mirror/FreshRSS
0
0 Fork 0
mirror of https://github.com/FreshRSS/FreshRSS.git synced 2026-10-28 05:58:40 -04:00
Code Issues Packages Projects Releases Wiki Activity

Cleaner limit anonymous mode to default user (#9235)

Browse Source 
While waiting for https://github.com/FreshRSS/FreshRSS/issues/1553
This commit is contained in:
Alexandre Alapetite authored and GitHub committed 2026-08-25 16:17:36 +02:00
1 parent 95842d81c1
commit 2701b7dff4
9 files changed
+36 -26
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

app/Controllers/feedController.php
+1 -2
View File
@@ -14,7 +14,6 @@ class FreshRSS_feed_Controller extends FreshRSS_ActionController {
public function firstAction(): void {
if (!FreshRSS_Auth::hasAccess()) {
$action = Minz_Request::actionName();
$allow_anonymous_refresh = FreshRSS_Context::systemConf()->allow_anonymous_refresh;
// Likely coming from bookmarklet, redirect to the login page
if ($action === 'add') {
@@ -22,7 +21,7 @@ class FreshRSS_feed_Controller extends FreshRSS_ActionController {
return;
}
if ($action !== 'actualize' || (!$allow_anonymous_refresh && !Minz_Request::tokenIsOk())) {
if ($action !== 'actualize' || (!FreshRSS_Auth::allowAnonymousRefresh() && !Minz_Request::tokenIsOk())) {
Minz_Error::error(403);
}
}
app/Controllers/indexController.php
+14 -12
View File
@@ -102,9 +102,12 @@ class FreshRSS_index_Controller extends FreshRSS_ActionController {
* This action displays the normal view of FreshRSS.
*/
public function normalAction(): void {
$allow_anonymous = FreshRSS_Context::systemConf()->allow_anonymous;
if (!FreshRSS_Auth::hasAccess() && !$allow_anonymous) {
Minz_Request::forward(['c' => 'auth', 'a' => 'login']);
if (!FreshRSS_Auth::hasAccess() && !FreshRSS_Auth::allowAnonymous()) {
if (Minz_Request::paramString('user') !== '') {
Minz_Error::error(403, redirect: false);
} else {
Minz_Request::forward(['c' => 'auth', 'a' => 'login']);
}
return;
}
@@ -208,9 +211,12 @@ class FreshRSS_index_Controller extends FreshRSS_ActionController {
* This action displays the global view of FreshRSS.
*/
public function globalAction(): void {
$allow_anonymous = FreshRSS_Context::systemConf()->allow_anonymous;
if (!FreshRSS_Auth::hasAccess() && !$allow_anonymous) {
Minz_Request::forward(['c' => 'auth', 'a' => 'login']);
if (!FreshRSS_Auth::hasAccess() && !FreshRSS_Auth::allowAnonymous()) {
if (Minz_Request::paramString('user') !== '') {
Minz_Error::error(403, redirect: false);
} else {
Minz_Request::forward(['c' => 'auth', 'a' => 'login']);
}
return;
}
@@ -251,10 +257,8 @@ class FreshRSS_index_Controller extends FreshRSS_ActionController {
* @deprecated See user query RSS sharing instead
*/
public function rssAction(): void {
$allow_anonymous = FreshRSS_Context::systemConf()->allow_anonymous;
// Check if user has access.
if (!FreshRSS_Auth::hasAccess() && !$allow_anonymous && !Minz_Request::tokenIsOk()) {
if (!FreshRSS_Auth::hasAccess() && !FreshRSS_Auth::allowAnonymous() && !Minz_Request::tokenIsOk()) {
Minz_Error::error(403, redirect: false);
return;
}
@@ -288,10 +292,8 @@ class FreshRSS_index_Controller extends FreshRSS_ActionController {
}
public function opmlAction(): void {
$allow_anonymous = FreshRSS_Context::systemConf()->allow_anonymous;
// Check if user has access.
if (!FreshRSS_Auth::hasAccess() && !$allow_anonymous && !Minz_Request::tokenIsOk()) {
if (!FreshRSS_Auth::hasAccess() && !FreshRSS_Auth::allowAnonymous() && !Minz_Request::tokenIsOk()) {
Minz_Error::error(403, redirect: false);
return;
}
app/Controllers/javascriptController.php
+2 -5
View File
@@ -19,10 +19,7 @@ class FreshRSS_javascript_Controller extends FreshRSS_ActionController {
}
public function actualizeAction(): void {
if (!FreshRSS_Auth::hasAccess() && !(
FreshRSS_Context::systemConf()->allow_anonymous
&& FreshRSS_Context::systemConf()->allow_anonymous_refresh
)) {
if (!FreshRSS_Auth::hasAccess() && !FreshRSS_Auth::allowAnonymousRefresh()) {
Minz_Error::error(403);
return;
}
@@ -58,7 +55,7 @@ class FreshRSS_javascript_Controller extends FreshRSS_ActionController {
}
public function nbUnreadsPerFeedAction(): void {
if (!FreshRSS_Auth::hasAccess() && !FreshRSS_Context::systemConf()->allow_anonymous) {
if (!FreshRSS_Auth::hasAccess() && !FreshRSS_Auth::allowAnonymous()) {
Minz_Error::error(403);
return;
}
app/Controllers/tagController.php
+1 -1
View File
@@ -145,7 +145,7 @@ class FreshRSS_tag_Controller extends FreshRSS_ActionController {
}
public function getTagsForEntryAction(): void {
if (!FreshRSS_Auth::hasAccess() && !FreshRSS_Context::systemConf()->allow_anonymous) {
if (!FreshRSS_Auth::hasAccess() && !FreshRSS_Auth::allowAnonymous()) {
Minz_Error::error(403);
}
$this->view->_layout(null);
app/FreshRSS.php
+3 -3
View File
@@ -57,7 +57,7 @@ class FreshRSS extends Minz_FrontController {
// Complete initialization of the other FreshRSS / Minz components.
self::initI18n();
// Enable extensions for the current (logged) user.
if (FreshRSS_Auth::hasAccess() || FreshRSS_Context::systemConf()->allow_anonymous) {
if (FreshRSS_Auth::hasAccess() || FreshRSS_Auth::allowAnonymous()) {
$ext_list = FreshRSS_Context::userConf()->extensions_enabled;
Minz_ExtensionManager::enableByList($ext_list, 'user');
}
@@ -76,9 +76,9 @@ class FreshRSS extends Minz_FrontController {
(Minz_Request::controllerName() === 'auth' && Minz_Request::actionName() === 'login') ||
(Minz_Request::controllerName() === 'user' && Minz_Request::actionName() === 'create' && !FreshRSS_Auth::hasAccess('admin')) ||
(Minz_Request::controllerName() === 'feed' && Minz_Request::actionName() === 'actualize' &&
FreshRSS_Context::systemConf()->allow_anonymous_refresh) ||
FreshRSS_Auth::allowAnonymousRefresh()) ||
(Minz_Request::controllerName() === 'javascript' && Minz_Request::actionName() === 'actualize' &&
FreshRSS_Context::systemConf()->allow_anonymous)
FreshRSS_Auth::allowAnonymous())
)) {
// Token-based protection against XSRF attacks, except for the login or self-create user forms
self::initI18n();
app/Models/Auth.php
+12
View File
@@ -270,4 +270,16 @@ class FreshRSS_Auth {
return false;
}
public static function allowAnonymous(): bool {
$defaultUser = FreshRSS_Context::systemConf()->default_user;
$requestedUser = Minz_Request::paramString('user');
return FreshRSS_Context::systemConf()->allow_anonymous &&
Minz_User::name() === $defaultUser &&
($requestedUser === '' || $requestedUser === $defaultUser);
}
public static function allowAnonymousRefresh(): bool {
return FreshRSS_Context::systemConf()->allow_anonymous_refresh && self::allowAnonymous();
}
}
app/layout/header.phtml
+1 -1
View File
@@ -16,7 +16,7 @@
</div>
<div class="item search">
<?php if (FreshRSS_Auth::hasAccess() || FreshRSS_Context::systemConf()->allow_anonymous) { ?>
<?php if (FreshRSS_Auth::hasAccess() || FreshRSS_Auth::allowAnonymous()) { ?>
<form action="<?= $this->html_url ?>" method="get">
<?php if (Minz_Request::controllerName() === 'index'): ?>
<?php if (in_array(Minz_Request::actionName(), ['normal', 'global', 'reader'], true)) { ?>
app/layout/nav_menu.phtml
+1 -1
View File
@@ -285,7 +285,7 @@
</div>
</div>
<?php if (FreshRSS_Auth::hasAccess() || FreshRSS_Context::systemConf()->allow_anonymous_refresh) { ?>
<?php if (FreshRSS_Auth::hasAccess() || FreshRSS_Auth::allowAnonymousRefresh()) { ?>
<div id="nav_menu_actualize" class="group">
<a id="actualize" class="btn" href="<?= _url('feed', 'actualize') ?>" title="<?= _t('gen.action.actualize') ?>"><?= _i('refresh') ?></a>
</div>
app/views/helpers/javascript_vars.phtml
+1 -1
View File
@@ -4,7 +4,7 @@ declare(strict_types=1);
$mark = FreshRSS_Context::userConf()->mark_when;
$s = FreshRSS_Context::userConf()->shortcuts;
$extData = Minz_ExtensionManager::callHook(Minz_HookType::JsVars, []);
$canView = FreshRSS_Auth::hasAccess() || FreshRSS_Context::systemConf()->allow_anonymous;
$canView = FreshRSS_Auth::hasAccess() || FreshRSS_Auth::allowAnonymous();
echo json_encode([
'context' => [
'anonymous' => !FreshRSS_Auth::hasAccess(),