Commit Graph

1302 Commits

Author SHA1 Message Date
Inverle
118356ee58 Fix cancellation of slider exit (#7705)
Previously when you clicked the "Cancel" button inside of the confirm dialog, the slider would close anyway.
2025-06-30 20:18:17 +02:00
Inverle
32146bd849 Rework #7646: URLSearchParams -> JSON.stringify (#7704)
* Rework #7646: `URLSearchParams` -> `JSON.stringify`

* Single quotes

* Send `id` as int
2025-06-30 12:32:56 +02:00
Inverle
7915abd833 Implement custom feed favicons (#7646)
Closes #3789, #6503

Icon setting when no custom icon is set yet:

![image](https://github.com/user-attachments/assets/28b07dd0-7dac-4c76-b1d7-77035f91a87a)

- `Change...` button opens a file dialog, and after selecting a file shows the chosen icon in the preview on the left. `Submit` must be clicked after selecting the icon.
- `Reset to default` changes the preview icon to the default one, and also requires `Submit` to be clicked to apply the changes.

Full list of changes:
- CSP now includes `blob:` in `img-src` for
   - `indexAction()` and `feedAction()` in `subscriptionController.php`
   - all of the view actions in `indexController.php`
- Introduce new attribute `customFavicon (boolean)` for feeds that indicates if the feed has a custom favicon
   - `hashFavicon()` in `Feed.php` is dependent on this attribute
      - `hashFavicon()` has a new parameter called `skipCache (boolean)` that allows the reset of the favicon hash for the Feed object
      - `resetFaviconHash()` just calls `hashFavicon(skipCache: true)`
- `f.php` URLs now have the format of `/f.php?h=XXXXX&t=cachebuster`, where the `t` parameter is only used for serving custom favicons
   - if `t` parameter is set, `f.php` returns a `Cache-Control: immutable` header
- `stripos` and `strpos` were changed to `str_contains` in various places (refactor)
- JS for handling the custom favicon configuration logic is in `extra.js` inside `init_update_feed()` which is called when feed configuration is opened from the aside or when the subscription management page with the feed is loaded
   - Server-side code for uploading the icon in `subscriptionController.php` under `feedAction()`
   - Errors that may occur during the setting of a custom favicon:
      - Unsupported image file type (handled only server-side with `isImgMime()`)
      - When the file is bigger than 1 MiB (default), handled both client-side and server-side
      - Standard feed error when `updateFeed()` fails
- JS vars `javascript_vars.phtml` are no longer escaped with `htmlspecialchars()`, instead with json encoding,
- CSS for disabled buttons was added
- Max favicon file size is configurable with the `max_favicon_upload_size` option in `config.php` (not exposed via UI)
- Custom favicons are currently deleted only when they are either reset to the default icon, or the feed gets deleted. They do not get deleted when the user deletes their account without removing their feeds first.
- ` faviconPrepare()` and `faviconRebuild()` are not allowed to be called when the `customFavicon` attribute is `true`
- New i18n strings:
   - `'sub.feed.icon' => 'Icon'`
   - `'sub.feed.change_favicon' => 'Change…'`
   - `'sub.feed.reset_favicon' => 'Reset to default'`
   - `'sub.feed.favicon_changed_by_ext' => 'The icon has been set by the <b>%s</b> extension.'`
   - `'feedback.sub.feed.favicon.too_large' => 'Uploaded icon is too large. The maximum file size is <em>%s</em>.'`
   - `'feedback.sub.feed.favicon.unsupported_format' => 'Unsupported image file format!'`
- Extension hook `custom_favicon_hash`
   - `setCustomFavicon()` method
   - `resetCustomFavicon()` method
   - `customFaviconExt` and `customFaviconDisallowDel` attributes
   - example of usage: https://github.com/FreshRSS/Extensions/pull/337
- Extension hook `custom_favicon_btn_url`
   - Allows extensions to implement a button for setting a custom favicon for individual feeds by providing an URL. The URL will be sent a POST request with the `extAction` field set to either `query_icon_info` or `update_icon`, along with an `id` field which describes the feed's ID.
2025-06-30 12:01:56 +02:00
Alexandre Alapetite
0bca0d8afc API add support for states in s streamId (#7695)
https://github.com/Ashinch/ReadYou/issues/1081#issuecomment-3009682580

Some other implementations allow `s` to target states:
* https://www.inoreader.com/developers/stream-ids
* https://github.com/theoldreader/api/blob/master/README.md#item-ids
* https://feedhq.readthedocs.io/en/latest/api/reference.html#stream-items-ids

I find this behaviour redundant with `it`, but for the sake of compatibility
2025-06-29 14:11:02 +02:00
Inverle
a6948218fb frame-ancestors CSP (#7677) 2025-06-18 22:20:17 +02:00
Alexandre Alapetite
cc35094bb2 Add API endpoint for extensions (#7576)
* Add API endpoint for extensions
Useful for https://github.com/FreshRSS/FreshRSS/issues/7572

* Support PATH_INFO
Now also support being invoked like `/api/misc.php/Extension%20Name/`

* More  documentation
2025-06-03 00:16:17 +02:00
Inverle
dd5ea7ab4e Include remaining tags/attributes for lazy loading (#7636)
* Include remaining tags/attributes for lazy loading

* Suggested change
2025-06-03 00:14:50 +02:00
Inverle
464921108b Fix user self-deletion (#7626)
* Fix user self-deletion

* Minor code cleanup
2025-05-31 21:43:18 +02:00
Alexandre Alapetite
80c9623f8f API fix default category (#7610)
fix https://github.com/FreshRSS/FreshRSS/issues/7368
2025-05-31 13:01:27 +02:00
Inverle
84d4aeb9e6 Implement loading spinner for marking as favorite/read, read/unread (#7564)
* Implement loading spinner for marking as favorite

* Ensure that the correct previous icon gets set

* Remove delay

* Improve compatibility with various parsers

Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>

* Support multiple icons (top, bottom)

* Remove preload for now

* Fix CSS, remove !important

* Implement read/unread and alt

* Ensure correct bookmark icon gets set after error

---------

Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>
2025-05-10 21:06:58 +02:00
CarelessCaution
c6f09e1ae4 Fix favicon hashing in GReader API (#7573)
* Fix favicon hashing in GReader API (#7570)

This allows the correct iconUrl to be returned from the GReader API for
a given feed.

* Fix method signature

* Fix Fever API

---------

Co-authored-by: CarelessCaution <189675655+CarelessCaution@users.noreply.github.com>
Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>
2025-05-09 23:41:31 +02:00
Alexandre Alapetite
f2a7af03e8 Remove Apache 2.2 (only support Apache 2.4+) (#7561)
Follow-up of https://github.com/FreshRSS/FreshRSS/pull/7552
I cannot find any distribution still supporting Apache 2.2
2025-05-07 14:45:43 +02:00
Alexandre Alapetite
91d32acfdc HTTP Cache-Control immutable (#7552)
Start using `Cache-Control: immutable` for some resources served with a timestamp.
https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Cache-Control#immutable
The `<If>` directive requires Apache 2.4+
2025-05-07 10:53:59 +02:00
Inverle
4568111c00 Fix file serving for symlinked extensions (#7545)
* Fix file serving for symlinked extensions from ext.php

* Don't resolve symlink when deleting extension

* Minor syntax

---------

Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>
2025-05-02 09:47:57 +02:00
Alexandre Alapetite
9374b7745f Themes fix CSS .as-link (#7526)
* Themes fix CSS .as-link
Add missing rules.
fix https://github.com/FreshRSS/FreshRSS/pull/7489#issuecomment-2781146577

* More fixes
2025-04-27 22:30:52 +02:00
Alexandre Alapetite
be73c6d669 Fix regression ext.php (#7499)
fix https://github.com/FreshRSS/FreshRSS/issues/7498
Regression from https://github.com/FreshRSS/FreshRSS/pull/7495
2025-04-08 10:25:42 +02:00
Alexandre Alapetite
0c33d27139 Secure serving of user files from extensions (#7495)
* Secure serving of user files from extensions
fix https://github.com/FreshRSS/FreshRSS/issues/4930

* More fixes

* Typo
2025-04-07 08:47:42 +02:00
Alexandre Alapetite
d858053a7c Use HTTP POST for logout (#7489)
* Use HTTP POST for logout
To avoid potential CSRF risks

* Fixed button font issue

* Minor whitespace
2025-04-05 23:15:37 +02:00
Frans de Jonge
711a14fd9c Add :focus style to .dropdown-menu .item (#7491)
So you can see keyboard focus.

In reply to <https://github.com/FreshRSS/FreshRSS/pull/7489#issuecomment-2774759046>.
2025-04-05 22:23:54 +02:00
maTh
92c9293865 fix regression mapco/ansum theme (#7490)
fix of https://github.com/FreshRSS/FreshRSS/pull/7489#discussion_r2023760515

Regression #7314
2025-04-03 22:50:29 +02:00
Alexandre Alapetite
d3aaefb1f6 Fix ext.php: Restrict valid paths in ext.php for extensions (#7479)
* Fix ext.php: Restrict valid paths in ext.php for extensions
Rework https://github.com/FreshRSS/FreshRSS/pull/7474

* Fix wrong variable
2025-04-01 19:13:27 +02:00
Alexandre Alapetite
5cb73fa220 Restrict valid paths in ext.php for extensions (#7474)
* Restrict valid paths in ext.php for extensions

* Disallow absolute paths as well
2025-04-01 17:53:33 +02:00
Alexandre Alapetite
aa3867ae12 Partial revert Referrer-Policy (#7478)
https://github.com/FreshRSS/FreshRSS/pull/6303#issuecomment-2768907702
Was already implemented conditionally
https://github.com/FreshRSS/FreshRSS/pull/1198
2025-04-01 12:38:37 +02:00
maTh
1f624bc5e2 Referrer-Policy: same-origin (#6303)
* Referrer-Policy: same-origin

* same-origin for our own images

---------

Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>
2025-04-01 12:23:56 +02:00
Alexandre Alapetite
426e3054c2 Add CSP to favicons (#7471)
E.g. for the case of SVGs
2025-04-01 09:27:33 +02:00
Alexandre Alapetite
d0b9611319 Update bcrypt.js from 2.4.4 to 3.0.2 (#7449)
https://github.com/dcodeIO/bcrypt.js/releases/tag/v3.0.0
Can be updated to the latest version with:
`curl -L https://unpkg.com/bcryptjs/umd/index.js > p/scripts/vendor/bcrypt.js`
2025-03-25 10:19:51 +01:00
hkcomori
9e8c306b3e JavaScript: new event to detect context loaded (#7452)
* Add JavaScript event: freshrss:globalContextLoaded

* Update docs

* Update docs: fix typo
2025-03-25 10:18:33 +01:00
maTh
0217c83979 Themes: .btn padding + small adjustments (#7168)
Closes https://github.com/FreshRSS/FreshRSS/issues/6262

Changes proposed in this pull request:

- CSS: the search button was too big/not flexible enough for the height because of the padding


How to test the feature manually:

1. browser configuration: change the default font size from (`16`pt mostly) to `15` or `14`
2. go to subscription management -> `Subscription tools`
3. there should be no scroll bar (because the left hand side navigation is short and the content right hand side is short too)

Side effect: All buttons will be a bit smaller as before (because `px` -> `rem`) It should not be an issue at all
2025-03-22 23:31:08 +01:00
Alexandre Alapetite
72ad6e528c Fix API for labels with slash (#7437)
fix https://github.com/FreshRSS/FreshRSS/issues/7435
2025-03-22 23:16:59 +01:00
maTh
7de384bf9c Mark as read button: config for the size (#7314)
* settings

* i18n: mark_read_button

* big, small, none

* fix

* Fixes

* make fix-all

---------

Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>
2025-03-13 23:10:48 +01:00
Dezponia
df545b513b Add check for Apache mod_filter to ensure "AddOutputFilterByType" works. (#7419)
* Update .htaccess

Add check for Apache mod_filter to ensure "AddOutputFilterByType" works.

* Explicit enabling mod_filter in our Docker images

---------

Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>
2025-03-13 22:40:26 +01:00
maTh
b9a6c943b2 improve origine theme (#7413)
* improve origine theme

* .nav_menu .btn
2025-03-07 00:20:21 +01:00
maTh
a697ca54ad Shortcuts for adding labels (#7274)
* add shortcut in config

* open my labels menu with shortcut

* the first 9 items are selectable + input field

* i18n

* Update app/i18n/nl/conf.php

Co-authored-by: Frans de Jonge <fransdejonge@gmail.com>

* index.menu.mylabels

* order fixed

---------

Co-authored-by: Frans de Jonge <fransdejonge@gmail.com>
2025-02-03 08:47:25 +01:00
maTh
f72f5e9523 Improve notification banner (#7268)
* a -> button

* i18n: Close

* a.close -> .close

* themes

* Apply suggestions from code review

Co-authored-by: UserRoot-Luca <55756898+UserRoot-Luca@users.noreply.github.com>
Co-authored-by: Frans de Jonge <fransdejonge@gmail.com>

* Update app/i18n/fr/gen.php

---------

Co-authored-by: UserRoot-Luca <55756898+UserRoot-Luca@users.noreply.github.com>
Co-authored-by: Frans de Jonge <fransdejonge@gmail.com>
Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>
2025-01-31 13:58:57 +01:00
maTh
afb6f788fa Improve stats page layout (#7243)
* New stats box layout

* repartition: table overview improved with links and icons

* Show selected feed name in title

* i18n string: overview

* fix

* fix

* fix

* delete unused stat in frss

* Update app/i18n/fr/admin.php

---------

Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>
2025-01-21 23:45:22 +01:00
maTh
f2c820dccd fix global view unread articles counter (#7247) 2025-01-21 23:40:03 +01:00
Alexandre Alapetite
825ccf5556 Hide base theme (#7234) 2025-01-21 23:31:40 +01:00
maTh
3fda6f6bf5 smaller "mark as read" button in mobile view (#5220)
* wip

* fix
2025-01-21 23:30:45 +01:00
Alexandre Alapetite
466b955165 Remove local reference to fonts/OpenSans (#7215) 2025-01-12 22:46:40 +01:00
maTh
82b1d999dc New: About page with env information (#7161)
* infobox

* i18n

* CSS improved

* themes

* Update app/views/index/about.phtml

Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>

* Update app/views/index/about.phtml

Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>

* Environment information => System information

* Issue templates: Env info -> System info

* i18n: IT

Co-authored-by: UserRoot-Luca <55756898+UserRoot-Luca@users.noreply.github.com>

* i18n: DE

* Update app/i18n/it/index.php

Co-authored-by: UserRoot-Luca <55756898+UserRoot-Luca@users.noreply.github.com>

* added: php_uname()

* i18n: fr

* Add database version

---------

Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>
Co-authored-by: UserRoot-Luca <55756898+UserRoot-Luca@users.noreply.github.com>
2025-01-10 08:31:44 +01:00
Alexandre Alapetite
5368f38753 Reduce undeeded use of elvis operator ?: (#7204) 2025-01-10 08:13:09 +01:00
Alexandre Alapetite
1f466d7a2e Implement custom order-by (#7149)
Add option to sort results by received date (existing, default), publication date, title, URL (link), random.

fix https://github.com/FreshRSS/FreshRSS/issues/1771
fix https://github.com/FreshRSS/FreshRSS/issues/2083
fix https://github.com/FreshRSS/FreshRSS/issues/2119
fix https://github.com/FreshRSS/FreshRSS/issues/2596
fix https://github.com/FreshRSS/FreshRSS/issues/3204
fix https://github.com/FreshRSS/FreshRSS/issues/4405
fix https://github.com/FreshRSS/FreshRSS/issues/5529
fix https://github.com/FreshRSS/FreshRSS/issues/5864
fix https://github.com/FreshRSS/Extensions/issues/161

URL parameters:
* `&sort=id` (current behaviour, sorting according to newest received articles)
* `&sort=date` (publication date, which is not indicative of how new an article is)
* `&sort=title`
* `&sort=link`
* `&sort=rand` (random order - which disables infinite scrolling, at least for now)

combined with `&order=ASC` or `&order=DESC`

![image](https://github.com/user-attachments/assets/2de5aef1-604e-4a73-a147-569f6f42a1be)

## Implementation notes

The sorting criteria by *received date* (id), which is the default, and which was the only one before this PR, is the one that has the best sorting characteristics:
* *uniqueness*: no entries have the exact same received date
* *monotonicity*: new entries always have a higher received date
* *performance*: this field is efficiently indexed in database for fast usage, including for paging (indexing could also be done to other fields, but with lower effective performance)

In contrary, sorting criteria such as by *publication date*, by *title*, or by *link* are neither unique nor monotonic. In particular, multiple articles may share the same *publication date*, and we may receive articles with a *publication date* far in the future, and then later some new articles with a *publication date* far in the past.

To understand why sorting by *publication date* is problematic, it helps to think about sorting by *title* or by *link*, as sorting by *title* and by *publication date* share more or less the same characteristics.

### Problem 1: new articles

New articles may be received in the background after what is shown on screen, and before the next user action such as *mark all as read*. Due to the lack of *monotonicity* when sorting by e.g. *publication date* or *title*, users risk marking as read a batch of articles containing some fresh articles without seeing them.

Mitigation: A parameter `idMax` tracks the maximum ID related to a batch of actions such as *mark all as read* to exclude articles received after those that are displayed.

### Problem 2: paging / pagination

When navigating articles, only a few articles are displayed, and a new "page" of articles needs to be received from the database when scrolling down or when clicking the button to show more articles. When sorting by e.g. *publication date* or *title*, it is not trivial to show the next page without re-showing some of the same articles, and without skipping any. Indeed, views are often with additional criteria such as showing only unread articles, and users may mark some articles as read while viewing them, hereby removing some articles from the previous pages. And like for *Problem 1*, new articles may have been received in the background. Consequently, it is not possible to use `OFFSET` to implement pagination (so the patches suggested by a few users were wrong due to that, in particular).

Mitigation: `idMax` is also used (just like for *Problem 1*) and a *Keyset Pagination* approach is used, combining an unstable sorting criterion such as *publication date* or *title*, together with *id* to ensure stable sorting. (So, 2 sorting criteria + 1 filter criteria)

See e.g. https://www.alwaysdeveloping.net/dailydrop/2022/07/01-keyset-pagination/

### Problem 3: performance

Sorting by anything else than *received date* (id) is doomed to be slow(er) due to the combination of 3 criteria (see *Problem 2*). An `OFFSET` approach (which is not possible anyway as explained) would be even slower. Furthermore, we have no SQL index at the moment, but they would not necessarily help much due to the multiple sorting criteria needed and involving some `OR` logic which is difficult to optimise for databases.

The nicest syntax would be using tuples and corresponding indexes, but that is poorly supported by MySQL https://bugs.mysql.com/bug.php?id=104128

Mitigation: a compatibility SQL syntax is used to implement *Keyset Pagination*

### Problem 4: user confusion

Several users have shown that they do not fully understand the difference between *received date* and *publication date*, and particularly not the pitfalls of *publication date*.

Mitigation: the menus to mark-as-read *before 1 day* and *before 1 week* are disabled when sorting by anything else than *received date*. Likewise, the separation headers *Today* and *Yesterday* and *Before yesterday* are only shown when sorting by *received date*.

Again here, to better understand why, it helps to think about sorting by *title* or by *link*, as sorting by *title* and by *publication date* share more or less the same characteristics.

* [ ] We should write a Q&A and/or documentation about the problems associated to *sorting by publication date*: risks of not noticing new publication, of inadvertently marking them as read, of having some articles with a date in the future hanging at the top of the views (vice versa when sorting in ascending order), performance, etc.

### Problem 5: APIs

Sorting by anything else than *received date* breaks the guarantees needed for a successful synchronisation via API.

Mitigation: sorting by *received date* is ensured for all API calls.
2025-01-06 16:00:00 +01:00
Alexandre Alapetite
05d9a5ddf8 Fix access to manifest (#7158)
* Fix access to manifest
fix https://github.com/FreshRSS/FreshRSS/issues/7157

* Casing
2024-12-29 12:54:50 +01:00
Alexandre Alapetite
c29cbb7b8b Fix regressions on some array structures (#7155)
regressions from https://github.com/FreshRSS/FreshRSS/pull/7131
fix https://github.com/FreshRSS/FreshRSS/issues/7154
2024-12-28 23:58:00 +01:00
Alexandre Alapetite
33cdfbb309 Hint .htaccess (#7153)
https://github.com/FreshRSS/FreshRSS/discussions/7145
2024-12-27 21:32:44 +01:00
Alexandre Alapetite
b1d24fbdb7 PHPStan 2.0 (#7131)
* PHPStan 2.0
fix https://github.com/FreshRSS/FreshRSS/issues/6989
https://github.com/phpstan/phpstan/releases/tag/2.0.0
https://github.com/phpstan/phpstan/blob/2.0.x/UPGRADING.md

* More

* More

* Done

* fix i18n CLI

* Restore a PHPStan Next test
For work towards PHPStan Level 10

* 4 more on Level 10

* fix getTagsForEntry

* API at Level 10

* More Level 10

* Finish Minz at Level 10

* Finish CLI at Level 10

* Finish Controllers at Level 10

* More Level 10

* More

* Pass bleedingEdge

* Clean PHPStan options and add TODOs

* Level 10 for main config

* More

* Consitency array vs. list

* Sanitize themes get_infos

* Simplify TagDAO->getTagsForEntries()

* Finish reportAnyTypeWideningInVarTag

* Prepare checkBenevolentUnionTypes and checkImplicitMixed

* Fixes

* Refix

* Another fix

* Casing of __METHOD__ constant
2024-12-27 12:12:49 +01:00
Alexandre Alapetite
897e4a3f4a Search in all feeds (#7144)
* Search in all feeds
Search in PRIORITY_ARCHIVED with `&get=A`
fix https://github.com/FreshRSS/FreshRSS/discussions/7143

* Fix type

* Search in PRIORITY_ARCHIVED with `&get=Z`

* More

* Fixes

* One more fix

* Extra features in user queries

* Move i18n key

* Fix overview

* Enlarge query boxes

* Revert i18n spelling

* i18n: it

Thanks @UserRoot-Luca

Co-authored-by: UserRoot-Luca <55756898+UserRoot-Luca@users.noreply.github.com>

---------

Co-authored-by: UserRoot-Luca <55756898+UserRoot-Luca@users.noreply.github.com>
2024-12-27 12:03:59 +01:00
maTh
1d10b3697d new: reader view: footer has manage icons (#7133)
* add footer

* rename content thin medium large class

* rework css

* footer improved
2024-12-26 19:05:18 +01:00
maTh
3b87372061 fix: sharing menu entry id (#7113)
* fix sharing menu entry id

* Update main.js
2024-12-18 11:02:29 +01:00
Frans de Jonge
12c659fb2f Always prevent default regardless of window.open() return status (#7089)
* Always prevent default regardless of window.open() return status

Fixes regression noted in https://github.com/FreshRSS/FreshRSS/pull/7077#discussion_r1879016226

* Update p/scripts/main.js

Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>

---------

Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>
2024-12-11 14:47:01 +01:00