From 18403d9720c7b3d26881bb6291bf6eb2a9df05d9 Mon Sep 17 00:00:00 2001
From: Alexandre Alapetite <alexandre@alapetite.fr>
Date: Tue, 11 Feb 2014 15:30:52 +0100
Subject: SQL : Supprime c.color
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Implémente décision
https://github.com/marienfressinaud/FreshRSS/issues/295
Install.php pourrait peut-être être mis à jour pour supprimer
automatiquement la colonne, mais ce n'est pas fait dans ce patch.
---
 p/i/install.php | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

(limited to 'p/i/install.php')

diff --git a/p/i/install.php b/p/i/install.php
index 8002a45da..bb49e3fdb 100644
--- a/p/i/install.php
+++ b/p/i/install.php
@@ -44,8 +44,8 @@ UPDATE `%1$sfeed006` f
 INNER JOIN `%1$scategory006` c ON f.category = c.id
 SET f.category2 = c.id2;
 
-INSERT IGNORE INTO `%2$scategory` (name, color)
-SELECT name, color
+INSERT IGNORE INTO `%2$scategory` (name)
+SELECT name
 FROM `%1$scategory006`
 ORDER BY id2;
 
-- 
cgit v1.2.3


From 0cabd1f50dd7d1cf0941a50139e6fbeed6825b4d Mon Sep 17 00:00:00 2001
From: Alexandre Alapetite <alexandre@alapetite.fr>
Date: Tue, 11 Feb 2014 21:48:10 +0100
Subject: Mutex par flux pour les actualisations
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Contribue à https://github.com/marienfressinaud/FreshRSS/issues/351
Nouvelle constante TMP_PATH comme répertoire pour stocker des fichiers
temporaires (si possible en mémoire et non sur disque, tel tmpfs pour
/tmp sur certaines distributions Linux)
Requiert PHP 5.2.1+ (contre 5.2.0 auparavant) pour le
`sys_get_temp_dir()`
---
 README.md                          |  2 +-
 app/Controllers/feedController.php |  5 +++++
 app/Models/Feed.php                | 18 ++++++++++++++++++
 app/actualize_script.php           | 19 -------------------
 constants.php                      |  2 ++
 p/i/install.php                    |  5 +++--
 6 files changed, 29 insertions(+), 22 deletions(-)

(limited to 'p/i/install.php')

diff --git a/README.md b/README.md
index 247d08799..1ed6d8f82 100644
--- a/README.md
+++ b/README.md
@@ -25,7 +25,7 @@ Privilégiez pour cela des demandes sur GitHub
 * Serveur modeste, par exemple sous Linux ou Windows
 	* Fonctionne même sur un Raspberry Pi avec des temps de réponse < 1s (testé sur 150 flux, 22k articles, soit 32Mo de données partiellement compressées)
 * Serveur Web Apache2 ou Nginx (non testé sur les autres)
-* PHP 5.2+ (PHP 5.3.7+ recommandé)
+* PHP 5.2.1+ (PHP 5.3.7+ recommandé)
 	* Requis : [PDO_MySQL](http://php.net/pdo-mysql), [cURL](http://php.net/curl), [LibXML](http://php.net/xml), [PCRE](http://php.net/pcre), [ctype](http://php.net/ctype)
 	* Recommandés : [JSON](http://php.net/json), [zlib](http://php.net/zlib), [mbstring](http://php.net/mbstring), [iconv](http://php.net/iconv)
 * MySQL 5.0.3+ (ou SQLite 3.7.4+ à venir)
diff --git a/app/Controllers/feedController.php b/app/Controllers/feedController.php
index 55e8f76cf..61bfc5919 100755
--- a/app/Controllers/feedController.php
+++ b/app/Controllers/feedController.php
@@ -189,6 +189,10 @@ class FreshRSS_feed_Controller extends Minz_ActionController {
 		$flux_update = 0;
 		$is_read = $this->view->conf->mark_when['reception'] ? 1 : 0;
 		foreach ($feeds as $feed) {
+			if (!$feed->lock()) {
+				Minz_Log::record('Feed already being actualized: ' . $feed->url(), Minz_Log::NOTICE);
+				continue;
+			}
 			try {
 				$url = $feed->url();
 				$feedHistory = $feed->keepHistory();
@@ -251,6 +255,7 @@ class FreshRSS_feed_Controller extends Minz_ActionController {
 				$feedDAO->updateLastUpdate ($feed->id (), 1);
 			}
 
+			$feed->unlock();
 			unset($feed);
 
 			// On arrête à 10 flux pour ne pas surcharger le serveur
diff --git a/app/Models/Feed.php b/app/Models/Feed.php
index e94ae2b3a..73f9c32fb 100644
--- a/app/Models/Feed.php
+++ b/app/Models/Feed.php
@@ -281,4 +281,22 @@ class FreshRSS_Feed extends Minz_Model {
 
 		$this->entries = $entries;
 	}
+
+	function lock() {
+		$lock = TMP_PATH . '/' . md5(Minz_Configuration::salt() . $this->url) . '.freshrss.lock';
+		if (file_exists($lock) && ((time() - @filemtime($lock)) > 3600)) {
+			@unlink($lock);
+		}
+		if (($handle = @fopen($lock, 'x')) === false) {
+			return false;
+		}
+		//register_shutdown_function('unlink', $lock);
+		@fclose($handle);
+		return true;
+	}
+
+	function unlock() {
+		$lock = TMP_PATH . '/' . md5(Minz_Configuration::salt() . $this->url) . '.freshrss.lock';
+		@unlink($lock);
+	}
 }
diff --git a/app/actualize_script.php b/app/actualize_script.php
index bef9bd218..8d81e0189 100755
--- a/app/actualize_script.php
+++ b/app/actualize_script.php
@@ -1,24 +1,5 @@
 <?php
 require(dirname(__FILE__) . '/../constants.php');
-
-//<Mutex>
-$lock = DATA_PATH . '/actualize.lock.txt';
-if (file_exists($lock) && ((time() - @filemtime($lock)) > 3600)) {
-	@unlink($lock);
-}
-if (($handle = @fopen($lock, 'x')) === false) {
-	syslog(LOG_NOTICE, 'FreshRSS actualize already running?');
-	if (defined('STDERR')) {
-		fwrite(STDERR, 'FreshRSS actualize already running?' . "\n");
-	}
-	echo 'FreshRSS actualize already running?', "\n";
-	return;
-}
-register_shutdown_function('unlink', $lock);
-//Could use http://php.net/function.pcntl-signal.php to catch interruptions
-@fclose($handle);
-//</Mutex>
-
 require(LIB_PATH . '/lib_rss.php');	//Includes class autoloader
 
 session_cache_limiter('');
diff --git a/constants.php b/constants.php
index a7c96f47b..4818f1565 100644
--- a/constants.php
+++ b/constants.php
@@ -15,3 +15,5 @@ define('FRESHRSS_PATH', dirname(__FILE__));
 
 	define('LIB_PATH', FRESHRSS_PATH . '/lib');
 		define('APP_PATH', FRESHRSS_PATH . '/app');
+
+define('TMP_PATH', sys_get_temp_dir());
diff --git a/p/i/install.php b/p/i/install.php
index bb49e3fdb..4b0b1d194 100644
--- a/p/i/install.php
+++ b/p/i/install.php
@@ -548,8 +548,9 @@ function checkStep0 () {
 		'all' => $language ? 'ok' : 'ko'
 	);
 }
+
 function checkStep1 () {
-	$php = version_compare (PHP_VERSION, '5.2.0') >= 0;
+	$php = version_compare (PHP_VERSION, '5.2.1') >= 0;
 	$minz = file_exists (LIB_PATH . '/Minz');
 	$curl = extension_loaded ('curl');
 	$pdo = extension_loaded ('pdo_mysql');
@@ -721,7 +722,7 @@ function printStep1 () {
 	<?php if ($res['php'] == 'ok') { ?>
 	<p class="alert alert-success"><span class="alert-head"><?php echo _t ('ok'); ?></span> <?php echo _t ('php_is_ok', PHP_VERSION); ?></p>
 	<?php } else { ?>
-	<p class="alert alert-error"><span class="alert-head"><?php echo _t ('damn'); ?></span> <?php echo _t ('php_is_nok', PHP_VERSION, '5.1.0'); ?></p>
+	<p class="alert alert-error"><span class="alert-head"><?php echo _t ('damn'); ?></span> <?php echo _t ('php_is_nok', PHP_VERSION, '5.2.1'); ?></p>
 	<?php } ?>
 
 	<?php if ($res['minz'] == 'ok') { ?>
-- 
cgit v1.2.3


From ccc8c415f30a70a160cec6bca0f7cdfc7dc471f4 Mon Sep 17 00:00:00 2001
From: Marien Fressinaud <dev@marienfressinaud.fr>
Date: Sat, 15 Feb 2014 14:46:13 +0100
Subject: Style install.php: add alert-warn class to update message

---
 p/i/install.php | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

(limited to 'p/i/install.php')

diff --git a/p/i/install.php b/p/i/install.php
index 4b0b1d194..90ee0b8a9 100644
--- a/p/i/install.php
+++ b/p/i/install.php
@@ -955,7 +955,7 @@ function printStep4 () {
 		<legend><?php echo _t ('version_update'); ?></legend>
 
 		<?php if (updateDatabase(false)) { ?>
-		<p class="alert"><?php echo _t ('update_long'); ?></p>
+		<p class="alert alert-warn"><?php echo _t ('update_long'); ?></p>
 
 		<div class="form-group form-actions">
 			<div class="group-controls">
@@ -965,7 +965,7 @@ function printStep4 () {
 		</div>
 
 		<?php } else { ?>
-		<p class="alert"><?php echo _t ('update_end'); ?></p>
+		<p class="alert alert-warn"><?php echo _t ('update_end'); ?></p>
 
 		<div class="form-group form-actions">
 			<div class="group-controls">
-- 
cgit v1.2.3


From f2a8a516aa44a7862a80e9d75c5df12fcfc2badb Mon Sep 17 00:00:00 2001
From: Alexandre Alapetite <alexandre@alapetite.fr>
Date: Sun, 23 Feb 2014 11:52:37 +0100
Subject: Requiert PHP 5.3.4 pour l'authentification par formulaire
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

https://github.com/marienfressinaud/FreshRSS/issues/432
En attendant de voir si on peut trouver une meilleure solution, si
nécessaire, ou une meilleure documentation
---
 README.md                       | 3 ++-
 app/views/configure/users.phtml | 2 +-
 p/i/install.php                 | 2 +-
 3 files changed, 4 insertions(+), 3 deletions(-)

(limited to 'p/i/install.php')

diff --git a/README.md b/README.md
index 1ed6d8f82..519db7e76 100644
--- a/README.md
+++ b/README.md
@@ -42,7 +42,8 @@ Privilégiez pour cela des demandes sur GitHub
 5. Tout devrait fonctionner :) En cas de problème, n’hésitez pas à me contacter.
 
 # Contrôle d’accès
-Il est requis pour le mode multi-utilisateur, et recommandé dans tous les cas, de limiter l’accès à votre FreshRSS :
+Il est requis pour le mode multi-utilisateur, et recommandé dans tous les cas, de limiter l’accès à votre FreshRSS. Au choix :
+* En utilisant l’identification par formulaire (requiert PHP 5.3.4+ et JavaScript)
 * En utilisant l’identification par [Mozilla Persona](https://login.persona.org/about) incluse dans FreshRSS
 * En utilisant un contrôle d’accès HTTP défini par votre serveur Web
 	* Voir par exemple la [documentation d’Apache sur l’authentification](http://httpd.apache.org/docs/trunk/howto/auth.html)
diff --git a/app/views/configure/users.phtml b/app/views/configure/users.phtml
index 1305feac9..18e4dd091 100644
--- a/app/views/configure/users.phtml
+++ b/app/views/configure/users.phtml
@@ -52,7 +52,7 @@
 					<?php if (!in_array(Minz_Configuration::authType(), array('form', 'persona', 'http_auth', 'none'))) { ?>
 						<option selected="selected"></option>
 					<?php } ?>
-					<option value="form"<?php echo Minz_Configuration::authType() === 'form' ? ' selected="selected"' : '', version_compare(PHP_VERSION, '5.3', '<') ? ' disabled="disabled"' : ''; ?>><?php echo Minz_Translate::t('auth_form'); ?></option>
+					<option value="form"<?php echo Minz_Configuration::authType() === 'form' ? ' selected="selected"' : '', version_compare(PHP_VERSION, '5.3.4', '<') ? ' disabled="disabled"' : ''; ?>><?php echo Minz_Translate::t('auth_form'); ?></option>
 					<option value="persona"<?php echo Minz_Configuration::authType() === 'persona' ? ' selected="selected"' : '', $this->conf->mail_login == '' ? ' disabled="disabled"' : ''; ?>><?php echo Minz_Translate::t('auth_persona'); ?></option>
 					<option value="http_auth"<?php echo Minz_Configuration::authType() === 'http_auth' ? ' selected="selected"' : '', httpAuthUser() == '' ? ' disabled="disabled"' : ''; ?>><?php echo Minz_Translate::t('http_auth'); ?> (REMOTE_USER = '<?php echo httpAuthUser(); ?>')</option>
 					<option value="none"<?php echo Minz_Configuration::authType() === 'none' ? ' selected="selected"' : ''; ?>><?php echo Minz_Translate::t('auth_none'); ?></option>
diff --git a/p/i/install.php b/p/i/install.php
index 90ee0b8a9..dd38fab1f 100644
--- a/p/i/install.php
+++ b/p/i/install.php
@@ -837,7 +837,7 @@ function printStep2 () {
 					<?php if (!in_array($_SESSION['auth_type'], array('form', 'persona', 'http_auth', 'none'))) { ?>
 						<option selected="selected"></option>
 					<?php } ?>
-					<option value="form"<?php echo $_SESSION['auth_type'] === 'form' ? ' selected="selected"' : '', version_compare(PHP_VERSION, '5.3', '<') ? ' disabled="disabled"' : ''; ?>><?php echo _t('auth_form'); ?></option>
+					<option value="form"<?php echo $_SESSION['auth_type'] === 'form' ? ' selected="selected"' : '', version_compare(PHP_VERSION, '5.3.4', '<') ? ' disabled="disabled"' : ''; ?>><?php echo _t('auth_form'); ?></option>
 					<option value="persona"<?php echo $_SESSION['auth_type'] === 'persona' ? ' selected="selected"' : ''; ?>><?php echo _t('auth_persona'); ?></option>
 					<option value="http_auth"<?php echo $_SESSION['auth_type'] === 'http_auth' ? ' selected="selected"' : '', httpAuthUser() == '' ? ' disabled="disabled"' : ''; ?>><?php echo _t('http_auth'); ?> (REMOTE_USER = '<?php echo httpAuthUser(); ?>')</option>
 					<option value="none"<?php echo $_SESSION['auth_type'] === 'none' ? ' selected="selected"' : ''; ?>><?php echo _t('auth_none'); ?></option>
-- 
cgit v1.2.3


From db120b4ed41584c7e33bfe63015f948e6230f1ab Mon Sep 17 00:00:00 2001
From: Alexandre Alapetite <alexandre@alapetite.fr>
Date: Sun, 23 Feb 2014 12:16:23 +0100
Subject: Test si crypt() fonctionne pour PHP 5.3.3

https://github.com/marienfressinaud/FreshRSS/issues/432
---
 README.md                       |  2 +-
 app/views/configure/users.phtml |  2 +-
 lib/lib_rss.php                 | 11 +++++++++++
 p/i/install.php                 |  2 +-
 4 files changed, 14 insertions(+), 3 deletions(-)

(limited to 'p/i/install.php')

diff --git a/README.md b/README.md
index 519db7e76..2b54ff9d5 100644
--- a/README.md
+++ b/README.md
@@ -43,7 +43,7 @@ Privilégiez pour cela des demandes sur GitHub
 
 # Contrôle d’accès
 Il est requis pour le mode multi-utilisateur, et recommandé dans tous les cas, de limiter l’accès à votre FreshRSS. Au choix :
-* En utilisant l’identification par formulaire (requiert PHP 5.3.4+ et JavaScript)
+* En utilisant l’identification par formulaire (requiert JavaScript, et PHP 5.3.7+ recommandé – fonctionne avec certaines versions de PHP5.3.3+)
 * En utilisant l’identification par [Mozilla Persona](https://login.persona.org/about) incluse dans FreshRSS
 * En utilisant un contrôle d’accès HTTP défini par votre serveur Web
 	* Voir par exemple la [documentation d’Apache sur l’authentification](http://httpd.apache.org/docs/trunk/howto/auth.html)
diff --git a/app/views/configure/users.phtml b/app/views/configure/users.phtml
index 18e4dd091..0677db881 100644
--- a/app/views/configure/users.phtml
+++ b/app/views/configure/users.phtml
@@ -52,7 +52,7 @@
 					<?php if (!in_array(Minz_Configuration::authType(), array('form', 'persona', 'http_auth', 'none'))) { ?>
 						<option selected="selected"></option>
 					<?php } ?>
-					<option value="form"<?php echo Minz_Configuration::authType() === 'form' ? ' selected="selected"' : '', version_compare(PHP_VERSION, '5.3.4', '<') ? ' disabled="disabled"' : ''; ?>><?php echo Minz_Translate::t('auth_form'); ?></option>
+					<option value="form"<?php echo Minz_Configuration::authType() === 'form' ? ' selected="selected"' : '', cryptAvailable() ? '' : ' disabled="disabled"'; ?>><?php echo Minz_Translate::t('auth_form'); ?></option>
 					<option value="persona"<?php echo Minz_Configuration::authType() === 'persona' ? ' selected="selected"' : '', $this->conf->mail_login == '' ? ' disabled="disabled"' : ''; ?>><?php echo Minz_Translate::t('auth_persona'); ?></option>
 					<option value="http_auth"<?php echo Minz_Configuration::authType() === 'http_auth' ? ' selected="selected"' : '', httpAuthUser() == '' ? ' disabled="disabled"' : ''; ?>><?php echo Minz_Translate::t('http_auth'); ?> (REMOTE_USER = '<?php echo httpAuthUser(); ?>')</option>
 					<option value="none"<?php echo Minz_Configuration::authType() === 'none' ? ' selected="selected"' : ''; ?>><?php echo Minz_Translate::t('auth_none'); ?></option>
diff --git a/lib/lib_rss.php b/lib/lib_rss.php
index a13d9e951..8c6fb5543 100644
--- a/lib/lib_rss.php
+++ b/lib/lib_rss.php
@@ -233,3 +233,14 @@ function listUsers() {
 function httpAuthUser() {
 	return isset($_SERVER['REMOTE_USER']) ? $_SERVER['REMOTE_USER'] : '';
 }
+
+function cryptAvailable() {
+	if (version_compare(PHP_VERSION, '5.3.3', '>=')) {
+		try {
+			$hash = '$2y$04$usesomesillystringfore7hnbRJHxXVLeakoG8K30oukPsA.ztMG';
+			return $hash === @crypt('password', $hash);
+		} catch (Exception $e) {
+		}
+	}
+	return false;
+}
diff --git a/p/i/install.php b/p/i/install.php
index dd38fab1f..720813323 100644
--- a/p/i/install.php
+++ b/p/i/install.php
@@ -837,7 +837,7 @@ function printStep2 () {
 					<?php if (!in_array($_SESSION['auth_type'], array('form', 'persona', 'http_auth', 'none'))) { ?>
 						<option selected="selected"></option>
 					<?php } ?>
-					<option value="form"<?php echo $_SESSION['auth_type'] === 'form' ? ' selected="selected"' : '', version_compare(PHP_VERSION, '5.3.4', '<') ? ' disabled="disabled"' : ''; ?>><?php echo _t('auth_form'); ?></option>
+					<option value="form"<?php echo $_SESSION['auth_type'] === 'form' ? ' selected="selected"' : '', cryptAvailable() ? '' : ' disabled="disabled"'; ?>><?php echo _t('auth_form'); ?></option>
 					<option value="persona"<?php echo $_SESSION['auth_type'] === 'persona' ? ' selected="selected"' : ''; ?>><?php echo _t('auth_persona'); ?></option>
 					<option value="http_auth"<?php echo $_SESSION['auth_type'] === 'http_auth' ? ' selected="selected"' : '', httpAuthUser() == '' ? ' disabled="disabled"' : ''; ?>><?php echo _t('http_auth'); ?> (REMOTE_USER = '<?php echo httpAuthUser(); ?>')</option>
 					<option value="none"<?php echo $_SESSION['auth_type'] === 'none' ? ' selected="selected"' : ''; ?>><?php echo _t('auth_none'); ?></option>
-- 
cgit v1.2.3


From b07f9157b18bffdb28833ed1363284571be3644e Mon Sep 17 00:00:00 2001
From: Alexandre Alapetite <alexandre@alapetite.fr>
Date: Sun, 2 Mar 2014 13:35:09 +0100
Subject: New unsafe autologin mode

https://github.com/marienfressinaud/FreshRSS/issues/440
---
 app/Controllers/indexController.php | 26 ++++++++++++++++++++++++++
 lib/Minz/Configuration.php          | 14 ++++++++++++++
 p/i/install.php                     |  3 +++
 3 files changed, 43 insertions(+)

(limited to 'p/i/install.php')

diff --git a/app/Controllers/indexController.php b/app/Controllers/indexController.php
index c83c5b630..0905e591a 100755
--- a/app/Controllers/indexController.php
+++ b/app/Controllers/indexController.php
@@ -352,6 +352,32 @@ class FreshRSS_index_Controller extends Minz_ActionController {
 			}
 			$this->view->_useLayout(false);
 			Minz_Request::forward(array('c' => 'index', 'a' => 'index'), true);
+		} elseif (Minz_Configuration::unsafeAutologinEnabled() && isset($_GET['u']) && isset($_GET['p'])) {
+			Minz_Session::_param('currentUser');
+			Minz_Session::_param('mail');
+			Minz_Session::_param('passwordHash');
+			$username = ctype_alnum($_GET['u']) ? $_GET['u'] : '';
+			$passwordPlain = $_GET['p'];
+			Minz_Request::_param('p');	//Discard plain-text password ASAP
+			$_GET['p'] = '';
+			if (!function_exists('password_verify')) {
+				include_once(LIB_PATH . '/password_compat.php');
+			}
+			try {
+				$conf = new FreshRSS_Configuration($username);
+				$s = $conf->passwordHash;
+				$ok = password_verify($passwordPlain, $s);
+				unset($passwordPlain);
+				if ($ok) {
+					Minz_Session::_param('currentUser', $username);
+					Minz_Session::_param('passwordHash', $s);
+				} else {
+					Minz_Log::record('Unsafe password mismatch for user ' . $username, Minz_Log::WARNING);
+				}
+			} catch (Minz_Exception $me) {
+				Minz_Log::record('Unsafe login failure: ' . $me->getMessage(), Minz_Log::WARNING);
+			}
+			Minz_Request::forward(array('c' => 'index', 'a' => 'index'), true);
 		} elseif (!Minz_Configuration::canLogIn()) {
 			Minz_Error::error (
 				403,
diff --git a/lib/Minz/Configuration.php b/lib/Minz/Configuration.php
index ff71d747c..324aae881 100644
--- a/lib/Minz/Configuration.php
+++ b/lib/Minz/Configuration.php
@@ -55,6 +55,7 @@ class Minz_Configuration {
 	private static $allow_anonymous_refresh = false;
 	private static $auth_type = 'none';
 	private static $api_enabled = false;
+	private static $unsafe_autologin_enabled = false;
 
 	private static $db = array (
 		'type' => 'mysql',
@@ -135,6 +136,9 @@ class Minz_Configuration {
 	public static function apiEnabled() {
 		return self::$api_enabled;
 	}
+	public static function unsafeAutologinEnabled() {
+		return self::$unsafe_autologin_enabled;
+	}
 
 	public static function _allowAnonymous($allow = false) {
 		self::$allow_anonymous = ((bool)$allow) && self::canLogIn();
@@ -158,6 +162,9 @@ class Minz_Configuration {
 	public static function _enableApi($value = false) {
 		self::$api_enabled = (bool)$value;
 	}
+	public static function _enableAutologin($value = false) {
+		self::$unsafe_autologin_enabled = (bool)$value;
+	}
 
 	/**
 	 * Initialise les variables de configuration
@@ -188,6 +195,7 @@ class Minz_Configuration {
 				'allow_anonymous_refresh' => self::$allow_anonymous_refresh,
 				'auth_type' => self::$auth_type,
 				'api_enabled' => self::$api_enabled,
+				'unsafe_autologin_enabled' => self::$unsafe_autologin_enabled,
 			),
 			'db' => self::$db,
 		);
@@ -310,6 +318,12 @@ class Minz_Configuration {
 				($general['api_enabled'] !== 'no')
 			);
 		}
+		if (isset ($general['unsafe_autologin_enabled'])) {
+			self::$unsafe_autologin_enabled = (
+				((bool)($general['unsafe_autologin_enabled'])) &&
+				($general['unsafe_autologin_enabled'] !== 'no')
+			);
+		}
 
 		// Base de données
 		if (isset ($ini_array['db'])) {
diff --git a/p/i/install.php b/p/i/install.php
index 720813323..a7563d5ee 100644
--- a/p/i/install.php
+++ b/p/i/install.php
@@ -235,6 +235,9 @@ function saveStep3 () {
 				'default_user' => $_SESSION['default_user'],
 				'auth_type' => $_SESSION['auth_type'],
 				'allow_anonymous' => isset($_SESSION['allow_anonymous']) ? $_SESSION['allow_anonymous'] : false,
+				'allow_anonymous_refresh' => false,
+				'unsafe_autologin_enabled' => false,
+				'api_enabled' => false,
 			),
 			'db' => array(
 				'type' => $_SESSION['bd_type'],
-- 
cgit v1.2.3


From c8aa451c768a3d4dfce3d19648f3c8420dedb74c Mon Sep 17 00:00:00 2001
From: Alexandre Alapetite <alexandre@alapetite.fr>
Date: Mon, 24 Mar 2014 20:55:18 +0100
Subject: Minz: remove url_rewriting

As suggested
https://github.com/marienfressinaud/FreshRSS/issues/163#issuecomment-38478669

At the same time, removes a bunch of (almost) dead code such as
Minz_Router (the few remaining lines being moved to Minz_FrontController
to avoid a class)

Contributes to https://github.com/marienfressinaud/FreshRSS/issues/303
---
 lib/Minz/ActionController.php       |   6 +-
 lib/Minz/Configuration.php          |   9 --
 lib/Minz/Dispatcher.php             |  16 +--
 lib/Minz/FrontController.php        |  43 ++++++--
 lib/Minz/RouteNotFoundException.php |  16 ---
 lib/Minz/Router.php                 | 209 ------------------------------------
 lib/Minz/Url.php                    |  13 +--
 p/i/install.php                     |   1 -
 8 files changed, 40 insertions(+), 273 deletions(-)
 delete mode 100644 lib/Minz/RouteNotFoundException.php
 delete mode 100644 lib/Minz/Router.php

(limited to 'p/i/install.php')

diff --git a/lib/Minz/ActionController.php b/lib/Minz/ActionController.php
index 409d9611f..b47c54554 100644
--- a/lib/Minz/ActionController.php
+++ b/lib/Minz/ActionController.php
@@ -8,16 +8,12 @@
  * La classe ActionController représente le contrôleur de l'application
  */
 class Minz_ActionController {
-	protected $router;
 	protected $view;
 
 	/**
 	 * Constructeur
-	 * @param $controller nom du controller
-	 * @param $action nom de l'action à lancer
 	 */
-	public function __construct ($router) {
-		$this->router = $router;
+	public function __construct () {
 		$this->view = new Minz_View ();
 		$this->view->attributeParams ();
 	}
diff --git a/lib/Minz/Configuration.php b/lib/Minz/Configuration.php
index d905f6ddd..16c8eb727 100644
--- a/lib/Minz/Configuration.php
+++ b/lib/Minz/Configuration.php
@@ -30,7 +30,6 @@ class Minz_Configuration {
 	 * définition des variables de configuration
 	 * $salt une chaîne de caractères aléatoires (obligatoire)
 	 * $environment gère le niveau d'affichage pour log et erreurs
-	 * $use_url_rewriting indique si on utilise l'url_rewriting
 	 * $base_url le chemin de base pour accéder à l'application
 	 * $title le nom de l'application
 	 * $language la langue par défaut de l'application
@@ -43,7 +42,6 @@ class Minz_Configuration {
 	private static $salt = '';
 	private static $environment = Minz_Configuration::PRODUCTION;
 	private static $base_url = '';
-	private static $use_url_rewriting = false;
 	private static $title = '';
 	private static $language = 'en';
 	private static $default_user = '';
@@ -90,9 +88,6 @@ class Minz_Configuration {
 	public static function baseUrl () {
 		return self::$base_url;
 	}
-	public static function useUrlRewriting () {
-		return self::$use_url_rewriting;
-	}
 	public static function title () {
 		return self::$title;
 	}
@@ -176,7 +171,6 @@ class Minz_Configuration {
 		$ini_array = array(
 			'general' => array(
 				'environment' => self::environment(true),
-				'use_url_rewriting' => self::$use_url_rewriting,
 				'salt' => self::$salt,
 				'base_url' => self::$base_url,
 				'title' => self::$title,
@@ -262,9 +256,6 @@ class Minz_Configuration {
 		if (isset ($general['base_url'])) {
 			self::$base_url = $general['base_url'];
 		}
-		if (isset ($general['use_url_rewriting'])) {
-			self::$use_url_rewriting = $general['use_url_rewriting'];
-		}
 
 		if (isset ($general['title'])) {
 			self::$title = $general['title'];
diff --git a/lib/Minz/Dispatcher.php b/lib/Minz/Dispatcher.php
index ca1fd1f5c..f62a92911 100644
--- a/lib/Minz/Dispatcher.php
+++ b/lib/Minz/Dispatcher.php
@@ -16,26 +16,18 @@ class Minz_Dispatcher {
 	private static $instance = null;
 	private static $needsReset;
 
-	private $router;
 	private $controller;
 
 	/**
 	 * Récupère l'instance du Dispatcher
 	 */
-	public static function getInstance ($router) {
+	public static function getInstance () {
 		if (self::$instance === null) {
-			self::$instance = new Minz_Dispatcher ($router);
+			self::$instance = new Minz_Dispatcher ();
 		}
 		return self::$instance;
 	}
 
-	/**
-	 * Constructeur
-	 */
-	private function __construct ($router) {
-		$this->router = $router;
-	}
-
 	/**
 	 * Lance le controller indiqué dans Request
 	 * Remplit le body de Response à partir de la Vue
@@ -58,7 +50,7 @@ class Minz_Dispatcher {
 				$this->controller->lastAction ();
 
 				if (!self::$needsReset) {
-					echo $this->controller->view ()->build ();
+					$this->controller->view ()->build ();
 				}
 			} catch (Minz_Exception $e) {
 				throw $e;
@@ -90,7 +82,7 @@ class Minz_Dispatcher {
 				Minz_Exception::ERROR
 			);
 		}
-		$this->controller = new $controller_name ($this->router);
+		$this->controller = new $controller_name ();
 
 		if (! ($this->controller instanceof Minz_ActionController)) {
 			throw new Minz_ControllerNotActionControllerException (
diff --git a/lib/Minz/FrontController.php b/lib/Minz/FrontController.php
index 3e50db1cf..f13882801 100644
--- a/lib/Minz/FrontController.php
+++ b/lib/Minz/FrontController.php
@@ -24,11 +24,10 @@
  */
 class Minz_FrontController {
 	protected $dispatcher;
-	protected $router;
 
 	/**
 	 * Constructeur
-	 * Initialise le router et le dispatcher
+	 * Initialise le dispatcher, met à jour la Request
 	 */
 	public function __construct () {
 		if (LOG_PATH === false) {
@@ -40,24 +39,46 @@ class Minz_FrontController {
 
 			Minz_Request::init ();
 
-			$this->router = new Minz_Router ();
-			$this->router->init ();
-		} catch (Minz_RouteNotFoundException $e) {
-			Minz_Log::record ($e->getMessage (), Minz_Log::ERROR);
-			Minz_Error::error (
-				404,
-				array ('error' => array ($e->getMessage ()))
+			$url = $this->buildUrl();
+			$url['params'] = array_merge (
+				$url['params'],
+				Minz_Request::fetchPOST ()
 			);
+			Minz_Request::forward ($url);
 		} catch (Minz_Exception $e) {
 			Minz_Log::record ($e->getMessage (), Minz_Log::ERROR);
 			$this->killApp ($e->getMessage ());
 		}
 
-		$this->dispatcher = Minz_Dispatcher::getInstance ($this->router);
+		$this->dispatcher = Minz_Dispatcher::getInstance();
+	}
+
+	/**
+	 * Retourne un tableau représentant l'url passée par la barre d'adresses
+	 * @return tableau représentant l'url
+	 */
+	private function buildUrl() {
+		$url = array ();
+
+		$url['c'] = Minz_Request::fetchGET (
+			'c',
+			Minz_Request::defaultControllerName ()
+		);
+		$url['a'] = Minz_Request::fetchGET (
+			'a',
+			Minz_Request::defaultActionName ()
+		);
+		$url['params'] = Minz_Request::fetchGET ();
+
+		// post-traitement
+		unset ($url['params']['c']);
+		unset ($url['params']['a']);
+
+		return $url;
 	}
 
 	/**
-	 * Démarre l'application (lance le dispatcher et renvoie la réponse
+	 * Démarre l'application (lance le dispatcher et renvoie la réponse)
 	 */
 	public function run () {
 		try {
diff --git a/lib/Minz/RouteNotFoundException.php b/lib/Minz/RouteNotFoundException.php
deleted file mode 100644
index dc4f6fbad..000000000
--- a/lib/Minz/RouteNotFoundException.php
+++ /dev/null
@@ -1,16 +0,0 @@
-<?php
-class Minz_RouteNotFoundException extends Minz_Exception {
-	private $route;
-	
-	public function __construct ($route, $code = self::ERROR) {
-		$this->route = $route;
-		
-		$message = 'Route `' . $route . '` not found';
-		
-		parent::__construct ($message, $code);
-	}
-	
-	public function route () {
-		return $this->route;
-	}
-}
diff --git a/lib/Minz/Router.php b/lib/Minz/Router.php
deleted file mode 100644
index 1ccd72597..000000000
--- a/lib/Minz/Router.php
+++ /dev/null
@@ -1,209 +0,0 @@
-<?php
-/** 
- * MINZ - Copyright 2011 Marien Fressinaud
- * Sous licence AGPL3 <http://www.gnu.org/licenses/>
-*/
-
-/**
- * La classe Router gère le routage de l'application
- * Les routes sont définies dans APP_PATH.'/configuration/routes.php'
- */
-class Minz_Router {
-	const ROUTES_PATH_NAME = '/configuration/routes.php';
-
-	private $routes = array ();
-	
-	/**
-	 * Constructeur
-	 * @exception FileNotExistException si ROUTES_PATH_NAME n'existe pas
-	 *            et que l'on utilise l'url rewriting
-	 */
-	public function __construct () {
-		if (Minz_Configuration::useUrlRewriting ()) {
-			if (file_exists (APP_PATH . self::ROUTES_PATH_NAME)) {
-				$routes = include (
-					APP_PATH . self::ROUTES_PATH_NAME
-				);
-		
-				if (!is_array ($routes)) {
-					$routes = array ();
-				}
-				
-				$this->routes = array_map (
-					array ('Url', 'checkUrl'),
-					$routes
-				);
-			} else {
-				throw new Minz_FileNotExistException (
-					self::ROUTES_PATH_NAME,
-					Minz_Exception::ERROR
-				);
-			}
-		}
-	}
-	
-	/**
-	 * Initialise le Router en déterminant le couple Controller / Action
-	 * Mets à jour la Request
-	 * @exception RouteNotFoundException si l'uri n'est pas présente dans
-	 *          > la table de routage
-	 */
-	public function init () {
-		$url = array ();
-		
-		if (Minz_Configuration::useUrlRewriting ()) {
-			try {
-				$url = $this->buildWithRewriting ();
-			} catch (Minz_RouteNotFoundException $e) {
-				throw $e;
-			}
-		} else {
-			$url = $this->buildWithoutRewriting ();
-		}
-		
-		$url['params'] = array_merge (
-			$url['params'],
-			Minz_Request::fetchPOST ()
-		);
-		
-		Minz_Request::forward ($url);
-	}
-	
-	/**
-	 * Retourne un tableau représentant l'url passée par la barre d'adresses
-	 * Ne se base PAS sur la table de routage
-	 * @return tableau représentant l'url
-	 */
-	public function buildWithoutRewriting () {
-		$url = array ();
-		
-		$url['c'] = Minz_Request::fetchGET (
-			'c',
-			Minz_Request::defaultControllerName ()
-		);
-		$url['a'] = Minz_Request::fetchGET (
-			'a',
-			Minz_Request::defaultActionName ()
-		);
-		$url['params'] = Minz_Request::fetchGET ();
-		
-		// post-traitement
-		unset ($url['params']['c']);
-		unset ($url['params']['a']);
-		
-		return $url;
-	}
-	
-	/**
-	 * Retourne un tableau représentant l'url passée par la barre d'adresses
-	 * Se base sur la table de routage
-	 * @return tableau représentant l'url
-	 * @exception RouteNotFoundException si l'uri n'est pas présente dans
-	 *          > la table de routage
-	 */
-	public function buildWithRewriting () {
-		$url = array ();
-		$uri = Minz_Request::getURI ();
-		$find = false;
-		
-		foreach ($this->routes as $route) {
-			$regex = '*^' . $route['route'] . '$*';
-			if (preg_match ($regex, $uri, $matches)) {
-				$url['c'] = $route['controller'];
-				$url['a'] = $route['action'];
-				$url['params'] = $this->getParams (
-					$route['params'],
-					$matches
-				);
-				$find = true;
-				break;
-			}
-		}
-		
-		if (!$find && $uri != '/') {
-			throw new Minz_RouteNotFoundException (
-				$uri,
-				Minz_Exception::ERROR
-			);
-		}
-		
-		// post-traitement
-		$url = Minz_Url::checkUrl ($url);
-		
-		return $url;
-	}
-	
-	/**
-	 * Retourne l'uri d'une url en se basant sur la table de routage
-	 * @param l'url sous forme de tableau
-	 * @return l'uri formatée (string) selon une route trouvée
-	 */
-	public function printUriRewrited ($url) {
-		$route = $this->searchRoute ($url);
-		
-		if ($route !== false) {
-			return $this->replaceParams ($route, $url['params']);
-		}
-		
-		return '';
-	}
-	
-	/**
-	 * Recherche la route correspondante à une url
-	 * @param l'url sous forme de tableau
-	 * @return la route telle que spécifiée dans la table de routage,
-	 *         false si pas trouvée
-	 */
-	public function searchRoute ($url) {
-		foreach ($this->routes as $route) {
-			if ($route['controller'] == $url['c']
-			 && $route['action'] == $url['a']) {
-				// calcule la différence des tableaux de params
-				$params = array_flip ($route['params']);
-				$difference_params = array_diff_key (
-					$params,
-					$url['params']
-				);
-				
-				// vérifie que pas de différence
-				// et le cas où $params est vide et pas $url['params']
-				if (empty ($difference_params)
-				&& (!empty ($params) || empty ($url['params']))) {
-					return $route;
-				}
-			}
-		}
-		
-		return false;
-	}
-	
-	/**
-	 * Récupère un tableau dont
-	 * 	- les clés sont définies dans $params_route
-	 *	- les valeurs sont situées dans $matches
-	 * Le tableau $matches est décalé de +1 par rapport à $params_route
-	 */
-	private function getParams($params_route, $matches) {
-		$params = array ();
-		
-		for ($i = 0; $i < count ($params_route); $i++) {
-			$param = $params_route[$i];
-			$params[$param] = $matches[$i + 1];
-		}
-	
-		return $params;
-	}
-	
-	/**
-	 * Remplace les éléments de la route par les valeurs contenues dans $params
-	 */
-	private function replaceParams ($route, $params_replace) {
-		$uri = $route['route'];
-		$params = array();
-		foreach($route['params'] as $param) {
-			$uri = preg_replace('#\((.+)\)#U', $params_replace[$param], $uri, 1);
-		}
-
-		return stripslashes($uri);
-	 }
-}
diff --git a/lib/Minz/Url.php b/lib/Minz/Url.php
index 17f1ddece..af48f00f5 100644
--- a/lib/Minz/Url.php
+++ b/lib/Minz/Url.php
@@ -5,8 +5,7 @@
  */
 class Minz_Url {
 	/**
-	 * Affiche une Url formatée selon que l'on utilise l'url_rewriting ou non
-	 * si oui, on cherche dans la table de routage la correspondance pour formater
+	 * Affiche une Url formatée
 	 * @param $url l'url à formater définie comme un tableau :
 	 *                    $url['c'] = controller
 	 *                    $url['a'] = action
@@ -39,13 +38,7 @@ class Minz_Url {
 		}
 
 		if ($isArray) {
-			$router = new Minz_Router ();
-
-			if (Minz_Configuration::useUrlRewriting ()) {
-				$url_string .= $router->printUriRewrited ($url);
-			} else {
-				$url_string .= self::printUri ($url, $encodage);
-			}
+			$url_string .= self::printUri ($url, $encodage);
 		} else {
 			$url_string .= $url;
 		}
@@ -54,7 +47,7 @@ class Minz_Url {
 	}
 	
 	/**
-	 * Construit l'URI d'une URL sans url rewriting
+	 * Construit l'URI d'une URL
 	 * @param l'url sous forme de tableau
 	 * @param $encodage pour indiquer comment encoder les & (& ou &amp; pour html)
 	 * @return l'uri sous la forme ?key=value&key2=value2
diff --git a/p/i/install.php b/p/i/install.php
index a7563d5ee..f97f95d37 100644
--- a/p/i/install.php
+++ b/p/i/install.php
@@ -228,7 +228,6 @@ function saveStep3 () {
 		$ini_array = array(
 			'general' => array(
 				'environment' => empty($_SESSION['environment']) ? 'production' : $_SESSION['environment'],
-				'use_url_rewriting' => false,
 				'salt' => $_SESSION['salt'],
 				'base_url' => '',
 				'title' => $_SESSION['title'],
-- 
cgit v1.2.3


From 6aadb7e59a1c8e70cfa42457e1898e94fd854fb0 Mon Sep 17 00:00:00 2001
From: Nicolas ELIE <nicolaselie@free.fr>
Date: Fri, 9 May 2014 09:53:46 +0200
Subject: Username regexp is too strict

Username can contains more characters that the regexp allows. For example, on a raspberry pi, the default user for web server is 'www-data'.
---
 p/i/install.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'p/i/install.php')

diff --git a/p/i/install.php b/p/i/install.php
index f97f95d37..365d0696c 100644
--- a/p/i/install.php
+++ b/p/i/install.php
@@ -913,7 +913,7 @@ function printStep3 () {
 		<div class="form-group">
 			<label class="group-name" for="user"><?php echo _t ('username'); ?></label>
 			<div class="group-controls">
-				<input type="text" id="user" name="user" maxlength="16" pattern="[0-9A-Za-z_]{1,16}" value="<?php echo isset ($_SESSION['bd_user']) ? $_SESSION['bd_user'] : ''; ?>" />
+				<input type="text" id="user" name="user" maxlength="16" pattern="[0-9A-Za-z_.-]{1,16}" value="<?php echo isset ($_SESSION['bd_user']) ? $_SESSION['bd_user'] : ''; ?>" />
 			</div>
 		</div>
 
-- 
cgit v1.2.3


From 8c132b2acd6fa5771237cce5b890c7ad534c375a Mon Sep 17 00:00:00 2001
From: Marien Fressinaud <dev@marienfressinaud.fr>
Date: Fri, 13 Jun 2014 18:14:44 +0200
Subject: Fix theme paths for install.php

---
 app/views/configure/users.phtml | 6 +++---
 p/i/install.php                 | 4 ++--
 2 files changed, 5 insertions(+), 5 deletions(-)

(limited to 'p/i/install.php')

diff --git a/app/views/configure/users.phtml b/app/views/configure/users.phtml
index 87aac6198..272896fb2 100644
--- a/app/views/configure/users.phtml
+++ b/app/views/configure/users.phtml
@@ -22,7 +22,7 @@
 			<div class="group-controls">
 				<div class="stick">
 					<input type="password" id="passwordPlain" name="passwordPlain" autocomplete="off" pattern=".{7,}" <?php echo cryptAvailable() ? '' : 'disabled="disabled" '; ?>/>
-					<a class="btn toggle-password"/><?php echo FreshRSS_Themes::icon('key'); ?></a>
+					<a class="btn toggle-password"><?php echo FreshRSS_Themes::icon('key'); ?></a>
 				</div>
 				<noscript><b><?php echo Minz_Translate::t('javascript_should_be_activated'); ?></b></noscript>
 			</div>
@@ -34,7 +34,7 @@
 			<div class="group-controls">
 				<div class="stick">
 					<input type="password" id="apiPasswordPlain" name="apiPasswordPlain" autocomplete="off" pattern=".{7,}" <?php echo cryptAvailable() ? '' : 'disabled="disabled" '; ?>/>
-					<a class="btn toggle-password"/><?php echo FreshRSS_Themes::icon('key'); ?></a>
+					<a class="btn toggle-password"><?php echo FreshRSS_Themes::icon('key'); ?></a>
 				</div>
 			</div>
 		</div>
@@ -184,7 +184,7 @@
 			<div class="group-controls">
 				<div class="stick">
 					<input type="password" id="new_user_passwordPlain" name="new_user_passwordPlain" autocomplete="off" pattern=".{7,}" />
-					<a class="btn toggle-password"/><?php echo FreshRSS_Themes::icon('key'); ?></a>
+					<a class="btn toggle-password"><?php echo FreshRSS_Themes::icon('key'); ?></a>
 				</div>
 				<noscript><b><?php echo Minz_Translate::t('javascript_should_be_activated'); ?></b></noscript>
 			</div>
diff --git a/p/i/install.php b/p/i/install.php
index 365d0696c..bc9483f73 100644
--- a/p/i/install.php
+++ b/p/i/install.php
@@ -1028,8 +1028,8 @@ case 6:
 		<meta charset="utf-8">
 		<meta name="viewport" content="initial-scale=1.0">
 		<title><?php echo _t ('freshrss_installation'); ?></title>
-		<link rel="stylesheet" type="text/css" media="all" href="../themes/Origine/global.css" />
-		<link rel="stylesheet" type="text/css" media="all" href="../themes/Origine/freshrss.css" />
+		<link rel="stylesheet" type="text/css" media="all" href="../themes/Origine/template.css" />
+		<link rel="stylesheet" type="text/css" media="all" href="../themes/Origine/origine.css" />
 	</head>
 	<body>
 
-- 
cgit v1.2.3