GReader API doc and improvements (#4763)

* GReader API doc and improvements
#fix https://github.com/FreshRSS/FreshRSS/issues/4762

* Minor slash

* HTTPS for web.archive.org

docs/en/developers/06_GoogleReader_API.md

@@ -1,7 +1,8 @@
 # FreshRSS - Google Reader compatible API implementation
 
 See [Mobile access](../users/06_Mobile_access.md) for general aspects of API access.
-Additionally [page about our Fever compatible API](06_Fever_API.md) for another possibility.
+
+See also the [page about our Fever compatible API](06_Fever_API.md) for another possibility (less powerful).
 
 ## RSS clients
 
@@ -23,7 +24,7 @@ Then point your mobile application to the `greader.php` address (e.g. `https://f
 
 | App                                                                                | Platform            | License                                            |
 |:----------------------------------------------------------------------------------:|:-------------------:|:--------------------------------------------------------:|
-|[News+](https://github.com/noinnion/newsplus/blob/master/apk/NewsPlus_202.apk) with [News+ Google Reader extension](https://github.com/noinnion/newsplus/blob/master/apk/GoogleReaderCloneExtension_101.apk) |Android|Closed Source (Free)|
+|[News+](https://github.com/noinnion/newsplus/blob/master/apk/NewsPlus_202.apk) with [News+ Google Reader extension](https://github.com/noinnion/newsplus/blob/master/apk/GoogleReaderCloneExtension_101.apk) |Android|Closed Source (Free), [partially open source](https://github.com/noinnion/newsplus/blob/master/extensions/GoogleReaderCloneExtension/src/com/noinnion/android/newsplus/extension/google_reader/GoogleReaderClient.java)|
 |[FeedMe 3.5.3+](https://play.google.com/store/apps/details?id=com.seazon.feedme) |Android                  |Closed Source (Free)                                             |
 |[EasyRSS](https://github.com/Alkarex/EasyRSS)                          |Android                |[GPLv3](https://github.com/Alkarex/EasyRSS/blob/master/license.txt) ([F-Droid](https://f-droid.org/packages/org.freshrss.easyrss/))|
 |[Readrops](https://github.com/readrops/Readrops) |Android                  |[GPLv3](https://github.com/readrops/Readrops/blob/develop/LICENSE)                                             |
@@ -36,6 +37,8 @@ Then point your mobile application to the `greader.php` address (e.g. `https://f
 |[Reeder](https://www.reederapp.com/)                           |macOS, iOS                |Closed Source                                              |
 |[FreshRSS-Notify](https://addons.mozilla.org/firefox/addon/freshrss-notify-webextension/)                           |Firefox                |Open Source                                              |
 
+> ℹ️ See a [better table of compatible clients in our main Readme](https://github.com/FreshRSS/FreshRSS/blob/edge/README.md#apis--native-apps).
+
 ## Google Reader compatible API
 
 Examples of basic queries:
@@ -65,3 +68,29 @@ curl -H "Authorization:GoogleLogin auth=alice/8e6845e089457af25303abc6f53356eb60
 curl -s -H "Authorization:GoogleLogin auth=alice/8e6845e089457af25303abc6f53356eb60bdb5f8" \
   'https://freshrss.example.net/api/greader.php/reader/api/0/stream/contents/reading-list' | jq .
 ```
+
+* [Source code of our API implementation](https://github.com/FreshRSS/FreshRSS/blob/edge/p/api/greader.php)
+
+### API documentation from the original Google Reader
+
+* [By Daniel Arowser](https://web.archive.org/web/20130710044440/http://undoc.in/api.html) ([source](https://github.com/arowser/google-reader-api))
+* [By Martin Doms](https://web.archive.org/web/20210126115837/https://blog.martindoms.com/2009/10/16/using-the-google-reader-api-part-2/)
+* [By Nick Bradbury](https://inessential.com/2013/03/14/google_reader_api_documentation)
+* [By Niall Kennedy](https://web.archive.org/web/20170426184845/http://www.niallkennedy.com/blog/2005/12/google-reader-api.html)
+* [By Mihai Parparita](https://web.archive.org/web/20140919042419/http://code.google.com/p/google-reader-api/w/list) ([source](https://github.com/mihaip/google-reader-api))
+
+### API documentation from other compatible clients
+
+* [FeedHQ](https://feedhq.readthedocs.io/en/latest/api/index.html)
+* [Inoreader](https://www.inoreader.com/developers/)
+* [The Old Reader](https://github.com/theoldreader/api)
+* [pyrfeed](http://code.google.com/p/pyrfeed/wiki/GoogleReaderAPI)
+* [BazQux](https://github.com/bazqux/bazqux-api)
+
+### Synchronisation strategy
+
+> ℹ️ If you are maintaining a client or planning to develop a new one, please read carefully the following pieces of advice,
+as many clients start by having a very inneficient synchronisation strategy.
+
+* [*Synchronisation recommendation* by Alkarex](https://github.com/FreshRSS/FreshRSS/issues/2566#issuecomment-541317776)
+* [*The Right Way to Sync* by BazQux](https://github.com/bazqux/bazqux-api#user-content-the-right-way-to-sync)

p/api/greader.php

@@ -10,10 +10,10 @@ Server-side API compatible with Google Reader API layer 2
 
 == Documentation ==
 * http://code.google.com/p/pyrfeed/wiki/GoogleReaderAPI
-* http://web.archive.org/web/20130718025427/http://undoc.in/
+* https://web.archive.org/web/20130718025427/http://undoc.in/
 * http://ranchero.com/downloads/GoogleReaderAPI-2009.pdf
 * http://code.google.com/p/google-reader-api/w/list
-* http://blog.martindoms.com/2009/10/16/using-the-google-reader-api-part-2/
+* https://web.archive.org/web/20210126115837/https://blog.martindoms.com/2009/10/16/using-the-google-reader-api-part-2/
 * https://github.com/noinnion/newsplus/blob/master/extensions/GoogleReaderCloneExtension/src/com/noinnion/android/newsplus/extension/google_reader/GoogleReaderClient.java
 * https://github.com/ericmann/gReader-Library/blob/master/greader.class.php
 * https://github.com/devongovett/reader
@@ -185,7 +185,7 @@ function authorizationToUser() {
 }
 
 function clientLogin($email, $pass) {
-	//http://web.archive.org/web/20130604091042/http://undoc.in/clientLogin.html
+	//https://web.archive.org/web/20130604091042/http://undoc.in/clientLogin.html
 	if (FreshRSS_user_Controller::checkUsername($email)) {
 		FreshRSS_Context::initUser($email);
 		if (FreshRSS_Context::$user_conf == null) {
@@ -878,6 +878,10 @@ function markAllAsRead($streamId, $olderThanId) {
 	$entryDAO = FreshRSS_Factory::createEntryDao();
 	if (strpos($streamId, 'feed/') === 0) {
 		$f_id = basename($streamId);
+		if (!ctype_digit($f_id)) {
+			badRequest();
+		}
+		$f_id = intval($f_id);
 		$entryDAO->markReadFeed($f_id, $olderThanId);
 	} elseif (strpos($streamId, 'user/-/label/') === 0) {
 		$c_name = substr($streamId, 13);
@@ -891,12 +895,15 @@ function markAllAsRead($streamId, $olderThanId) {
 			$tag = $tagDAO->searchByName($c_name);
 			if ($tag != null) {
 				$entryDAO->markReadTag($tag->id(), $olderThanId);
+			} else {
+				badRequest();
 			}
 		}
 	} elseif ($streamId === 'user/-/state/com.google/reading-list') {
 		$entryDAO->markReadEntries($olderThanId, false, -1);
+	} else {
+		badRequest();
 	}
-
 	exit('OK');
 }
 
@@ -1105,10 +1112,10 @@ if ($pathInfos[1] === 'accounts') {
 		case 'mark-all-as-read':
 			$token = isset($_POST['T']) ? trim($_POST['T']) : '';
 			checkToken(FreshRSS_Context::$user_conf, $token);
-			$streamId = $_POST['s'];	//StreamId
+			$streamId = $_POST['s'] ?? '';
 			$ts = isset($_POST['ts']) ? $_POST['ts'] : '0';	//Older than timestamp in nanoseconds
 			if (!ctype_digit($ts)) {
-				$ts = '0';
+				badRequest();
 			}
 			markAllAsRead($streamId, $ts);
 			break;