3 Commits

Include renames

Author	SHA1	Message	Date
Alexandre Alapetite	fd3f75b3a2	Require PHP 8.2+ (#9470) ... Drop PHP 8.1 (EOL December 2025), drop Ubuntu 22.04 (EOL May 2027, and there is now 24.04 and 26.04 LTS). PHP 8.1 is already EOL, and Debian, Alpine, Fedora, Red Hat, Synology have dropped PHP 8.1 already. See https://github.com/FreshRSS/FreshRSS/discussions/5474#discussioncomment-16791937 With PHP 8.6 around the corner and in particular a relevant `FILTER_FLAG_GLOBAL_RANGE` in PHP 8.2+. * https://www.php.net/releases/8.2 * https://www.php.net/filter.constants.validation#constant.filter-flag-global-range * https://www.php.net/class.sensitiveparameter * https://php.watch/versions/8.2/readonly-classes * https://www.php.net/function.ini-parse-quantity Allows updating to PHPUnit 11.x instead of 10.x https://phpunit.de/supported-versions.html Contributes to https://github.com/FreshRSS/FreshRSS/issues/9475 * Add regression test for FILTER_FLAG_GLOBAL_RANGE https://github.com/FreshRSS/FreshRSS/pull/9470#discussion_r4371168720	2026-10-26 21:02:32 +01:00
Alexandre Alapetite	61d7925af1	Config + increase default values for search max length and depth (#9280) ... Fix https://github.com/FreshRSS/FreshRSS/discussions/9279 Follow-up of https://github.com/FreshRSS/FreshRSS/pull/9277 Values can be overridden in `data/config.php`, or in `./data/config.custom.php` before the install process	2026-09-10 22:14:55 +02:00
Ali GündoğarandAlexandre Alapetite	18dfada959	Only allow http/https URI schemes for enclosure and thumbnail URLs (#9272) ... * Only allow http/https URI schemes for enclosure and thumbnail URLs Feed enclosure URLs were stored and rendered without URI scheme validation: SimplePie's scheme check only applies to URLs inside content HTML (Sanitize::replace_urls()), not to enclosure metadata, so a `javascript:` URL survived the whole pipeline and was served as a clickable link in the article view, including through the Google Reader compatible API. Add FreshRSS_http_Util::isAllowedUrlScheme() and apply it: - at store time, when building enclosure attributes in FreshRSS_Feed - at render time, in FreshRSS_Entry::content(), so entries already stored in existing databases are protected as well https://github.com/FreshRSS/FreshRSS/security/advisories/GHSA-3fw6-j8m4-82vj * Reuse existing SimplePie is_remote_uri() function * Use more realistic test examples * Add tests for protocol relative And simplify tests further --------- Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>	2026-09-09 00:14:13 +02:00