5fb..3a755b560 100644 --- a/app/layout/nav_menu.phtml +++ b/app/layout/nav_menu.phtml @@ -156,8 +156,7 @@