Commit Graph

95 Commits

Author SHA1 Message Date
Alexandre Alapetite
1acd3ab09b Use typographic quotes (#4133)
* Use typographic quotes

* A few fixes

* Fix

* Fix not saved

* Implement feedback

* Detail

* Revert spoken English fixes
Left for a future dedicated discussion

* More reverts

* Final reverts

* Final minor
2022-01-08 21:58:55 +01:00
Alexandre Alapetite
77e9877316 Add PHPStan (#4021)
* Add PHPStan
#fix https://github.com/FreshRSS/FreshRSS/issues/4016
https://phpstan.org/

```sh
composer run-script phpstan
```

* More fixes

* Fix global variables

* Add .phtml

* Fix merge
https://github.com/FreshRSS/FreshRSS/pull/4090

* Fix more warnings

* Fix view errors and enable in CI

* ReturnTypeWillChange

* Dynamic view type

* Fix Minz static/self bug
2021-12-31 17:00:51 +01:00
maTh
fce021aad6 Themes incl javascript files (#3739)
* it works

* optimized
2021-08-04 12:26:18 +02:00
Alexandre Alapetite
947e918f05 Travis: Enforce phpcs line length + whitespace (#3488)
* Update Travis line length

* Also check whitespace in CSS files

* Fix line length ext.php

* More syntax, string templates

* Fix exclude-pattern

* Test JS files as well
2021-02-28 12:26:24 +01:00
hesch
13b03b232b refactor: remove referer checks, as they are no longer needed (replaced by csrf tokens) (#3432) 2021-02-11 17:38:39 +01:00
Alexandre Alapetite
9c6682e7ed Avoid manual initialisations of system or user configuration (#3070)
* Avoid manual intialisations of system or user configuration

More consistent use of Context

* Simplify FreshRSS_Context::initUser

* Remove a few manual get_user_configuration

* A bit of debugging

* Fix context user init

* Fix install

* Fix concurrency

Concurrent requests could lead to bad race condition

* Fix actualize cron

Fix case when system i initialised several times
2021-01-02 21:20:19 +01:00
Alexandre Alapetite
5ca961b8d5 Fix bugs in anomymous mode (#3305)
* Fix bugs in anomymous mode

Login bug (submit button not working) and refresh bug (JS null
exception, and then 403).

* Take advantage of existing variable
2020-12-31 00:13:29 +01:00
Alexandre Alapetite
8dad63de02 Fix initI18n (#3249)
* Fix initI18n

#fix
https://github.com/FreshRSS/FreshRSS/issues/3246#issuecomment-725463337
#fix https://github.com/FreshRSS/FreshRSS/issues/3136

It was due to calling `initI18n()` before `FreshRSS_Context` is
intialised in some situations

Introduced by https://github.com/FreshRSS/FreshRSS/pull/3022
Will be better fixed when https://github.com/FreshRSS/FreshRSS/pull/3070
lands

* Fallback condition
2020-11-11 23:03:15 +01:00
Alexandre Alapetite
7652369359 Minz: Attach a notification to a request (#3208)
* Minz: Attach a notification to a request

Notifications should be attached to a request, not to a global session.
Fix
https://github.com/FreshRSS/FreshRSS/pull/3096#issuecomment-654891906
Prepare https://github.com/FreshRSS/FreshRSS/pull/3096

* Rename array

* Avoid string constants

Implement
https://github.com/FreshRSS/FreshRSS/pull/3208#issuecomment-703243863

* Improved logic

* Simplify storage

https://github.com/FreshRSS/FreshRSS/pull/3208#discussion_r499511213

* Fix notification bug in configuration/system
2020-10-05 19:03:33 +02:00
Alexis Degrugillier
36bda2e715 Add language detection when the user is not logged in (#3022)
Before, when the user was not logged in, pages where translated with the '_' user language.
Now, they are translated with the user preferred language if there is one supported by FreshRSS or with the system default language.
2020-06-05 10:10:46 +02:00
Marien Fressinaud
582a0041a9 Don't check email if feature disabled or for admin (#2917) 2020-04-20 17:48:41 +02:00
Frans de Jonge
25666ec5d3 [UI] Add RTL support with RTLCSS (#2776)
* Add dir info to gen.php & install.php!

* Add `make rtl` command

Using rtlcss because it has actually has a command-line application!
2020-03-01 21:15:17 +01:00
Marien Fressinaud
7802fd33a6 tec: Allow to change CSP header from controllers
For an extension, I needed to call a script from an external domain.
Unfortunately, the CSP headers didn't allow this domain and I had to
patch manually the FreshRSS FrontController for my extension. It's
obviously not a long-term solution since it has nothing to do in the
core of FRSS, and I don't want to apply this patch manually at each
update.

With this patch, I allow changing the CSP header from inside the
controller actions. It allows extensions to modify headers. It's also an
opportunity to remove a bit of code from the FrontController. I wasn't
happy with the previous implementation anyhow.

Reference: https://github.com/flusio/xExtension-Flus/commit/ed12d56#diff-ff12e33ed31b23bda327499fa6e84eccR143
2019-12-22 15:01:02 +01:00
Marien Fressinaud
68c006b7ad fix: Allow to refresh feeds if user isn't verified (#2694)
While I was looking at the number of articles of my users, I discovered
some of them had none, while having a bunch of feeds though. I took a
look at the logs generated by `app/actualize_script.php` and discovered
that the script stopped strangely (in this example, "OK" for denise is
expected, and more users too):

```
FreshRSS[1681]: FreshRSS Start feeds actualization...
Starting feed actualization at 2019-11-29T16:37:19+00:00
Actualize alice...
Actualize denise...
Results:
alice OK
denise
```

After digging a bit, I quickly realized the script stopped always on
users who didn't validate their emails. And indeed, we trigger a
`Minz_Request::forward(..., true)` for these users, in the `FreshRSS`
class. This function calls the `exit` function, which stops the script.

This patch only allows the feed#actualize action to be executed for
unverified users in order to avoid an early-`exit`. This is a quick-win
solution, but I don't think it's a good one on the long term. I'll
propose an alternative in another patch, later.
2019-12-03 22:27:20 +01:00
Marien Fressinaud
84f9311fd5 fix: Fix "validate email"-related issues (#2512)
* fix: Make sure $disable_aside is initialized

There was a warning for an uninitialized variable, hidden in production
but visible in development mode.

* fix: Allow to delete account when email isn't validated
2019-08-29 18:08:43 +02:00
Marien Fressinaud
75632e70f0 Provide email address verification feature (#2481)
* Add an email field to the profile page

I reuse the `mail_login` from the configuration. I'm not sure if it's
useful today (I would say it was used when Persona login was available).

A good improvement would be to rename `mail_login` into `email` so it
would be more intuitive to use.

* Add boolean to the conf to force email validation

This commit only adds a configuration item.

* Add email during registration if email must be validated

* Set email token to validate when email changes

* Block access to FreshRSS if email is not validated

* Send email when address is changed

* Allow to resend the validation email

* Allow the user to change its email while blocked

* Document the email validation feature

* fixup! Allow the user to change its email while blocked

* tec: Autoload PHPMailer lib

* Validate email address format

* Add feedback on validation email resend action

* Allow to logout when user is blocked

* fix: Change default email "from"

* Reorganize i18n keys

* Complete all the locales with default english

* Hide sidebar (profile page) if email is not validated

* Check email requirements on registration

* Allow admin to specify email when creating users

* Don't check email format if value is empty

* Remove trailing comma in userController

Co-Authored-By: Alexandre Alapetite <alexandre@alapetite.fr>

* Set PHPMailer validator to html5 before sending email

* fixup! Remove trailing comma in userController
2019-08-29 12:02:05 +02:00
Marien Fressinaud
7fd88adeb0 Add hooks to ExtensionManager (#2482)
Hooks allow to:

- add items in menus
- perform new actions at the end of FreshRSS initialization
2019-08-14 22:19:24 +02:00
Alexandre Alapetite
caeeeb52ca Fix user self registration (#2442)
* Fix user self registration

Fix https://github.com/FreshRSS/FreshRSS/issues/2381

* CSRF for admin
2019-07-21 11:05:51 +02:00
Alexandre Alapetite
ebd8c31c02 Rework CSRF interaction with sessions (#2290)
* Rework CSRF interaction with sessions

Fix https://github.com/FreshRSS/FreshRSS/issues/2288
Improve security in some edge cases
Maybe relevant for
https://github.com/FreshRSS/FreshRSS/issues/2125#issuecomment-474992671

* Forgotten mime type
2019-03-22 19:05:38 +01:00
Alexandre Alapetite
75356c64a2 Remove deprecated CSP child-src
It's been probably long enough since
https://github.com/FreshRSS/FreshRSS/pull/1099
2019-02-13 17:18:21 +01:00
Alexandre Alapetite
2374374ba9 Less jQuery (#2234)
* Less jQuery

Follow-up of https://github.com/FreshRSS/FreshRSS/pull/2199

* Even less jQuery + global view unread title fix

* Even less jQuery

* Yet even less jQuery

* Even less jQuery

* Reduce some events

* Even less jQuery

* jQuery gone from main view

+Fixed English i18n

* Fix feed folded view

* Remove Firefox 64 workaround

Remove workaround for Gecko bug 1514498 in Firefox 64, fixed in Firefox
65

* Split to extra.js

Avoid loading unneeded JavaScript code for the main view.
+ several adjustements

* Improve CSS transition fold category

* Rewrite shortcuts

Remove library. Much faster, shorter, one listener instead of many.
Control of the shortcut context.
Fix https://github.com/FreshRSS/FreshRSS/issues/2215

* Remove debug

* Minor syntax

* Filter out unwanted shortcut modifiers

* Menu overflow fix

* Typo

* Fix unfolding in mobile view

* Remove jQuery from category.js

* Remove jQuery from Global view
2019-02-13 15:06:28 +01:00
Alexandre Alapetite
1cc891be35 Remove some preload / prefetch (#2040)
* Remove next prefetch

This approach was only efficient in the specific case when no change was
made (no mark-as-read, favourites, tags), and useless in the other
situations.
Removed to reduce server load.

* Remove next prefetch from JavaScript too

* Remove some preload / prefetch

While useful for the first request, those preload / prefetch hints are
slightly negative for the following requets, especially server-side,
e.g. generating one log entry in Apache, and a bit more network traffic.

* Revert mistake

* Remove comment

https://github.com/FreshRSS/FreshRSS/pull/2040#discussion_r223214915
2018-10-14 00:35:43 +02:00
Alexandre Alapetite
a66b995be7 Explicit quotes decoding (#1947)
* Explicit quotes decoding

* Explicit htmlspecialchars_decode and htmlspecialchars
2018-06-22 16:07:48 +02:00
Alexandre Alapetite
b8094f8044 Move shares (#1812)
From ./data/ to ./app/
Fix manual updates like
https://github.com/FreshRSS/FreshRSS/issues/1803#issuecomment-369371907
Left for later: support a ./data/shares.local.php for user-defined
shares.
2018-03-03 15:06:22 +01:00
Alexandre Alapetite
38de643d09 Small fix Mastodon share
$a['method'] can be undefined.
https://github.com/FreshRSS/FreshRSS/pull/1674
https://github.com/FreshRSS/FreshRSS/issues/1521
2017-11-04 21:34:34 +01:00
Alexis Degrugillier
afffbfce07 Add a Mastodon share (#1674)
See #1521
2017-11-04 21:19:51 +01:00
Alexandre Alapetite
3a5427ea7f Change CSS load order to help CustomCSS extension
https://github.com/FreshRSS/Extensions/issues/13
2017-05-26 14:00:52 +02:00
Alexandre Alapetite
af8960b8b3 Move default configuration files
https://github.com/FreshRSS/FreshRSS/issues/1531
2017-05-12 23:33:58 +02:00
Alexandre Alapetite
e6e8cac3c4 Allow extensions for default accout in anonymous mode
https://github.com/FreshRSS/FreshRSS/issues/1257#issuecomment-248111169
2016-10-06 21:00:02 +02:00
Alexandre Alapetite
a180485f91 sticky-kit fix, and compatible async defer
And set correct parent option
https://github.com/FreshRSS/FreshRSS/pull/1172
2016-08-13 23:39:52 +02:00
Alexandre Alapetite
0c4add6913 Merge conflicts
https://github.com/FreshRSS/FreshRSS/pull/1172
2016-08-13 21:35:34 +02:00
Alexandre Alapetite
e6fd34bdda CSRF token, update HTTP Referrer policy to same-origin
https://www.w3.org/TR/referrer-policy/#referrer-policy-no-referrer
https://github.com/FreshRSS/FreshRSS/issues/570
https://github.com/FreshRSS/FreshRSS/issues/955
https://github.com/FreshRSS/FreshRSS/issues/1198
https://github.com/FreshRSS/FreshRSS/issues/565
https://github.com/FreshRSS/FreshRSS/issues/554
2016-08-13 17:49:31 +02:00
Alexandre Alapetite
c1548e732d Remove Mozilla Persona login
https://github.com/FreshRSS/FreshRSS/issues/1052
2016-07-31 14:58:19 +02:00
romibi
d9e14621b5 Make Sidebar Sticky 2016-07-08 19:39:02 +02:00
Alexandre Alapetite
6466fc87ec Load styles for two JSON cases 2016-04-29 18:24:46 +02:00
Alexandre Alapetite
805ec6392c Revert; Notifications needed also for non-layout requests 2016-04-23 23:12:08 +02:00
Alexandre Alapetite
b042d3a772 HTTP2 optimization
Fast flush HTTP headers, push promise CSS.
Requires PHP 5.3+ due to anonymous function.
Do not load syles, scripts, and notifications for Ajax requests.
https://github.com/FreshRSS/FreshRSS/issues/1089
2016-04-23 19:10:32 +02:00
Alexandre Alapetite
44be16d4fb X-Content-Type-Options: nosniff
https://github.com/FreshRSS/FreshRSS/issues/1114
2016-03-08 18:28:04 +01:00
Alexandre Alapetite
cbac2afd23 CSP compatibility with Firefox older than 45
https://github.com/FreshRSS/FreshRSS/pull/1075
https://github.com/FreshRSS/FreshRSS/pull/1078
https://developer.mozilla.org/en-US/Firefox/Releases/45#Security
https://bugzilla.mozilla.org/show_bug.cgi?id=1045891
2016-03-01 21:56:19 +01:00
Alexandre Alapetite
38c2d671e3 CSP different policies per controller
https://github.com/FreshRSS/FreshRSS/issues/1075
2016-02-21 21:25:23 +01:00
Alexandre Alapetite
cb913a3a76 CSP for statistics and forms
https://github.com/FreshRSS/FreshRSS/issues/1075
2016-02-21 19:15:23 +01:00
Alexandre Alapetite
e3dc7d46e1 CSP: Use inline JSON instead of one-time cookie
Simpler, lighter
https://github.com/FreshRSS/FreshRSS/issues/1075
2016-02-21 14:23:24 +01:00
Alexandre Alapetite
8cdf44c87b CSP allow iframes
E.g. for YouTube videos, etc.
https://github.com/FreshRSS/FreshRSS/issues/1075
2016-02-17 01:17:56 +01:00
Alexandre Alapetite
e4a459a6ed CSP no inline javascript draft
https://github.com/FreshRSS/FreshRSS/issues/1075
2016-02-16 23:53:39 +01:00
Alexandre Alapetite
79f0f2bbb4 Bug Page 403 ne peut s'afficher si Translate n'est pas instancié avant
https://github.com/FreshRSS/FreshRSS/issues/821
2015-05-10 18:21:21 +02:00
Marien Fressinaud
789d9fc6c8 Fix coding style in extension manager
Yep, same as 8968288...
2015-01-14 23:40:18 +01:00
Marien Fressinaud
67375537e4 Init auth before user configuration
Add a lot of comments to explain how work the FRSS front controller and
the order of initializations.

Fix https://github.com/FreshRSS/FreshRSS/issues/745
2015-01-09 19:34:02 +01:00
Marien Fressinaud
73023bc12b Merge branch 'dev' into 252-extensions
Conflicts:
	app/FreshRSS.php
	app/Models/Configuration.php
	app/views/index/index.phtml
	app/views/index/normal.phtml
	lib/Minz/Configuration.php
	lib/Minz/Translate.php
	lib/lib_rss.php
2015-01-08 14:18:32 +01:00
Marien Fressinaud
2fd8a80878 Add first test for a generic ConfigurationSetter
We are blocked if a setter has to update several values.
ConfigurationSetter will be updated.

See https://github.com/FreshRSS/FreshRSS/issues/730
2015-01-07 16:36:55 +01:00
Marien Fressinaud
4c128e05a4 Reorganize FreshRSS init
See https://github.com/FreshRSS/FreshRSS/issues/730
2015-01-07 16:13:57 +01:00