From 39cc1c11ec596176e842cc98e6a54337e3c04d7e Mon Sep 17 00:00:00 2001
From: Alexandre Alapetite <alexandre@alapetite.fr>
Date: Mon, 26 Feb 2024 09:01:03 +0100
Subject: New feature: shareable user query  (#6052)

* New feature: shareable user query
Share the output of a user query by RSS / HTML / OPML with other people through unique URLs.
Replaces the global admin token, which was the only option (but unsafe) to share RSS outputs with other people.
Also add a new HTML output for people without an RSS reader.

fix https://github.com/FreshRSS/FreshRSS/issues/3066#issuecomment-648977890
fix https://github.com/FreshRSS/FreshRSS/issues/3178#issuecomment-769435504

* Remove unused method

* Fix token saving

* Implement HTML view

* Update i18n for master token

* Revert i18n get_favorite

* Fix missing i18n for user queries from before this PR

* Remove irrelevant tests

* Add link to RSS version

* Fix getGet

* Fix getState

* Fix getSearch

* Alternative getSearch

* Default getOrder

* Explicit default state

* Fix test

* Add OPML sharing

* Remove many redundant SQL queries from original implementation of user queries

* Fix article tags

* Use default user settings

* Prepare public search

* Fixes

* Allow user search on article tags

* Implement user search

* Revert filter bug

* Revert wrong SQL left outer join change

* Implement checkboxes

* Safe check of OPML

* Fix label

* Remove RSS button to favour new sharing method
That sharing button was using a global admin token

* First version of HTTP 304

* Disallow some recusrivity
fix https://github.com/FreshRSS/FreshRSS/issues/6086

* Draft of nav

* Minor httpConditional

* Add support for offset for pagination

* Fix offset pagination

* Fix explicit order ASC

* Add documentation

* Help links i18n

* Note about deprecated master token

* Typo

* Doc about format
---
 lib/Minz/Request.php | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

(limited to 'lib')

diff --git a/lib/Minz/Request.php b/lib/Minz/Request.php
index 9bf1ff4fb..662dc6db9 100644
--- a/lib/Minz/Request.php
+++ b/lib/Minz/Request.php
@@ -162,11 +162,11 @@ class Minz_Request {
 	 * Setteurs
 	 */
 	public static function _controllerName(string $controller_name): void {
-		self::$controller_name = $controller_name;
+		self::$controller_name = ctype_alnum($controller_name) ? $controller_name : '';
 	}
 
 	public static function _actionName(string $action_name): void {
-		self::$action_name = $action_name;
+		self::$action_name = ctype_alnum($action_name) ? $action_name : '';
 	}
 
 	/** @param array<string,string> $params */
@@ -187,6 +187,7 @@ class Minz_Request {
 	 * Initialise la Request
 	 */
 	public static function init(): void {
+		self::_params($_GET);
 		self::initJSON();
 	}
 
-- 
cgit v1.2.3