Commit Graph

106 Commits

Author SHA1 Message Date
Luc SANCHEZ
30c7a61a9b Use strict_types (#5830)
* Little's optimisations and booleans in conditions

* Apply strict type

* Apply strict type

* Apply strict type

* Fix multiple bugs with PHP 8.2 and 8.3

* Many declares missing, more errors fixed

* Apply strict type

* Another approach

* Stronger typing for Minz_Session

* Fix case of SQLite

---------

Co-authored-by: Luc <sanchezluc+freshrss@gmail.com>
Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>
2023-11-16 22:43:00 +01:00
Luc SANCHEZ
f8f163d054 Chore/processing of depreciations and updating code to php72 minimum (#5504)
* processing of depreciations and updating of code to php7.2 minimum

* Autoformat many strange array indenting
And revert a few unwanted changes

---------

Co-authored-by: Luc <sanchezluc+freshrss@gmail.com>
Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>
2023-07-07 22:36:27 +02:00
Alexandre Alapetite
2038d50110 PHPStan Level 7 for Minz_Request, FreshRSS_Feed, Minz_Error (#5400)
* PHPStan Level 7 for Minz_Request

* PHPStan Level 7 for FreshRSS_Feed

* PHPStan Level 7 for Minz_Error
2023-05-15 19:26:48 +02:00
Alexandre Alapetite
fe7d9bbcd6 Typed view model classes (#5380)
* Typed view model classes
* Add ability to provide a typed view model class to a controller
* Use `::class` instead of string for referring to classes
* Examplified with `stats` and `javascript` controllers / views (more to do)
* Also useful for extensions (my usecase today), which did not have the ability to define own view model attributes before.

* Typo
2023-05-11 12:53:32 +02:00
Alexandre Alapetite
6c01e4e7d6 Use typed access to request parameters (#5267)
* Use typed access to request parameters
This was a big source of mixed datatypes in many places

* Fix notifications

* Fix bookmarkAction
2023-04-07 00:13:49 +02:00
Alexandre Alapetite
36aa0122e1 Fix extensions in actualize_script (#5243)
* Fix extension freshrss_user_maintenance in actualize_script
Follow-up of https://github.com/FreshRSS/FreshRSS/pull/3440

The hook was called before registering all the extensions for the current user

* PHPStan Level 6 for extensions
And remove 5-year old legacy format of enabled extensions < FreshRSS 1.11.1

* Fix multiple bugs in extensions

* Minor typing

* Don't change signature of methods supposed to be overridden

* PHPStan Level 9 and compatibility Intelliphense

* Set as final the methods not supposed to be overriden
2023-04-04 10:23:26 +02:00
maTh
068d18b69b Add: <meta name="theme-color"> (#5105)
* implemented

* themes' metadata.json

* fix

* fix

* retrigger tests

* Update lib/Minz/View.php

Co-authored-by: Luc SANCHEZ <4697568+ColonelMoutarde@users.noreply.github.com>

* Update lib/Minz/View.php

Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>

* Update lib/Minz/View.php

Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>

* Update lib/Minz/View.php

Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>

* fix

---------

Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>
Co-authored-by: Luc SANCHEZ <4697568+ColonelMoutarde@users.noreply.github.com>
2023-03-04 15:05:58 +01:00
Alexandre Alapetite
4f316b2ed3 PHPStan level 9 for ./p/ and lib_rss.php (#5049)
And app/FreshRSS.php
Contributes to https://github.com/FreshRSS/FreshRSS/issues/4112
2023-01-29 18:53:51 +01:00
Alexandre Alapetite
dbdb7869c4 Safer timezone set (#5021)
* Safer timezone set
Add missing tzdata in Docker :newest
Fallback to UTC if no timezone is defined at all
#fix https://github.com/FreshRSS/FreshRSS/pull/4906#issuecomment-1386747169

* Better refactoring
Show fallback timezone everywhere
2023-01-19 18:26:04 +01:00
Alexandre Alapetite
6261dc9cf4 User-defined time zone (#4906)
* User-defined time zone
#fix https://github.com/FreshRSS/FreshRSS/issues/2754

* Update app/i18n/nl/conf.php

Co-authored-by: Frans de Jonge <fransdejonge@gmail.com>

* Timezone when creating a new user

Co-authored-by: Frans de Jonge <fransdejonge@gmail.com>
2022-11-29 15:27:32 +01:00
Alexandre Alapetite
f89819bd64 Custom logo HTML (#4369)
* Custom logo HTML
Add option for custom HTML logo/title in the main Web UI view.
Can potentially be different per user.
#fix https://github.com/FreshRSS/FreshRSS/pull/3830/files#r850472247

* logo_html in main config
With new `./data/config.custom.php` to provide custom values before install

* Docker documentation

* whitespace

* Auto relax CSP to allow images for HTML logo

* Documentation
2022-05-23 14:03:19 +02:00
Alexandre Alapetite
1acd3ab09b Use typographic quotes (#4133)
* Use typographic quotes

* A few fixes

* Fix

* Fix not saved

* Implement feedback

* Detail

* Revert spoken English fixes
Left for a future dedicated discussion

* More reverts

* Final reverts

* Final minor
2022-01-08 21:58:55 +01:00
Alexandre Alapetite
77e9877316 Add PHPStan (#4021)
* Add PHPStan
#fix https://github.com/FreshRSS/FreshRSS/issues/4016
https://phpstan.org/

```sh
composer run-script phpstan
```

* More fixes

* Fix global variables

* Add .phtml

* Fix merge
https://github.com/FreshRSS/FreshRSS/pull/4090

* Fix more warnings

* Fix view errors and enable in CI

* ReturnTypeWillChange

* Dynamic view type

* Fix Minz static/self bug
2021-12-31 17:00:51 +01:00
maTh
fce021aad6 Themes incl javascript files (#3739)
* it works

* optimized
2021-08-04 12:26:18 +02:00
Alexandre Alapetite
947e918f05 Travis: Enforce phpcs line length + whitespace (#3488)
* Update Travis line length

* Also check whitespace in CSS files

* Fix line length ext.php

* More syntax, string templates

* Fix exclude-pattern

* Test JS files as well
2021-02-28 12:26:24 +01:00
hesch
13b03b232b refactor: remove referer checks, as they are no longer needed (replaced by csrf tokens) (#3432) 2021-02-11 17:38:39 +01:00
Alexandre Alapetite
9c6682e7ed Avoid manual initialisations of system or user configuration (#3070)
* Avoid manual intialisations of system or user configuration

More consistent use of Context

* Simplify FreshRSS_Context::initUser

* Remove a few manual get_user_configuration

* A bit of debugging

* Fix context user init

* Fix install

* Fix concurrency

Concurrent requests could lead to bad race condition

* Fix actualize cron

Fix case when system i initialised several times
2021-01-02 21:20:19 +01:00
Alexandre Alapetite
5ca961b8d5 Fix bugs in anomymous mode (#3305)
* Fix bugs in anomymous mode

Login bug (submit button not working) and refresh bug (JS null
exception, and then 403).

* Take advantage of existing variable
2020-12-31 00:13:29 +01:00
Alexandre Alapetite
8dad63de02 Fix initI18n (#3249)
* Fix initI18n

#fix
https://github.com/FreshRSS/FreshRSS/issues/3246#issuecomment-725463337
#fix https://github.com/FreshRSS/FreshRSS/issues/3136

It was due to calling `initI18n()` before `FreshRSS_Context` is
intialised in some situations

Introduced by https://github.com/FreshRSS/FreshRSS/pull/3022
Will be better fixed when https://github.com/FreshRSS/FreshRSS/pull/3070
lands

* Fallback condition
2020-11-11 23:03:15 +01:00
Alexandre Alapetite
7652369359 Minz: Attach a notification to a request (#3208)
* Minz: Attach a notification to a request

Notifications should be attached to a request, not to a global session.
Fix
https://github.com/FreshRSS/FreshRSS/pull/3096#issuecomment-654891906
Prepare https://github.com/FreshRSS/FreshRSS/pull/3096

* Rename array

* Avoid string constants

Implement
https://github.com/FreshRSS/FreshRSS/pull/3208#issuecomment-703243863

* Improved logic

* Simplify storage

https://github.com/FreshRSS/FreshRSS/pull/3208#discussion_r499511213

* Fix notification bug in configuration/system
2020-10-05 19:03:33 +02:00
Alexis Degrugillier
36bda2e715 Add language detection when the user is not logged in (#3022)
Before, when the user was not logged in, pages where translated with the '_' user language.
Now, they are translated with the user preferred language if there is one supported by FreshRSS or with the system default language.
2020-06-05 10:10:46 +02:00
Marien Fressinaud
582a0041a9 Don't check email if feature disabled or for admin (#2917) 2020-04-20 17:48:41 +02:00
Frans de Jonge
25666ec5d3 [UI] Add RTL support with RTLCSS (#2776)
* Add dir info to gen.php & install.php!

* Add `make rtl` command

Using rtlcss because it has actually has a command-line application!
2020-03-01 21:15:17 +01:00
Marien Fressinaud
7802fd33a6 tec: Allow to change CSP header from controllers
For an extension, I needed to call a script from an external domain.
Unfortunately, the CSP headers didn't allow this domain and I had to
patch manually the FreshRSS FrontController for my extension. It's
obviously not a long-term solution since it has nothing to do in the
core of FRSS, and I don't want to apply this patch manually at each
update.

With this patch, I allow changing the CSP header from inside the
controller actions. It allows extensions to modify headers. It's also an
opportunity to remove a bit of code from the FrontController. I wasn't
happy with the previous implementation anyhow.

Reference: https://github.com/flusio/xExtension-Flus/commit/ed12d56#diff-ff12e33ed31b23bda327499fa6e84eccR143
2019-12-22 15:01:02 +01:00
Marien Fressinaud
68c006b7ad fix: Allow to refresh feeds if user isn't verified (#2694)
While I was looking at the number of articles of my users, I discovered
some of them had none, while having a bunch of feeds though. I took a
look at the logs generated by `app/actualize_script.php` and discovered
that the script stopped strangely (in this example, "OK" for denise is
expected, and more users too):

```
FreshRSS[1681]: FreshRSS Start feeds actualization...
Starting feed actualization at 2019-11-29T16:37:19+00:00
Actualize alice...
Actualize denise...
Results:
alice OK
denise
```

After digging a bit, I quickly realized the script stopped always on
users who didn't validate their emails. And indeed, we trigger a
`Minz_Request::forward(..., true)` for these users, in the `FreshRSS`
class. This function calls the `exit` function, which stops the script.

This patch only allows the feed#actualize action to be executed for
unverified users in order to avoid an early-`exit`. This is a quick-win
solution, but I don't think it's a good one on the long term. I'll
propose an alternative in another patch, later.
2019-12-03 22:27:20 +01:00
Marien Fressinaud
84f9311fd5 fix: Fix "validate email"-related issues (#2512)
* fix: Make sure $disable_aside is initialized

There was a warning for an uninitialized variable, hidden in production
but visible in development mode.

* fix: Allow to delete account when email isn't validated
2019-08-29 18:08:43 +02:00
Marien Fressinaud
75632e70f0 Provide email address verification feature (#2481)
* Add an email field to the profile page

I reuse the `mail_login` from the configuration. I'm not sure if it's
useful today (I would say it was used when Persona login was available).

A good improvement would be to rename `mail_login` into `email` so it
would be more intuitive to use.

* Add boolean to the conf to force email validation

This commit only adds a configuration item.

* Add email during registration if email must be validated

* Set email token to validate when email changes

* Block access to FreshRSS if email is not validated

* Send email when address is changed

* Allow to resend the validation email

* Allow the user to change its email while blocked

* Document the email validation feature

* fixup! Allow the user to change its email while blocked

* tec: Autoload PHPMailer lib

* Validate email address format

* Add feedback on validation email resend action

* Allow to logout when user is blocked

* fix: Change default email "from"

* Reorganize i18n keys

* Complete all the locales with default english

* Hide sidebar (profile page) if email is not validated

* Check email requirements on registration

* Allow admin to specify email when creating users

* Don't check email format if value is empty

* Remove trailing comma in userController

Co-Authored-By: Alexandre Alapetite <alexandre@alapetite.fr>

* Set PHPMailer validator to html5 before sending email

* fixup! Remove trailing comma in userController
2019-08-29 12:02:05 +02:00
Marien Fressinaud
7fd88adeb0 Add hooks to ExtensionManager (#2482)
Hooks allow to:

- add items in menus
- perform new actions at the end of FreshRSS initialization
2019-08-14 22:19:24 +02:00
Alexandre Alapetite
caeeeb52ca Fix user self registration (#2442)
* Fix user self registration

Fix https://github.com/FreshRSS/FreshRSS/issues/2381

* CSRF for admin
2019-07-21 11:05:51 +02:00
Alexandre Alapetite
ebd8c31c02 Rework CSRF interaction with sessions (#2290)
* Rework CSRF interaction with sessions

Fix https://github.com/FreshRSS/FreshRSS/issues/2288
Improve security in some edge cases
Maybe relevant for
https://github.com/FreshRSS/FreshRSS/issues/2125#issuecomment-474992671

* Forgotten mime type
2019-03-22 19:05:38 +01:00
Alexandre Alapetite
75356c64a2 Remove deprecated CSP child-src
It's been probably long enough since
https://github.com/FreshRSS/FreshRSS/pull/1099
2019-02-13 17:18:21 +01:00
Alexandre Alapetite
2374374ba9 Less jQuery (#2234)
* Less jQuery

Follow-up of https://github.com/FreshRSS/FreshRSS/pull/2199

* Even less jQuery + global view unread title fix

* Even less jQuery

* Yet even less jQuery

* Even less jQuery

* Reduce some events

* Even less jQuery

* jQuery gone from main view

+Fixed English i18n

* Fix feed folded view

* Remove Firefox 64 workaround

Remove workaround for Gecko bug 1514498 in Firefox 64, fixed in Firefox
65

* Split to extra.js

Avoid loading unneeded JavaScript code for the main view.
+ several adjustements

* Improve CSS transition fold category

* Rewrite shortcuts

Remove library. Much faster, shorter, one listener instead of many.
Control of the shortcut context.
Fix https://github.com/FreshRSS/FreshRSS/issues/2215

* Remove debug

* Minor syntax

* Filter out unwanted shortcut modifiers

* Menu overflow fix

* Typo

* Fix unfolding in mobile view

* Remove jQuery from category.js

* Remove jQuery from Global view
2019-02-13 15:06:28 +01:00
Alexandre Alapetite
1cc891be35 Remove some preload / prefetch (#2040)
* Remove next prefetch

This approach was only efficient in the specific case when no change was
made (no mark-as-read, favourites, tags), and useless in the other
situations.
Removed to reduce server load.

* Remove next prefetch from JavaScript too

* Remove some preload / prefetch

While useful for the first request, those preload / prefetch hints are
slightly negative for the following requets, especially server-side,
e.g. generating one log entry in Apache, and a bit more network traffic.

* Revert mistake

* Remove comment

https://github.com/FreshRSS/FreshRSS/pull/2040#discussion_r223214915
2018-10-14 00:35:43 +02:00
Alexandre Alapetite
a66b995be7 Explicit quotes decoding (#1947)
* Explicit quotes decoding

* Explicit htmlspecialchars_decode and htmlspecialchars
2018-06-22 16:07:48 +02:00
Alexandre Alapetite
b8094f8044 Move shares (#1812)
From ./data/ to ./app/
Fix manual updates like
https://github.com/FreshRSS/FreshRSS/issues/1803#issuecomment-369371907
Left for later: support a ./data/shares.local.php for user-defined
shares.
2018-03-03 15:06:22 +01:00
Alexandre Alapetite
38de643d09 Small fix Mastodon share
$a['method'] can be undefined.
https://github.com/FreshRSS/FreshRSS/pull/1674
https://github.com/FreshRSS/FreshRSS/issues/1521
2017-11-04 21:34:34 +01:00
Alexis Degrugillier
afffbfce07 Add a Mastodon share (#1674)
See #1521
2017-11-04 21:19:51 +01:00
Alexandre Alapetite
3a5427ea7f Change CSS load order to help CustomCSS extension
https://github.com/FreshRSS/Extensions/issues/13
2017-05-26 14:00:52 +02:00
Alexandre Alapetite
af8960b8b3 Move default configuration files
https://github.com/FreshRSS/FreshRSS/issues/1531
2017-05-12 23:33:58 +02:00
Alexandre Alapetite
e6e8cac3c4 Allow extensions for default accout in anonymous mode
https://github.com/FreshRSS/FreshRSS/issues/1257#issuecomment-248111169
2016-10-06 21:00:02 +02:00
Alexandre Alapetite
a180485f91 sticky-kit fix, and compatible async defer
And set correct parent option
https://github.com/FreshRSS/FreshRSS/pull/1172
2016-08-13 23:39:52 +02:00
Alexandre Alapetite
0c4add6913 Merge conflicts
https://github.com/FreshRSS/FreshRSS/pull/1172
2016-08-13 21:35:34 +02:00
Alexandre Alapetite
e6fd34bdda CSRF token, update HTTP Referrer policy to same-origin
https://www.w3.org/TR/referrer-policy/#referrer-policy-no-referrer
https://github.com/FreshRSS/FreshRSS/issues/570
https://github.com/FreshRSS/FreshRSS/issues/955
https://github.com/FreshRSS/FreshRSS/issues/1198
https://github.com/FreshRSS/FreshRSS/issues/565
https://github.com/FreshRSS/FreshRSS/issues/554
2016-08-13 17:49:31 +02:00
Alexandre Alapetite
c1548e732d Remove Mozilla Persona login
https://github.com/FreshRSS/FreshRSS/issues/1052
2016-07-31 14:58:19 +02:00
romibi
d9e14621b5 Make Sidebar Sticky 2016-07-08 19:39:02 +02:00
Alexandre Alapetite
6466fc87ec Load styles for two JSON cases 2016-04-29 18:24:46 +02:00
Alexandre Alapetite
805ec6392c Revert; Notifications needed also for non-layout requests 2016-04-23 23:12:08 +02:00
Alexandre Alapetite
b042d3a772 HTTP2 optimization
Fast flush HTTP headers, push promise CSS.
Requires PHP 5.3+ due to anonymous function.
Do not load syles, scripts, and notifications for Ajax requests.
https://github.com/FreshRSS/FreshRSS/issues/1089
2016-04-23 19:10:32 +02:00
Alexandre Alapetite
44be16d4fb X-Content-Type-Options: nosniff
https://github.com/FreshRSS/FreshRSS/issues/1114
2016-03-08 18:28:04 +01:00
Alexandre Alapetite
cbac2afd23 CSP compatibility with Firefox older than 45
https://github.com/FreshRSS/FreshRSS/pull/1075
https://github.com/FreshRSS/FreshRSS/pull/1078
https://developer.mozilla.org/en-US/Firefox/Releases/45#Security
https://bugzilla.mozilla.org/show_bug.cgi?id=1045891
2016-03-01 21:56:19 +01:00