Commit Graph

293 Commits

Author SHA1 Message Date
Inverle
18b5c8ec6d Handle redirects when scraping feed from HTML (#7654)
* Handle redirects when scraping feed from HTML

* pass codesniffer

* pass PHPStan

* Optimize

* Another approach relying on HTML base
Standard way to save an HTML document with relative references

* Fix case of existing HTML base
which should not be overriden

---------

Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>
2025-06-22 00:09:18 +02:00
Inverle
a6948218fb frame-ancestors CSP (#7677) 2025-06-18 22:20:17 +02:00
Inverle
dd5ea7ab4e Include remaining tags/attributes for lazy loading (#7636)
* Include remaining tags/attributes for lazy loading

* Suggested change
2025-06-03 00:14:50 +02:00
Alexandre Alapetite
5f45df3168 Strip more styles attributes (#7606)
Strip `bgcolor`, `text`, `background`, `link`, `alink`, `vlink`
fix https://github.com/FreshRSS/FreshRSS/issues/7604
2025-05-23 22:12:05 +02:00
Alexandre Alapetite
532d229d33 Fix newest articles not shown (#7577)
* Fix newest articles not shown
Case when processing was faster than 1 second.
fix https://github.com/FreshRSS/FreshRSS/issues/7412
Regression from https://github.com/FreshRSS/FreshRSS/pull/7149

* Simplify uTimeString()
PHPStan has become a bit smarter
2025-05-10 23:17:25 +02:00
Alexandre Alapetite
3f187395ea Move PHP minimum version check (#7560)
It is too late to check for minimum version check in `lib_rss.php` because that file already contains some relatively new PHP language constructs, which will lead to a syntax error - when running with an old PHP version - instead of the expected error message.
Moved to `constants.php` for now.

Example of syntax error with PHP 7.4:
```
PHP Parse error:  syntax error, unexpected '|', expecting '{' in /var/www/FreshRSS/lib/lib_rss.php on line 166
```

Should help users like in:
* https://github.com/FreshRSS/FreshRSS/discussions/7539
* https://github.com/FreshRSS/FreshRSS/issues/7557
2025-05-07 10:47:09 +02:00
Inverle
4568111c00 Fix file serving for symlinked extensions (#7545)
* Fix file serving for symlinked extensions from ext.php

* Don't resolve symlink when deleting extension

* Minor syntax

---------

Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>
2025-05-02 09:47:57 +02:00
Alexandre Alapetite
6bb8680ae0 HTTP Auth disallow multiple headers (#7528)
When using HTTP Auth methods (including OpenID Connect), exactly 1 HTTP header should be received, not more.
2025-04-28 22:51:54 +02:00
Alexandre Alapetite
f58dea6a5a SimplePie forbit formaction attribute (#7506)
Sanitize buttons with a form or formaction attribute.
2025-04-13 00:01:09 +02:00
Alexandre Alapetite
d3d9acca9f Web scraping forbid security headers in cURL (#7496)
Prevent using `Remote-User`, `X-WebAuth-User` during Web scraping.
2025-04-07 08:33:13 +02:00
Alexandre Alapetite
54e2f9107d Disallow iframe srcdoc for now (#7494)
We do not sanitize this attribute well enough, so striped for now.
It is rarely used: I have not seen any use of it in any of my many test feeds.
Can be added back when we can handle its inherent security issues better.
2025-04-06 00:47:45 +02:00
maTh
1f624bc5e2 Referrer-Policy: same-origin (#6303)
* Referrer-Policy: same-origin

* same-origin for our own images

---------

Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>
2025-04-01 12:23:56 +02:00
Alexandre Alapetite
d7ca2f8768 Doc force-https (#7259)
* Doc force-https
https://github.com/FreshRSS/FreshRSS/discussions/7252#discussioncomment-11951183

* Forgotten ^

* More proper support for comments
2025-01-26 23:19:44 +01:00
Alexandre Alapetite
22b74b0a57 Improve cURL proxy options (#7231)
3 is now used for CURLPROXY_HTTPS2
f07612cd9a/include/curl/curl.h (L789)
Related to https://github.com/FreshRSS/FreshRSS/issues/7209
2025-01-25 09:14:08 +01:00
Alexandre Alapetite
50adb55982 Add some missing PHP native types (#7191)
* Add some missing PHP native types
Replaces https://github.com/FreshRSS/FreshRSS/pull/7184

* Clean some types
2025-01-08 13:26:09 +01:00
Alexandre Alapetite
b1d24fbdb7 PHPStan 2.0 (#7131)
* PHPStan 2.0
fix https://github.com/FreshRSS/FreshRSS/issues/6989
https://github.com/phpstan/phpstan/releases/tag/2.0.0
https://github.com/phpstan/phpstan/blob/2.0.x/UPGRADING.md

* More

* More

* Done

* fix i18n CLI

* Restore a PHPStan Next test
For work towards PHPStan Level 10

* 4 more on Level 10

* fix getTagsForEntry

* API at Level 10

* More Level 10

* Finish Minz at Level 10

* Finish CLI at Level 10

* Finish Controllers at Level 10

* More Level 10

* More

* Pass bleedingEdge

* Clean PHPStan options and add TODOs

* Level 10 for main config

* More

* Consitency array vs. list

* Sanitize themes get_infos

* Simplify TagDAO->getTagsForEntries()

* Finish reportAnyTypeWideningInVarTag

* Prepare checkBenevolentUnionTypes and checkImplicitMixed

* Fixes

* Refix

* Another fix

* Casing of __METHOD__ constant
2024-12-27 12:12:49 +01:00
Luc SANCHEZ
15745d42b7 Upgrade code to php 8.1 (#6748)
* revert
Fix code indentation
Fix code

Upgrade code to php 8.1

* fix remarques

* code review

* code review

* code review

* Apply suggestions from code review

* code review

* Fixes

* Many remainging updates of array syntax

* Lost case 'reading-list'

* Uneeded PHPDoc

---------

Co-authored-by: Luc Sanchez <l.sanchez-prestataire@alptis.fr>
Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>
2024-11-28 17:11:04 +01:00
Alexandre Alapetite
ffc3d393e5 SimplePie support for HTTP cache policies (#6812)
* SimplePie support for HTTP cache policies
Discussion in https://github.com/FreshRSS/simplepie/pull/26

* Bump SimplePie commit

* Typos

* Typos

* Simpler logic

* Explicitly disable cache for non-GET flows

* Bump SimplePie commit

* Bump SimplePie commit

* Bump SimplePie commit

* Bump SimplePie commit
2024-09-20 23:25:38 +02:00
Artur Weigandt
882deab455 Allow SimplePie updates with composer (#4374)
* rename lib/SimplePie to lib/CustomSimplePie

* add test for autoloading SimplePie with PSR-0

* install SimplePie 1.6.0

* Add SimplePie CHANGELOG.md, ignore irrelevant files

* remove unmodified custom classes

* rename all customized SimplePie classes

* Add autoloading for SimplePie PSR-0 and CustomSimplePie classes

* let CustomSimplePie extends SimplePie, remove unchanged code

* let CustomSimplePieMisc extends SimplePie\Misc, remove unchanged code

* Add tests for autoloading

* let CustomSimplePieContentTypeSniffer extends Sniffer, remove unchanged code

* remove unchanged CustomSimplePieEnclosure class

The fixed typos are commited to SimplePie
See 133eac158c

* let CustomSimplePieFile extends SimplePie\File, remove unchanged code

* let CustomSimplePieParser extends SimplePie\Parser, remove unchanged code

* let CustomSimplePieSanitize extends SimplePie\Sanitize, remove unchanged code

* let CustomSimplePieHttpParser extends SimplePie\HTTP\Parser, remove unchanged code

* Remove CustomSimplePie

* Switch SimplePie repo to https://github.com/FreshRSS/simplepie.git

* move to latest branch, update all SimplePie source files

* Use namespaced SimplePie classes, remove SimplePie library folder

* Update to latest SimplePie version with FreshRSS modifications

* Bump SimplePie
Tests expected to fail due to missing a backport of functionalities

* Add fork-specific readme

* Re-implement initial syslog SimplePie GET
https://github.com/FreshRSS/FreshRSS/pull/815
Lacks https://github.com/FreshRSS/FreshRSS/pull/6061

* Closer backport of syslog SimplePie GET
https://github.com/FreshRSS/FreshRSS/pull/6061
But the requests logs will be in the wrong order in case of redirections

* Fixes

* lib update

* SimplePie include a few more files

* Try with cache-hash branch

* Point to newer commit

* Point to newer commit

* Finalise logs

* Finalise

* Bump SimplePie commit

* Bump SimplePie commit

* Readme SimplePie fork

* Bump SimplePie commit

* Better logging

* Bump SimplePie commit

* Reworked approach to work with SimplePie cache
Simpler FreshRSS patches

* Bump SimplePie commit
https://github.com/FreshRSS/simplepie/pull/22

* Simplepie846
https://github.com/FreshRSS/simplepie/pull/23
And additional fixes

* Remove log

* Cherry pick relevant unmerged SimplePie PRs

---------

Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>
2024-09-14 23:11:10 +02:00
Alexandre Alapetite
dfac9f5813 PHPStan booleansInConditions (#6793)
* PHPStan booleansInConditions

* Uniformisation
2024-09-11 17:14:53 +02:00
Alexandre Alapetite
a81656c3ed Upgrade to PHP 8.1 (#6711)
* Upgrade to PHP 8.1
As discussed in https://github.com/FreshRSS/FreshRSS/discussions/5474

https://www.php.net/releases/8.0/en.php
https://www.php.net/releases/8.1/en.php

Upgrade to available native type declarations
https://php.net/language.types.declarations

Upgrade to https://phpunit.de/announcements/phpunit-10.html which requires PHP 8.1+ (good timing, as version 9 was not maintained anymore)

Upgrade `:oldest` Docker dev image to oldest Alpine version supporting PHP 8.1: Alpine 3.16, which includes PHP 8.1.22.

* Include 6736
https://github.com/FreshRSS/FreshRSS/pull/6736
2024-09-06 09:06:46 +02:00
Alexandre Alapetite
c480e57161 Fix HTTP cache of user queries (#6718)
fix https://github.com/FreshRSS/FreshRSS/issues/6717
2024-08-16 22:40:56 +02:00
Alexandre Alapetite
d2247221bb Minor update whitespace PHPCS rules (#6666)
* Minor update whitespace PHPCS rules
To simplify our configuration, apply more rules, and be clearer about what is added or removed compared with PSR12.
Does not change our current conventions, but just a bit more consistent.

* Forgotten *.phtml

* Sort exclusion patterns + add a few for Extensions repo

* Relaxed some rules
2024-08-01 20:31:40 +02:00
Alexandre Alapetite
5b28a35003 Pass PHPStan level 9 (#6544)
* More PHPStan

* More, passing

* 4 more files

* Update to PHPStan 1.11.4
Needed for fixed bug: Consider numeric-string types after string concat
https://github.com/phpstan/phpstan/releases/tag/1.11.4

* Pass PHPStan level 9
Start tracking booleansInConditions

* Fix mark as read

* Fix doctype

* ctype_digit
2024-06-09 20:32:12 +02:00
Alexandre Alapetite
3cd90a2b1f Fix HTTP GET curl options (#6492)
fix https://github.com/FreshRSS/FreshRSS/issues/6491
Regression from https://github.com/FreshRSS/FreshRSS/pull/6177
2024-05-25 18:27:12 +02:00
Alexandre Alapetite
2d17c020b6 PHPStan 1.11 + minor update dev dependencies (#6459)
* PHPStan 1.11 + minor update dev dependencies
https://github.com/phpstan/phpstan/releases/tag/1.11.0

* Comment style
2024-05-15 08:57:58 +02:00
Alexandre Alapetite
7aaed6092f SimplePie replace iframe allow attribute (#6274)
* SimplePie strip iframe allow attribute
https://developer.mozilla.org/en-US/docs/Web/HTML/Element/iframe#allow

Besides security, the `allow autoplay` atttribute is especially problematic on mobile (Firefox on Android) as it asks to open the YouTube app as soon as the article is opened.

Example of code before:

```html
<iframe data-original="https://www.youtube.com/embed/??????feature=oembed" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share" referrerpolicy="strict-origin-when-cross-origin" allowfullscreen="" sandbox="allow-scripts allow-same-origin"></iframe>
```

* Replace allow attribute

* Allow more
2024-04-11 08:48:50 +02:00
Alexandre Alapetite
e3c86a164d HTTP Get allow UTF-8 even when charset is far from top (#6271)
* HTTP Get allow UTF-8 even when charset is far from top
fix https://github.com/FreshRSS/FreshRSS/issues/5586

The case was an HTML document with 15k whitespace then 1.2k of scripts before the `<meta charset="utf-8">` (far from the 1024 bytes suggested by the spec..., and too far for DOMDocument)

* Rewording

* Trim also vertical tab + comment
2024-04-06 23:02:50 +02:00
Alexandre Alapetite
d0072b9fb7 Refactor some cURL options and use CURLOPT_USERPWD (#6177)
* Refactor some cURL options and use CURLOPT_USERPWD
fix https://github.com/FreshRSS/FreshRSS/issues/6176

* Fixes
2024-03-10 23:04:17 +01:00
Alexandre Alapetite
5e54d5bc58 Reduce API memory consumption (#6137)
`echo json_encode(...)` is very memory demanding for large responses, so optimised.
Contributes to https://github.com/FreshRSS/FreshRSS/issues/6136
https://github.com/FreshRSS/FreshRSS/pull/6013#discussion_r1506779881
2024-03-01 10:08:25 +01:00
Alexandre Alapetite
7d6a64a522 Web scraping support encodings such as EUC-JP (#6112)
* Web scraping support encodings such as EUC-JP
fix https://github.com/FreshRSS/FreshRSS/issues/6106

* Typo
2024-02-18 10:53:44 +01:00
Alexandre Alapetite
06570b30f0 composer update (#6075)
Update PHPStan, fixing some bugs needed for https://github.com/FreshRSS/FreshRSS/pull/6052
(One syntax fix caught by new version)
Update also PHPUnit
2024-01-30 12:57:14 +01:00
Alexandre Alapetite
314077a457 PHPStan prepare exceptions (#6037)
Take advantage of
https://phpstan.org/blog/bring-your-exceptions-under-control

Minimum changes to pass `tooWideThrowType` and `implicitThrows`.

Revert some mistakes from:
https://github.com/FreshRSS/FreshRSS/pull/5504
Preparation needed before new PRs of the same type:
https://github.com/FreshRSS/FreshRSS/pull/5962

Fix several wrong PHPDocs and catches:

> Method ... has ...Exception in PHPDoc @throws tag but it's not thrown.

> Dead catch - ...Exception is never thrown in the try block.
2024-01-15 10:36:30 +01:00
eta-orionis
9c97d8ca72 JSONFeeds, JSON scraping, and POST requests for feeds (#5662)
* allow POST requests for feeds

* added json dotpath and jsonfeed subscriptions. No translation strings yet

* debug and fix jsonfeed parser

* bugfix params saved when editing feed

* added translations for JSON features

* Update docs for web scraping

* make fix-all
and revert unrelated changes, plus a few manual fixes, but there are still several type errors

* Fix some i18n

* refactor json parsing for both feed types

* cleanup unnecessary comment

* refactored generation of SimplePie for XPath and JSON feeds

* Fix merge error

* Update to newer FreshRSS code

* A bit of refactoring

* doc, whitespace

* JSON Feed is in two words

* Add support for array syntax

* Whitespace

* Add OPML export/import

* Work on i18n

* Accept application/feed+json

* Rework POST

* Fix update

* OPML for cURL options

* Fix types

* Fix Typos

---------

Co-authored-by: Erion Elmasllari <elmasllari@factorsixty.com>
Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>
2024-01-10 08:23:45 +01:00
Alexandre Alapetite
a80a5f48a1 Pass PHPStan level 8 (#5946)
* Pass PHPStan level 8
And prepare for PHPStan level 9 https://phpstan.org/user-guide/rule-levels

* Revert wrong replace in comment

* Fix PHPStan level 8

* Update PHPStan and other dev dependencies

* Remove obsolete comment

* noVariableVariables and towards bleedingEdge
https://github.com/phpstan/phpstan-strict-rules
https://phpstan.org/blog/what-is-bleeding-edge

* More bleedingEdge

* A bit more PHPStan level 9

* More PHPStan level 9

* Prepare for booleansInConditions
Ignore int and null

* Revert wrong line

* More fixes

* Fix keep_max_n_unread

* Stricter attribute functions

* Stricter callHooks and more PHPStan level 9

* More typing

* A tiny more
2023-12-18 17:59:16 +01:00
Alexandre Alapetite
b65ea97901 Fix PHP 7 compatibility strict_types (#5893)
* Fix PHP 7 compatibility
https://github.com/FreshRSS/FreshRSS/discussions/5892

* Multiple PHP 7 fixes

* PHPStan
2023-11-18 23:21:20 +01:00
Luc SANCHEZ
30c7a61a9b Use strict_types (#5830)
* Little's optimisations and booleans in conditions

* Apply strict type

* Apply strict type

* Apply strict type

* Fix multiple bugs with PHP 8.2 and 8.3

* Many declares missing, more errors fixed

* Apply strict type

* Another approach

* Stronger typing for Minz_Session

* Fix case of SQLite

---------

Co-authored-by: Luc <sanchezluc+freshrss@gmail.com>
Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>
2023-11-16 22:43:00 +01:00
Joe Stump
641b891972 Fix trusted cidrs check (#5853)
* Fix ignored TRUSTED_PROXY issue

* Add a sub-section to the docs no property mappings for Authentik

* Typo

* Fix typing

* A few changes to the doc

---------

Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>
2023-11-11 08:40:51 +01:00
Alexandre Alapetite
1c7c1016f4 Fix JSON export/import (#5626)
* Fix import with empty content
fix https://github.com/FreshRSS/FreshRSS/issues/5622
Cherry picks on https://github.com/FreshRSS/FreshRSS/pull/5584

* Fix export of tags / labels
Article-defined tags were wrongly exported as user-defined labels.

* Fix export of tags / labels
Article-defined tags were wrongly exported as user-defined labels.

* Fix bug with many labels

* Better typing

* Comments
2023-09-04 10:09:37 +02:00
Alexandre Alapetite
e7689459f2 Rework trusted proxies (#5549)
* Rework trusted proxies
Fix https://github.com/FreshRSS/FreshRSS/issues/5502
Follow-up of https://github.com/FreshRSS/FreshRSS/pull/3226

New environment variable `TRUSTED_PROXY`: set to 0 to disable, or to a list of trusted IP ranges compatible with https://httpd.apache.org/docs/current/mod/mod_remoteip.html#remoteiptrustedproxy

New internal environment variable `CONN_REMOTE_ADDR` to remember the true IP address of the connection (e.g. last proxy), even when using mod_remoteip.

Current working setups should not observe any significant change.

* Minor whitespace

* Safer trusted sources during install
Rework of https://github.com/FreshRSS/FreshRSS/pull/5358
https://github.com/FreshRSS/FreshRSS/issues/5357

* Minor readme
2023-07-30 12:59:18 +02:00
Luc SANCHEZ
7f9594b8c7 fix many "Only booleans are allowed in an if condition" (#5501)
* fix many "Only booleans are allowed in an if condition"

* Update cli/create-user.php

Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>

* Update cli/i18n/I18nUsageValidator.php

Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>

* Fix several regressions and other minor things

* Fix another regression

* Update lib/http-conditional.php

Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>

---------

Co-authored-by: Luc <sanchezluc+freshrss@gmail.com>
Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>
2023-07-07 21:53:17 +02:00
Alexandre Alapetite
0292b2f1f3 Improve Dev Container (#5423)
* Improve Dev Container
PHPStan was failing in Dev Container

* Update Docker to Alpine Linux 3.18
* New DATA_PATH environment variable

* README
2023-05-28 18:03:34 +02:00
Alexandre Alapetite
6e2f2f1c1e A few additional PHPStan rules (#5388)
A subset of
https://github.com/phpstan/phpstan-strict-rules
2023-05-11 13:02:04 +02:00
maTh
54c8de86c7 docs: language table added (#5375)
* docs: language table added

* Update 05_Configuration.md

* Update 05_Configuration.md

* french docs

* Unicode quote and a few fixes
(Same search&replace aslo applied to a few other files)

---------

Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>
2023-05-07 21:35:08 +02:00
Alexandre Alapetite
30c69ef147 Use PHPStan dynamicConstantNames (#5370)
https://phpstan.org/config-reference#constants
Avoid a few phpstan-ignore-next-line
2023-05-04 19:47:54 +02:00
Alexandre Alapetite
0a38aa7456 Automatic trusted_sources during install (#5358)
* Automatic trusted_sources during install
Fix https://github.com/FreshRSS/FreshRSS/issues/5357

* Fix install for http_auth

* Update lib/lib_rss.php

Co-authored-by: Luc SANCHEZ <4697568+ColonelMoutarde@users.noreply.github.com>

* Fill null exception e-mail

* Revert some syntax

* Minor parentheses
2023-05-03 00:37:04 +02:00
Alexandre Alapetite
5579dc88ab Better XPath failure (#5317)
Report feeds as errored for more cases
2023-04-20 08:21:37 +02:00
Alexandre Alapetite
ecd956c736 PHPStan 7 configureController (#5318)
And fix bugs for saving user queries
2023-04-20 00:55:10 +02:00
Alexandre Alapetite
687d0b40a8 Fix safe_ascii (#5311)
Fix https://github.com/FreshRSS/FreshRSS/issues/5310
2023-04-17 19:53:54 +02:00
Alexandre Alapetite
f3760f138d Complete PHPStan Level 6 (#5305)
* Complete PHPStan Level 6
Fix https://github.com/FreshRSS/FreshRSS/issues/4112
And initiate PHPStan Level 7

* PHPStan Level 6 for tests
* Use phpstan/phpstan-phpunit
* Update to PHPStan version 1.10

* Fix mixed bug

* Fix mixed return bug

* Fix paginator bug

* Fix FreshRSS_UserConfiguration

* A couple more Minz_Configuration bug fixes

* A few trivial PHPStan Level 7 fixes

* A few more simple PHPStan Level 7

* More files passing PHPStan Level 7
Add interface to replace removed class from https://github.com/FreshRSS/FreshRSS/pull/5251

* A few more PHPStan Level 7 preparations

* A few last details
2023-04-17 08:30:21 +02:00