From 2701b7dff4d459eadb099a7e3aaf1473cccdbd29 Mon Sep 17 00:00:00 2001 From: Alexandre Alapetite Date: Tue, 25 Aug 2026 16:17:36 +0200 Subject: [PATCH] Cleaner limit anonymous mode to default user (#9235) While waiting for https://github.com/FreshRSS/FreshRSS/issues/1553 --- app/Controllers/feedController.php | 3 +-- app/Controllers/indexController.php | 26 +++++++++++++----------- app/Controllers/javascriptController.php | 7 ++----- app/Controllers/tagController.php | 2 +- app/FreshRSS.php | 6 +++--- app/Models/Auth.php | 12 +++++++++++ app/layout/header.phtml | 2 +- app/layout/nav_menu.phtml | 2 +- app/views/helpers/javascript_vars.phtml | 2 +- 9 files changed, 36 insertions(+), 26 deletions(-) diff --git a/app/Controllers/feedController.php b/app/Controllers/feedController.php index df9eeafbe..afc8ce50d 100644 --- a/app/Controllers/feedController.php +++ b/app/Controllers/feedController.php @@ -14,7 +14,6 @@ class FreshRSS_feed_Controller extends FreshRSS_ActionController { public function firstAction(): void { if (!FreshRSS_Auth::hasAccess()) { $action = Minz_Request::actionName(); - $allow_anonymous_refresh = FreshRSS_Context::systemConf()->allow_anonymous_refresh; // Likely coming from bookmarklet, redirect to the login page if ($action === 'add') { @@ -22,7 +21,7 @@ class FreshRSS_feed_Controller extends FreshRSS_ActionController { return; } - if ($action !== 'actualize' || (!$allow_anonymous_refresh && !Minz_Request::tokenIsOk())) { + if ($action !== 'actualize' || (!FreshRSS_Auth::allowAnonymousRefresh() && !Minz_Request::tokenIsOk())) { Minz_Error::error(403); } } diff --git a/app/Controllers/indexController.php b/app/Controllers/indexController.php index 42d323f0a..44a3d057a 100644 --- a/app/Controllers/indexController.php +++ b/app/Controllers/indexController.php @@ -102,9 +102,12 @@ class FreshRSS_index_Controller extends FreshRSS_ActionController { * This action displays the normal view of FreshRSS. */ public function normalAction(): void { - $allow_anonymous = FreshRSS_Context::systemConf()->allow_anonymous; - if (!FreshRSS_Auth::hasAccess() && !$allow_anonymous) { - Minz_Request::forward(['c' => 'auth', 'a' => 'login']); + if (!FreshRSS_Auth::hasAccess() && !FreshRSS_Auth::allowAnonymous()) { + if (Minz_Request::paramString('user') !== '') { + Minz_Error::error(403, redirect: false); + } else { + Minz_Request::forward(['c' => 'auth', 'a' => 'login']); + } return; } @@ -208,9 +211,12 @@ class FreshRSS_index_Controller extends FreshRSS_ActionController { * This action displays the global view of FreshRSS. */ public function globalAction(): void { - $allow_anonymous = FreshRSS_Context::systemConf()->allow_anonymous; - if (!FreshRSS_Auth::hasAccess() && !$allow_anonymous) { - Minz_Request::forward(['c' => 'auth', 'a' => 'login']); + if (!FreshRSS_Auth::hasAccess() && !FreshRSS_Auth::allowAnonymous()) { + if (Minz_Request::paramString('user') !== '') { + Minz_Error::error(403, redirect: false); + } else { + Minz_Request::forward(['c' => 'auth', 'a' => 'login']); + } return; } @@ -251,10 +257,8 @@ class FreshRSS_index_Controller extends FreshRSS_ActionController { * @deprecated See user query RSS sharing instead */ public function rssAction(): void { - $allow_anonymous = FreshRSS_Context::systemConf()->allow_anonymous; - // Check if user has access. - if (!FreshRSS_Auth::hasAccess() && !$allow_anonymous && !Minz_Request::tokenIsOk()) { + if (!FreshRSS_Auth::hasAccess() && !FreshRSS_Auth::allowAnonymous() && !Minz_Request::tokenIsOk()) { Minz_Error::error(403, redirect: false); return; } @@ -288,10 +292,8 @@ class FreshRSS_index_Controller extends FreshRSS_ActionController { } public function opmlAction(): void { - $allow_anonymous = FreshRSS_Context::systemConf()->allow_anonymous; - // Check if user has access. - if (!FreshRSS_Auth::hasAccess() && !$allow_anonymous && !Minz_Request::tokenIsOk()) { + if (!FreshRSS_Auth::hasAccess() && !FreshRSS_Auth::allowAnonymous() && !Minz_Request::tokenIsOk()) { Minz_Error::error(403, redirect: false); return; } diff --git a/app/Controllers/javascriptController.php b/app/Controllers/javascriptController.php index c760fa5a7..a60c8dfbd 100644 --- a/app/Controllers/javascriptController.php +++ b/app/Controllers/javascriptController.php @@ -19,10 +19,7 @@ class FreshRSS_javascript_Controller extends FreshRSS_ActionController { } public function actualizeAction(): void { - if (!FreshRSS_Auth::hasAccess() && !( - FreshRSS_Context::systemConf()->allow_anonymous - && FreshRSS_Context::systemConf()->allow_anonymous_refresh - )) { + if (!FreshRSS_Auth::hasAccess() && !FreshRSS_Auth::allowAnonymousRefresh()) { Minz_Error::error(403); return; } @@ -58,7 +55,7 @@ class FreshRSS_javascript_Controller extends FreshRSS_ActionController { } public function nbUnreadsPerFeedAction(): void { - if (!FreshRSS_Auth::hasAccess() && !FreshRSS_Context::systemConf()->allow_anonymous) { + if (!FreshRSS_Auth::hasAccess() && !FreshRSS_Auth::allowAnonymous()) { Minz_Error::error(403); return; } diff --git a/app/Controllers/tagController.php b/app/Controllers/tagController.php index 019a44b0c..059b1ab76 100644 --- a/app/Controllers/tagController.php +++ b/app/Controllers/tagController.php @@ -145,7 +145,7 @@ class FreshRSS_tag_Controller extends FreshRSS_ActionController { } public function getTagsForEntryAction(): void { - if (!FreshRSS_Auth::hasAccess() && !FreshRSS_Context::systemConf()->allow_anonymous) { + if (!FreshRSS_Auth::hasAccess() && !FreshRSS_Auth::allowAnonymous()) { Minz_Error::error(403); } $this->view->_layout(null); diff --git a/app/FreshRSS.php b/app/FreshRSS.php index a696dcddd..251425de3 100644 --- a/app/FreshRSS.php +++ b/app/FreshRSS.php @@ -57,7 +57,7 @@ class FreshRSS extends Minz_FrontController { // Complete initialization of the other FreshRSS / Minz components. self::initI18n(); // Enable extensions for the current (logged) user. - if (FreshRSS_Auth::hasAccess() || FreshRSS_Context::systemConf()->allow_anonymous) { + if (FreshRSS_Auth::hasAccess() || FreshRSS_Auth::allowAnonymous()) { $ext_list = FreshRSS_Context::userConf()->extensions_enabled; Minz_ExtensionManager::enableByList($ext_list, 'user'); } @@ -76,9 +76,9 @@ class FreshRSS extends Minz_FrontController { (Minz_Request::controllerName() === 'auth' && Minz_Request::actionName() === 'login') || (Minz_Request::controllerName() === 'user' && Minz_Request::actionName() === 'create' && !FreshRSS_Auth::hasAccess('admin')) || (Minz_Request::controllerName() === 'feed' && Minz_Request::actionName() === 'actualize' && - FreshRSS_Context::systemConf()->allow_anonymous_refresh) || + FreshRSS_Auth::allowAnonymousRefresh()) || (Minz_Request::controllerName() === 'javascript' && Minz_Request::actionName() === 'actualize' && - FreshRSS_Context::systemConf()->allow_anonymous) + FreshRSS_Auth::allowAnonymous()) )) { // Token-based protection against XSRF attacks, except for the login or self-create user forms self::initI18n(); diff --git a/app/Models/Auth.php b/app/Models/Auth.php index 095f47ae3..dd925b676 100644 --- a/app/Models/Auth.php +++ b/app/Models/Auth.php @@ -270,4 +270,16 @@ class FreshRSS_Auth { return false; } + + public static function allowAnonymous(): bool { + $defaultUser = FreshRSS_Context::systemConf()->default_user; + $requestedUser = Minz_Request::paramString('user'); + return FreshRSS_Context::systemConf()->allow_anonymous && + Minz_User::name() === $defaultUser && + ($requestedUser === '' || $requestedUser === $defaultUser); + } + + public static function allowAnonymousRefresh(): bool { + return FreshRSS_Context::systemConf()->allow_anonymous_refresh && self::allowAnonymous(); + } } diff --git a/app/layout/header.phtml b/app/layout/header.phtml index e15a9a981..f083e5146 100644 --- a/app/layout/header.phtml +++ b/app/layout/header.phtml @@ -16,7 +16,7 @@
- allow_anonymous) { ?> +
diff --git a/app/layout/nav_menu.phtml b/app/layout/nav_menu.phtml index 4fea58226..dd17196da 100644 --- a/app/layout/nav_menu.phtml +++ b/app/layout/nav_menu.phtml @@ -285,7 +285,7 @@
- allow_anonymous_refresh) { ?> + diff --git a/app/views/helpers/javascript_vars.phtml b/app/views/helpers/javascript_vars.phtml index 252421e54..822d1011c 100644 --- a/app/views/helpers/javascript_vars.phtml +++ b/app/views/helpers/javascript_vars.phtml @@ -4,7 +4,7 @@ declare(strict_types=1); $mark = FreshRSS_Context::userConf()->mark_when; $s = FreshRSS_Context::userConf()->shortcuts; $extData = Minz_ExtensionManager::callHook(Minz_HookType::JsVars, []); -$canView = FreshRSS_Auth::hasAccess() || FreshRSS_Context::systemConf()->allow_anonymous; +$canView = FreshRSS_Auth::hasAccess() || FreshRSS_Auth::allowAnonymous(); echo json_encode([ 'context' => [ 'anonymous' => !FreshRSS_Auth::hasAccess(),