1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
|
<?php
class FreshRSS extends Minz_FrontController {
/**
* Initialize the different FreshRSS / Minz components.
*
* PLEASE DON'T CHANGE THE ORDER OF INITIALIZATIONS UNLESS YOU KNOW WHAT
* YOU DO!!
*
* Here is the list of components:
* - Create a configuration setter and register it to system conf
* - Init extension manager and enable system extensions (has to be done asap)
* - Init authentication system
* - Init user configuration (need auth system)
* - Init FreshRSS context (need user conf)
* - Init i18n (need context)
* - Init sharing system (need user conf and i18n)
* - Init generic styles and scripts (need user conf)
* - Init notifications
* - Enable user extensions (need all the other initializations)
*/
public function init() {
if (!isset($_SESSION)) {
Minz_Session::init('FreshRSS');
}
// Register the configuration setter for the system configuration
$configuration_setter = new FreshRSS_ConfigurationSetter();
$system_conf = Minz_Configuration::get('system');
$system_conf->_configurationSetter($configuration_setter);
// Load list of extensions and enable the "system" ones.
Minz_ExtensionManager::init();
// Auth has to be initialized before using currentUser session parameter
// because it's this part which create this parameter.
self::initAuth();
// Then, register the user configuration and use the configuration setter
// created above.
$current_user = Minz_Session::param('currentUser', '_');
Minz_Configuration::register('user',
join_path(USERS_PATH, $current_user, 'config.php'),
join_path(FRESHRSS_PATH, 'config-user.default.php'),
$configuration_setter);
// Finish to initialize the other FreshRSS / Minz components.
FreshRSS_Context::init();
self::initI18n();
self::loadNotifications();
// Enable extensions for the current (logged) user.
if (FreshRSS_Auth::hasAccess() || $system_conf->allow_anonymous) {
$ext_list = FreshRSS_Context::$user_conf->extensions_enabled;
Minz_ExtensionManager::enableByList($ext_list);
}
}
private static function initAuth() {
FreshRSS_Auth::init();
if (Minz_Request::isPost() && !(is_referer_from_same_domain() && FreshRSS_Auth::isCsrfOk())) {
// Basic protection against XSRF attacks
FreshRSS_Auth::removeAccess();
$http_referer = empty($_SERVER['HTTP_REFERER']) ? '' : $_SERVER['HTTP_REFERER'];
Minz_Translate::init('en'); //TODO: Better choice of fallback language
Minz_Error::error(
403,
array('error' => array(
_t('feedback.access.denied'),
' [HTTP_REFERER=' . htmlspecialchars($http_referer) . ']'
))
);
}
}
private static function initI18n() {
Minz_Session::_param('language', FreshRSS_Context::$user_conf->language);
Minz_Translate::init(FreshRSS_Context::$user_conf->language);
}
public static function loadStylesAndScripts() {
$theme = FreshRSS_Themes::load(FreshRSS_Context::$user_conf->theme);
if ($theme) {
foreach(array_reverse($theme['files']) as $file) {
if ($file[0] === '_') {
$theme_id = 'base-theme';
$filename = substr($file, 1);
} else {
$theme_id = $theme['id'];
$filename = $file;
}
$filetime = @filemtime(PUBLIC_PATH . '/themes/' . $theme_id . '/' . $filename);
$url = '/themes/' . $theme_id . '/' . $filename . '?' . $filetime;
header('Link: <' . Minz_Url::display($url, '', 'root') . '>;rel=preload', false); //HTTP2
Minz_View::prependStyle(Minz_Url::display($url));
}
}
//Use prepend to insert before extensions. Added in reverse order.
Minz_View::prependScript(Minz_Url::display('/scripts/main.js?' . @filemtime(PUBLIC_PATH . '/scripts/main.js')));
Minz_View::prependScript(Minz_Url::display('/scripts/shortcut.js?' . @filemtime(PUBLIC_PATH . '/scripts/shortcut.js')));
Minz_View::prependScript(Minz_Url::display('/scripts/jquery.min.js?' . @filemtime(PUBLIC_PATH . '/scripts/jquery.min.js')));
}
private static function loadNotifications() {
$notif = Minz_Session::param('notification');
if ($notif) {
Minz_View::_param('notification', $notif);
Minz_Session::_param('notification');
}
}
public static function preLayout() {
switch (Minz_Request::controllerName()) {
case 'index':
header("Content-Security-Policy: default-src 'self'; child-src *; frame-src *; img-src * data:; media-src *");
break;
case 'stats':
header("Content-Security-Policy: default-src 'self'; style-src 'self' 'unsafe-inline'");
break;
default:
header("Content-Security-Policy: default-src 'self'");
break;
}
header("X-Content-Type-Options: nosniff");
FreshRSS_Share::load(join_path(DATA_PATH, 'shares.php'));
self::loadStylesAndScripts();
}
}
|
