* Update websub_pending entry in sub.php
Translated the websub_pending attribute entry in sub.php in german
* make fix-all
---------
Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>
* docs: updates turkish websub_pending entry in sub.php
Modified the websub_pending attribute entry in sub.php in turkish
* make fix-all
---------
Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>
Translate the last untranslated Japanese strings and mark the Lithuanian
endonym as IGNORE, consistent with the other language names.
Co-authored-by: akinechan <1593847+akine@users.noreply.github.com>
* Reword explanations for edge/latest channels
Highlight the fact that we do not backport bug fixes or security fixes to previous releases.
Simplify also a slightly obsolte MySQL doc to favour SQLite
* Merge i18n: az
* Update Polish translations to specify rolling/versioned releases
Co-authored-by: Inverle <inverle@proton.me>
* Update 05_Release_new_version.md
---------
Co-authored-by: Inverle <inverle@proton.me>
- Reviewed all remaining Spanish translations marked as TODO or DIRTY
- Updated translations against the current English source
- Removed obsolete TODO, DIRTY, and IGNORE markers after verification
- Brought Spanish translation completion to 100%
* i18n(id): complete Indonesian translation
Translate the 130 remaining `// TODO` entries in app/i18n/id/ and refresh
the 5 `// DIRTY` ones, bringing Indonesian from 88% to 100%.
Terminology follows the strings already shipped (umpan, kategori, artikel,
belum dibaca, tandai, pintasan). Placeholders, inline markup and
documentation links are preserved unchanged. Entries with no natural
Indonesian form are marked `// IGNORE` rather than left silently as
English: the `lt` language endonym, `gen.search.url`, and the API error
marker.
Replace `peladen` with `server` throughout, including in strings that
predate this change, as `peladen` is unfamle
doing so, fix a mistranslation where the "Browser" field of the system
information panel read `Peladen`, i.e. ser
All edits were made through cli/manipulateME
progress tables were regenerated with `composer run-script translations`.
Refs #6349.
* i18n(id): Fix Indonesian translations for update messages and sorting options
* Refactor user query translation keys
What changed:
- replace dynamic user-query translation keys with explicit state, order, and type lookups
- retain the existing translations and query behaviour without adding dependencies
Why:
The translation checker cannot identify keys assembled at runtime. Explicit lookups make all user-query strings visible to validation and easier to maintain.
Fixes#6315
* Use semantic user query translation keys
* Show all effective user query states
* Display every effective user query state
* Preserve current Japanese translations
* Merge i18n: lt
* Update i18n: fr
---------
Co-authored-by: Gerard Alvear <gerard.alvear@logiqd.me>
Co-authored-by: Inverle <inverle@proton.me>
Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>
* Add link to cloud providers list and Chatons directory
Closes#7628
Changes proposed in this pull request:
* Added a line after the "Automated install" section linking to the cloud providers list (freshrss.org/cloud-providers.html) and the Chatons directory
* Follows Alkarex's suggestion in the issue (keep the section, add links instead of removing content)
* docs(fr): add link to cloud providers list and Chatons directory
* Typographic quotes
---------
Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>
* Add per-feed option to show or hide enclosures
Some feeds attach lots of enclosures (images, audio, video, downloads)
that clutter the article view for readers who only want the text. Add
a per-feed "Show enclosures" setting (Feed configuration > Display),
defaulting to "by default" (i.e. shown, matching current behaviour),
following the same ternary-attribute pattern used by existing
per-feed overrides such as show_unread_count and read_upon_gone.
Also apply the preference to the GReader-compat API content call and
the Fever API entry serialization, so third-party clients like Reeder
and Fever apps respect it too, not just the normal web UI. Renamed the
translation key to display_enclosures to match the underlying feed
attribute name.
Fixes#4999
* i18n: fr
* Fix Fever API
* Remove accessor
* Forgotten fix
---------
Co-authored-by: Gerard Alvear <gerard.alvear@logiqd.me>
Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>
* Fix outdated username length hint on registration and install forms
The hint text said usernames were limited to 16 alphanumeric
characters, but FreshRSS_user_Controller::USERNAME_PATTERN has long
allowed 1-39 characters, including underscore, dot, @ and hyphen.
Update the English source strings so the hint matches what is
actually accepted, using make i18n-update-key so the change
propagates to languages that had an untranslated copy of the old
English text (en-US, he), keeping en-US's IGNORE marker intact.
39 is simply the pattern's technical ceiling, not a claim about what
is safest to allow; that broader question was never settled on the
issue and is left for a follow-up if needed.
Fixes#3971
* i18n: mark username hints dirty
* i18n: retain untranslated Hebrew username hint
* i18n: fr
* i18n: TODO instead of DIRTY
---------
Co-authored-by: Gerard Alvear <gerard.alvear@logiqd.me>
Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>
* Check GMP during 32-bit installation
- add an installer prerequisite for GMP when PHP uses 32-bit integers
- stop installation before favourite export can call GMP functions that are unavailable
- cover 32-bit and 64-bit GMP requirement states
Google Reader-compatible entry identifiers require GMP on 32-bit PHP. The installer did not check that prerequisite, so a missing extension could instead cause a fatal error during favourite export.
* i18n: fr
---------
Co-authored-by: Gerard Alvear <gerard.alvear@logiqd.me>
Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>
* Update Japanese admin translations
* Update Japanese API translations
* Update Japanese configuration translations
* Update Japanese feedback translations
* Update Japanese general translations
* Update Japanese index translations
* Update Japanese installer translations
* Update Japanese subscription translations
* Normalize punctuation in Japanese translations
* fix(i18n): Correct Japanese scraping item label
* fix(i18n): Improve Japanese translations
* fix(i18n): Refine Japanese translations
* fix(i18n): Clear resolved Japanese DIRTY markers
* fix(i18n): Resolve remaining Japanese DIRTY translations
* fix(i18n): Use Arabic numerals for Japanese months
* style(i18n): Fix Japanese translation indentation
* docs(credits): Add gshimo contributor
* make fix-all
---------
Co-authored-by: gshimo <gakushimodaila@gmail.com>
Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>
* Add LinkAce as a sharing service
LinkAce is a self-hosted bookmark manager with a bookmarklet-style
add endpoint, similar to Linkding and Shaarli. Add a 'linkace' entry
to app/shares.php using its documented bookmarklet URL scheme, add
the corresponding translation key, and list it in the sharing
services documentation.
Fixes#6698
* i18n Ignore
---------
Co-authored-by: Gerard Alvear <gerard.alvear@logiqd.me>
Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>
* Warn during install if document root does not point to ./p
If the Web server's document root is misconfigured to serve the
FreshRSS repository root instead of the ./p public folder, other
folders such as ./data (which store credentials, tokens, and the
database) can become publicly accessible.
Add a non-blocking check to installation step 1 that compares the
detected DOCUMENT_ROOT against the ./p folder and warns when they
do not match. The check is skipped when DOCUMENT_ROOT is unknown
(e.g. CLI/cron context), including when it is an empty string,
since realpath('') would otherwise misleadingly resolve to the
current working directory.
Fixes#3679
* i18n: fr, en-US
* Path semantics preference
* Minor syntax preference
* Warn when document root is unavailable
---------
Co-authored-by: Gerard Alvear <gerard.alvear@logiqd.me>
Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>
**Change(s)**
- Add missing punctuation
- Add missing spaces in the date format
- Add some new translations
**File(s) changed**
`app/i18n/zh-TW/{admin,conf,gen,install,sub}.php`
`README.md`
`README.fr.md`
* Add option to keep or reset article sort order when navigating
Adds a new per-user reading option, "Keep the current sort order when
navigating between categories and feeds" (config key: sticky_sort), under
Settings > Reading > "Left navigation: Categories". It defaults to enabled,
which reproduces the current behaviour exactly.
Background (addresses #8953)
----------------------------
Once a sort/order was active in one view, it was propagated to every sidebar
link and to the "mark all as read" redirect. Opening another category then
ignored that category's own defaultSort/defaultOrder, because FreshRSS_Context
only applies those defaults when sort/order are absent from the request. As a
result the current view's sort (whether chosen manually or resolved from that
view's default) "bled" into the next category/feed.
Behaviour of the new option
---------------------------
- ON (default): unchanged. The current sort/order stays sticky while
navigating, exactly as before.
- OFF: sidebar links and the "mark all as read" redirect no longer carry
sort/order, so each target resolves its own order in FreshRSS_Context:
feed/category defaultSort/defaultOrder, falling back to the global Reading
sort criterion when none is configured.
order/sort propagation across the UI (for reference)
----------------------------------------------------
- Categories & feeds (sidebar): now gated by sticky_sort (app/layout/aside_feed.phtml).
- "Mark all as read" -> next category, both the top navigation button and the
stream-footer button: now gated by sticky_sort
(app/Controllers/entryController.php::readAction, non-AJAX redirect).
- Custom user queries: unaffected. A query's link is a self-contained URL built
from that query's own saved parameters, so switching query A -> B never
carried A's sort; no option is needed there.
- Stream transition links when sorting by category/feed name: intentionally
left unchanged (out of scope; the sort is intrinsic to that grouping).
Compatibility
-------------
- Not a breaking change: the default (true) reproduces the previous behaviour.
- No database migration. The setting is a standard user configuration value
with its default declared in config-user.default.php, so existing users keep
the previous behaviour transparently.
- The read/unread state filter still persists across navigation regardless of
this option.
i18n
----
English strings authored; en-US marked as IGNORE. Translations for the other
25 languages were produced with an automated (AI) translation service and
should be reviewed by native speakers.
* Update app/i18n/en/conf.php
Co-authored-by: Frans de Jonge <fransdejonge@gmail.com>
* Comments preference
* Update app/i18n/en/conf.php
Co-authored-by: Frans de Jonge <fransdejonge@gmail.com>
* i18n updates and comment
* Update translations to match reworded sticky_sort strings
Re-applies the 24 non-English/French translations of the "sticky_sort"
reading option after the English and French wording was updated to
"Keep manual sort order during navigation".
* improve Dutch
* i18n DIRTY
* i18n en: custom sort order
---------
Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>
Co-authored-by: Frans de Jonge <fransdejonge@gmail.com>
* Worked on Turkish translation
* Add my name to CREDITS.md
* Run make fix-all
* Fix credits
---------
Co-authored-by: Utku Tibet <utkutibet@Utkus-MacBook-Pro.local>
Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>
* Add SSRF mitigations using `filter_var` and `CURLOPT_RESOLVE`
The idea is to prevent FreshRSS from sending any HTTP requests to internal services, except for the ones that are explicitly allowed in the config.
Based on https://github.com/moodle/moodle/blob/6e82b46a480826d1a85394d9e5087f7d82d1dd52/lib/filelib.php#L3818 and https://github.com/symfony/symfony/blob/8.1/src/Symfony/Component/HttpClient/NoPrivateNetworkHttpClient.phphttps://github.com/FreshRSS/simplepie/pull/76https://github.com/FreshRSS/simplepie/pull/78
* Add allowlist setting in Web UI
* make readme
* Update app/i18n/fr/admin.php
Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>
* make readme again
* make readme
* Further work
Still WIP and needs testing etc.
* Readd previous if check for domain combination allowlist
* Turn POST to GET after redirect
* Improve
* Update config.default.php
Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>
* make readme
* Skip SSRF check if `CURLOPT_PROXY` is set
* make readme
* Fix `!empty()` mistake
* Respect max redirects feed option when fetching with `httpGet()`
* Respect max redirects during SimplePie fetching + fix bypass
bypass fix: `CURLOPT_FOLLOWLOCATION` was moved below so that emulated redirects are enforced.
* Avoid FreshRSS and Minz code in SimplePie
https://github.com/FreshRSS/FreshRSS/pull/8400#discussion_r2935375980
* Corrected hook code
* phpdoc wrong return type
* Add CIDR support in allowlist
* Implement simple DNS caching
* Suppress `dns_get_record()` warnings
* A bit of proof-reading
* Minor typo
* Fix proxy logic
* Fix HTTP POST redirect logic
* Proofread checkCIDR
Add fixes for several situations
* Remove credentials from URL in logs
* Ensure `CURLOPT_FOLLOWLOCATION` is `false` by setting it at the end
* Fix codesniffer long line
* Fix potential bypass due to wrong return value
If there were no records returned by `dns_get_record()`, no overrides to `CURLOPT_RESOLVE` would get passed,
and a potential bypass could occur, when cURL would try to resolve the domain by itself.
* Put the URL at the end in logs
* Add documentation and environment variable support
* make readme
* Fix wrong behavior in case of IP
* Fix duplicate selector in CSS
* Minor type check change
* i18n fr, en
* Minor type check change
* Fix whitespace i18n fr
* make fix-all
* Fix `$ips_ok` not being returned after domain records were cached
* make readme
* PHPStan fix
* make readme
* Minor syntax in SimplePie
* Only return `null` if no allowed IPs were found
* Add wildcard *, help message
* Consistent docs with help message
* i18n: pl
* SimplePie compatibility PHP 7.2
* make fix-all
* Sync SimplePie
* https://github.com/FreshRSS/simplepie/pull/76
* 💥 Breaking change in the Changelog
* Document `INTERNAL_HOST_ALLOWLIST` in Docker docs
* Remove `Cookie` and `Authorization` headers in `httpGet()` during cross-origin redirect
* Minor whitespace
And same comment convention than below
* Remove authentication headers and change POST to GET on redirect in SimplePie
* Remove .local in Docker example
* Fill in default ports when comparing URL origins
* Remove .local from other places than the Docker example
* Rewrite WebSub subscribe to use `httpGet()`
* make fix-all
* Also unset `CURLOPT_USERPWD` during redirects
* phpcs fix
* Always unset `CURLOPT_FOLLOWLOCATION`
* Bump SimplePie
https://github.com/FreshRSS/simplepie/pull/78
* Update logic for CURLOPT_FOLLOWLOCATION
* Fix PHPStan
* Changelog fix security section
* Update most common RSS Bridge case
https://hub.docker.com/r/rssbridge/rss-bridge
* Replace misleading 127.0.0.1:8080 example for Docker
This does not make sense for a Docker container
---------
Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>
* Add a warning message to the API password section, add a log warning when a client uses GET, use POST in sample curl API usage
References #8834.
* Apply suggestion from @Inverle
Co-authored-by: Inverle <inverle@proton.me>
* Apply suggestion from @Inverle (Polish translation)
Co-authored-by: Inverle <inverle@proton.me>
* French translation
* Dutch translation
* German
* Apply suggestion from @Inverle api via post
Co-authored-by: Inverle <inverle@proton.me>
* Apply suggestion from @Inverle via POST (French)
Co-authored-by: Inverle <inverle@proton.me>
* Add user-agent
* update translation info in README
* avoid phpcs line too long
* also trigger on email as suggested by @Inverle
* i18n: fr typography
* make fix-all
---------
Co-authored-by: Inverle <inverle@proton.me>
Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>
Inverle