35 Commits

Author SHA1 Message Date
Alexandre Alapetite
3a795eb5db Fix regression in ext.php (#8021)
fix https://github.com/FreshRSS/Extensions/issues/370
Regression from https://github.com/FreshRSS/FreshRSS/pull/7857
2025-09-27 14:40:35 +02:00
Alexandre Alapetite
bc3e4c8fa4 Add option for CSP frame-ancestors (#7857)
* Add option for CSP frame-ancestors
https://github.com/FreshRSS/FreshRSS/discussions/7856

* Revert contentSelectorPreviewAction

* Same for f.php and api

* Fix double init in f.php

* No sandbox for API page
2025-09-21 13:29:58 +02:00
Alexis Degrugillier
23ba48c71f Change how files are included (#7916)
1. `include`, `include_once`, `require` and `require_once` are expressions not functions, parentheses are not necessary.
2. to move up the directory tree, it's better to use the `dirname` function instead of relying on `/..`.
2025-09-05 15:56:46 +02:00
Inverle
858616f075 Fixes for no-cache.txt (#7907)
* Closes and fixes error from #7885
* `no-cache.txt` is now respected in `f.php`, `ext.php` and `serve` action in `extensionController`
   * And in all other places that weren't checking for `no-cache.txt` (some extensions maybe)
2025-09-05 08:16:52 +02:00
Inverle
7df6c201f2 Put CSP everywhere (#7810)
* Puts CSP everywhere in `p/api`
   * including the HTML query page 
   * Also in `p/ext.php`
* Puts `X-Content-Type-Options: nosniff` everywhere
* Fixes custom icon configuration not showing `blob:` icon in statsController (idle feeds)
   * Also removes `style-src 'unsafe-inline'` since it doesn't seem to be needed
* Improves CSP of `p/f.php`

* Add `sandbox` directive
2025-08-11 19:35:54 +02:00
Inverle
4568111c00 Fix file serving for symlinked extensions (#7545)
* Fix file serving for symlinked extensions from ext.php

* Don't resolve symlink when deleting extension

* Minor syntax

---------

Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>
2025-05-02 09:47:57 +02:00
Alexandre Alapetite
be73c6d669 Fix regression ext.php (#7499)
fix https://github.com/FreshRSS/FreshRSS/issues/7498
Regression from https://github.com/FreshRSS/FreshRSS/pull/7495
2025-04-08 10:25:42 +02:00
Alexandre Alapetite
0c33d27139 Secure serving of user files from extensions (#7495)
* Secure serving of user files from extensions
fix https://github.com/FreshRSS/FreshRSS/issues/4930

* More fixes

* Typo
2025-04-07 08:47:42 +02:00
Alexandre Alapetite
d3aaefb1f6 Fix ext.php: Restrict valid paths in ext.php for extensions (#7479)
* Fix ext.php: Restrict valid paths in ext.php for extensions
Rework https://github.com/FreshRSS/FreshRSS/pull/7474

* Fix wrong variable
2025-04-01 19:13:27 +02:00
Alexandre Alapetite
5cb73fa220 Restrict valid paths in ext.php for extensions (#7474)
* Restrict valid paths in ext.php for extensions

* Disallow absolute paths as well
2025-04-01 17:53:33 +02:00
maTh
1f624bc5e2 Referrer-Policy: same-origin (#6303)
* Referrer-Policy: same-origin

* same-origin for our own images

---------

Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>
2025-04-01 12:23:56 +02:00
Luc SANCHEZ
15745d42b7 Upgrade code to php 8.1 (#6748)
* revert
Fix code indentation
Fix code

Upgrade code to php 8.1

* fix remarques

* code review

* code review

* code review

* Apply suggestions from code review

* code review

* Fixes

* Many remainging updates of array syntax

* Lost case 'reading-list'

* Uneeded PHPDoc

---------

Co-authored-by: Luc Sanchez <l.sanchez-prestataire@alptis.fr>
Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>
2024-11-28 17:11:04 +01:00
Alexandre Alapetite
a81656c3ed Upgrade to PHP 8.1 (#6711)
* Upgrade to PHP 8.1
As discussed in https://github.com/FreshRSS/FreshRSS/discussions/5474

https://www.php.net/releases/8.0/en.php
https://www.php.net/releases/8.1/en.php

Upgrade to available native type declarations
https://php.net/language.types.declarations

Upgrade to https://phpunit.de/announcements/phpunit-10.html which requires PHP 8.1+ (good timing, as version 9 was not maintained anymore)

Upgrade `:oldest` Docker dev image to oldest Alpine version supporting PHP 8.1: Alpine 3.16, which includes PHP 8.1.22.

* Include 6736
https://github.com/FreshRSS/FreshRSS/pull/6736
2024-09-06 09:06:46 +02:00
Luc SANCHEZ
f99c8d5f54 Modernize code to php7.4 (#6043)
* Modernize code to php7.4

* Modernize code to php7.4

* Modernize code to php7.4

* Modernize code to php7.4

* Modernize code to php7.4

* Modernize code to php7.4

* Modernize code to php7.4

* Modernize code to php7.4

* Modernize code to php7.4

* Modernize code to php7.4

* Modernize code to php7.4

* Modernize code to php7.4

* Modernize code to php7.4

* Consistency

---------

Co-authored-by: Luc <sanchezluc+freshrss@gmail.com>
Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>
2024-06-05 22:04:06 +02:00
Alexandre Alapetite
a80a5f48a1 Pass PHPStan level 8 (#5946)
* Pass PHPStan level 8
And prepare for PHPStan level 9 https://phpstan.org/user-guide/rule-levels

* Revert wrong replace in comment

* Fix PHPStan level 8

* Update PHPStan and other dev dependencies

* Remove obsolete comment

* noVariableVariables and towards bleedingEdge
https://github.com/phpstan/phpstan-strict-rules
https://phpstan.org/blog/what-is-bleeding-edge

* More bleedingEdge

* A bit more PHPStan level 9

* More PHPStan level 9

* Prepare for booleansInConditions
Ignore int and null

* Revert wrong line

* More fixes

* Fix keep_max_n_unread

* Stricter attribute functions

* Stricter callHooks and more PHPStan level 9

* More typing

* A tiny more
2023-12-18 17:59:16 +01:00
Luc SANCHEZ
30c7a61a9b Use strict_types (#5830)
* Little's optimisations and booleans in conditions

* Apply strict type

* Apply strict type

* Apply strict type

* Fix multiple bugs with PHP 8.2 and 8.3

* Many declares missing, more errors fixed

* Apply strict type

* Another approach

* Stronger typing for Minz_Session

* Fix case of SQLite

---------

Co-authored-by: Luc <sanchezluc+freshrss@gmail.com>
Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>
2023-11-16 22:43:00 +01:00
Alexandre Alapetite
4f316b2ed3 PHPStan level 9 for ./p/ and lib_rss.php (#5049)
And app/FreshRSS.php
Contributes to https://github.com/FreshRSS/FreshRSS/issues/4112
2023-01-29 18:53:51 +01:00
Alexandre Alapetite
1d9d4e3e3c Update dev dependencies (#4993)
Related to https://github.com/FreshRSS/FreshRSS/pull/4991
Required a few changes in code to pass the tests
2023-01-09 12:59:30 +01:00
Alexandre Alapetite
ed578f224c Security fix in ext.php (#4928)
Details later.
Due to https://github.com/FreshRSS/FreshRSS/pull/3433 (1.18.0)
2022-12-08 10:25:57 +01:00
Alexandre Alapetite
e86c10e2f5 Composer require php extensions (#4497)
#fix https://github.com/FreshRSS/FreshRSS/discussions/4494
2022-08-10 09:36:54 +02:00
Alexandre Alapetite
3f6aa42b81 Fix most PHPDocs errors (#4107)
Contributes to https://github.com/FreshRSS/FreshRSS/issues/4103
https://phpstan.org/writing-php-code/phpdoc-types
2022-01-01 11:26:56 +01:00
Alexandre Alapetite
00dbde68fb Fix some PHPstan errors (#4019)
Fix some wrong variables found by https://github.com/FreshRSS/FreshRSS/issues/4016
2021-12-02 23:30:13 +01:00
Alexandre Alapetite
947e918f05 Travis: Enforce phpcs line length + whitespace (#3488)
* Update Travis line length

* Also check whitespace in CSS files

* Fix line length ext.php

* More syntax, string templates

* Fix exclude-pattern

* Test JS files as well
2021-02-28 12:26:24 +01:00
Alexis Degrugillier
0ce798d40b Add support for extension user files (#3433)
Extension user files can be stored easily in the user folder instead of the static folder.
2021-02-26 18:42:10 +01:00
Alexis Degrugillier
d7cfea155f Fix extension file search (#3413)
Before, it was possible to retrieve only the files from extensions. Thus
making core extension files unreachable.
Now, the selected file is search through all extensions folders.
2021-02-02 14:27:34 +01:00
Alexis Degrugillier
bed710b260 Refactor extension file script (#3399) 2021-02-02 00:00:51 +01:00
Alexandre Alapetite
cd49e9819b New core-extensions to allow Docker volumes for third-party extensions (#2837)
* New core-extensions to allow Docker volumes for third-party extensions

#Fix https://github.com/FreshRSS/FreshRSS/issues/2650
Split our extensions directory into two:
1) Core extensions shipped with FreshRSS in ./lib/core-extensions/
2) Third-party extensions modified by end-users in ./extensions/ which
can easily be mounted as a Docker volume

* Example of Docker Compose with extensions

* Back-compatibility + fix array merge bug
2020-03-22 16:31:20 +01:00
Marien Fressinaud
7533676ae7 Add support for images to the ext.php endpoint (#2465) 2019-07-31 13:49:29 +02:00
Alexandre Alapetite
74f92658b7 Fix for extensions on Windows (#2348)
https://github.com/FreshRSS/FreshRSS/issues/994
https://github.com/FreshRSS/FreshRSS/issues/2287
2019-04-06 14:07:19 +02:00
Girish Ramakrishnan
fa3532dc8e Use realpath of EXTENSIONS_PATH (#1911)
This handles the case where the extensions directory might be a symlink
2018-06-01 23:19:23 +02:00
Alexandre Alapetite
52d0988655 Use __DIR__ for relative include and require
For uniformity, and to avoid having PHP searching in include_path.
http://php.net/manual/function.include.php
https://github.com/FreshRSS/FreshRSS/pull/1715
https://github.com/FreshRSS/FreshRSS/pull/1711#issuecomment-350581350
2017-12-11 21:11:34 +01:00
Marien Fressinaud
a2da70fd11 Fix security hole from ext.php script.
Now, ext.php can only serve file under a EXTENSIONS_PATH/ext_dir/static/ directory.
A 400 Bad Request error will be returned for other files.

See https://github.com/FreshRSS/FreshRSS/issues/252
And https://github.com/FreshRSS/FreshRSS/commit/f9b037742a0aeb49cab86782d1a59913c2de47b
2014-12-05 10:54:44 +01:00
Marien Fressinaud
f9b037742a Update ext.php to serve any file from extensions
Add an extension->getFileUrl() method to facilitate url generation
2014-12-04 20:41:01 +01:00
Alexandre Alapetite
5a9b08e084 Primitive extension system: minor change
https://github.com/marienfressinaud/FreshRSS/issues/252
2014-10-05 12:38:13 +02:00
Alexandre Alapetite
febabccdd5 Primitive extension system
https://github.com/marienfressinaud/FreshRSS/issues/252
I have been using this extension system for a little while, in
particular to include custom CSS and/or JavaScript (inclusion of PHP
code is not done yet).
There is very little code and it does not impact performances.
I hurry to post it before
https://github.com/marienfressinaud/FreshRSS/issues/655
2014-10-05 12:14:22 +02:00