Commit Graph

6638 Commits

Author SHA1 Message Date
Alexandre Alapetite
5c7ea3c7e5 Docker revert to Debian 12 Bookworm (#7805)
Fix https://github.com/FreshRSS/FreshRSS/issues/7798
Revert https://github.com/FreshRSS/FreshRSS/pull/7772
Revert af6f7f013a
2025-08-09 19:13:38 +02:00
Alexandre Alapetite
56d1d4f194 Remove unneeded execution permissions (#7802) 2025-08-08 22:39:33 +02:00
Inverle
d9197d7e32 New JS attribute: data-auto-leave-validation (#7785)
Instead of a repeating pattern like: `<input type="text" value="something" data-leave-validation="something">`, you can now put a `data-auto-leave-validation="1"` attribute on a `<form>` for example, and it will automatically set the `data-leave-validation` attributes inside the form elements.

`data_auto_leave_validation(parent)`  from `extra.js` is called on slider open and page load.

---------

Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>
Co-authored-by: Frans de Jonge <fransdejonge@gmail.com>
2025-08-08 17:39:38 +02:00
Ali Moslemi
a3854c2f59 Update CREDITS.md (#7800)
* Update CREDITS.md

Added my name (Ali Moslemi) with link to GitHub profile as Persian (fa) translation contributor.

* More uniform

---------

Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>
2025-08-08 13:46:18 +02:00
Carey Metcalfe
bb659ee27a Optimize how much data needs to be chown/chmoded on container startup (#7793)
* Optimize how much data needs to be `chown`/`chmod`ed on container startup

This works around an issue where `chmod`/`chown` operations inside a
container can be extremely slow when using the `overlay2` storage
driver, resulting in 10min+ container startup times.

It modifies the owner of the webapp when building the container so that
only the `data` and `extensions` directories (which are commonly mapped
as volumes into the container) have to be modified by the
`access-permissions.sh` script at container startup.

When not running via docker the behaviour of the `access-permissions.sh`
script is unchanged.

* Take DATA_PATH environment variable into account when fixing permissions

* Revert change to using bash for arrays

(the alpine image doesn't include `bash`)

* A few more improvements

* Slightly tweak reapply permissions variable

- lowercase to indicate it's not an env variable
- use 0/1 to address potentially-irrational paranoia about unset variables

* Remove conditional logic to skip reapplying permissions

Also documents why in a comment so it's not missed in the future.

---------

Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>
2025-08-08 13:36:57 +02:00
Ali Moslemi
084f954980 Add Persian (fa) translations for FreshRSS (#7795)
* Add Persian (fa) translations for FreshRSS

* Fix Persian translation and syntax issues

* Apply fix-all for Persian translation2

* Fix syntax errors and update Persian translations

* Mark untranslated strings as IGNORE and fix remaining TODOs

* make fix-all

---------

Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>
2025-08-08 11:01:47 +02:00
James Frost
d1f2e0f6be Avoid styling <code> inside of <pre> (#7797)
* Remove background from <code> inside <pre>

This caused an ugly effect where each line has a seperate background to
the whole pre block.

Fixes #7796

* Add James Frost to CREDITS.md
2025-08-08 10:50:27 +02:00
Alexandre Alapetite
1f8273803f Add more unicity criteria based on title and/or content (#7789)
* Add more unicity criteria based on title and/or content
https://github.com/FreshRSS/FreshRSS/discussions/7788

* More
2025-08-07 22:20:08 +02:00
Alexandre Alapetite
62f32ccadf PHPStan: finalise strictArrayFilter (#7794)
As well as reportPossiblyNonexistentConstantArrayOffset.
And disable PHPStan-next from GitHub Action, since the work is completed for now.
2025-08-07 22:19:45 +02:00
Inverle
149136fbe2 Improve sharing via Print (#7728)
List of changes:
* The temporary document for printing is now in an `<iframe>` instead of a new tab
* The whole `<head>` element is copied to the temporary document, except for `<script>` tags to copy over the `<meta>` tags as well
* URLs that contain the instance base URL are now removed from the printed PDF
* The saved filename (PDF) will now default to the article title
* `<details>` is auto expanded
* Styling:
   * The main document's `<html>` class is copied over to preserve some styling that might use those classes
   * Instead of writing `content_el.innerHTML` to the temporary document, `content_el.outerHTML` is now written instead to apply the styles that select `.content`
   * `.dropdown-menu` is now hidden in the printed document, because it can't be expanded anyway
   * Headers and footers are hidden in the printed document
* The printed document will now display correctly all the time, by waiting for it to load before calling `print()`
   * Before, the stylesheets might've not finished loading and the document was broken
* Better browser support on mobile for this feature
   * Before, the document would fail to print on Chrome Mobile
   
Tested on:
* Firefox - both desktop and mobile, works 
* Chrome - both desktop and mobile, works 
* Opera - desktop, works (same as Chrome) 
* Brave - both desktop and mobile (same as Chrome), works 
* Safari - both desktop and mobile, works
* Microsoft Edge - both desktop and mobile, works 
* GNOME Web - desktop, works 
* SeaMonkey - desktop, works 

Known issues:
* Images may not finish loading the first time the print dialog is opened

TODO:
* [x] Test on Safari
* [x] Try to fix GNOME Web
2025-08-06 21:49:13 +02:00
hilariousperson
9faf2c1fa3 GReader API: fix incorrect favicon URL (#7792)
* GReader API: fix incorrect favicon URL

* Fix compatibility with custom favicons

---------

Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>
2025-08-06 12:32:16 +02:00
Alexandre Alapetite
b7a39976f9 PHPStan start supporting PHP 8.5+ (#7787)
https://github.com/phpstan/phpstan/releases/tag/2.1.22
2025-08-05 23:31:11 +02:00
Alexandre Alapetite
4a0aca36b7 Changelog 2025-08-04 23:12:18 +02:00
Alexandre Alapetite
eda66dda48 Fix regression promote user (#7786)
Quick fix, while waiting for something better
Regression from https://github.com/FreshRSS/FreshRSS/pull/7771
2025-08-04 10:04:09 +02:00
Alexandre Alapetite
05c7aac84e Improve security of form for user details (#7771)
Related to https://github.com/FreshRSS/FreshRSS/pull/7684
The form buttons requiring confirmation are disabled in HTML in the case of Ajax, and only enabled again if our own JavaScript is running
2025-08-03 23:30:35 +02:00
Inverle
26377b543d Fix create user bugs (#7783)
* Fix registration regression due to #7753
* Add missing access check
2025-08-03 23:14:59 +02:00
Inverle
502090edcd Redirect to the login page from bookmarklet instead of 403 (#7782)
Makes it easier than having to sign in then go back to the website I clicked the bookmarklet on.
2025-08-03 13:44:18 +02:00
Alexandre Alapetite
b817598f57 Bump SimplePie with PHPStan Level 8 (#7775)
* Bump SimplePie with PHPStan Level 8
* https://github.com/FreshRSS/simplepie/pull/45
SimplePie increased to PHPStan Level 8:
* https://github.com/simplepie/simplepie/pull/857

* Merge upstream
Including my two PRs:
* https://github.com/simplepie/simplepie/pull/932
* https://github.com/simplepie/simplepie/pull/933

* Resolve upstream sync of Expose HTTP status
* https://github.com/FreshRSS/simplepie/pull/47
Finalise merge, following:
* https://github.com/simplepie/simplepie/pull/905#issuecomment-3007605779
* https://github.com/simplepie/simplepie/pull/909
* https://github.com/FreshRSS/FreshRSS/issues/7038
2025-08-01 23:27:35 +02:00
Alexandre Alapetite
536c476f0d composer update + corresponding PHPStan fixes (#7781)
Replacing failing Dependabot PRs:
* https://github.com/FreshRSS/FreshRSS/pull/7779
* https://github.com/FreshRSS/FreshRSS/pull/7780
* https://github.com/FreshRSS/FreshRSS/pull/7778
2025-08-01 21:36:25 +02:00
dependabot[bot]
7bbee11bef Bump the stylelint group with 2 updates (#7777)
Bumps the stylelint group with 2 updates: [stylelint](https://github.com/stylelint/stylelint) and [@stylistic/stylelint-plugin](https://github.com/stylelint-stylistic/stylelint-stylistic).


Updates `stylelint` from 16.21.0 to 16.23.0
- [Release notes](https://github.com/stylelint/stylelint/releases)
- [Changelog](https://github.com/stylelint/stylelint/blob/main/CHANGELOG.md)
- [Commits](https://github.com/stylelint/stylelint/compare/16.21.0...16.23.0)

Updates `@stylistic/stylelint-plugin` from 3.1.3 to 4.0.0
- [Release notes](https://github.com/stylelint-stylistic/stylelint-stylistic/releases)
- [Changelog](https://github.com/stylelint-stylistic/stylelint-stylistic/blob/main/CHANGELOG.md)
- [Commits](https://github.com/stylelint-stylistic/stylelint-stylistic/compare/v3.1.3...v4.0.0)

---
updated-dependencies:
- dependency-name: stylelint
  dependency-version: 16.23.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: stylelint
- dependency-name: "@stylistic/stylelint-plugin"
  dependency-version: 4.0.0
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: stylelint
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-08-01 21:23:22 +02:00
dependabot[bot]
207dfe9499 Bump the eslint group with 3 updates (#7776)
Bumps the eslint group with 3 updates: [eslint](https://github.com/eslint/eslint), [@eslint/js](https://github.com/eslint/eslint/tree/HEAD/packages/js) and [neostandard](https://github.com/neostandard/neostandard).


Updates `eslint` from 9.30.0 to 9.32.0
- [Release notes](https://github.com/eslint/eslint/releases)
- [Changelog](https://github.com/eslint/eslint/blob/main/CHANGELOG.md)
- [Commits](https://github.com/eslint/eslint/compare/v9.30.0...v9.32.0)

Updates `@eslint/js` from 9.30.0 to 9.32.0
- [Release notes](https://github.com/eslint/eslint/releases)
- [Changelog](https://github.com/eslint/eslint/blob/main/CHANGELOG.md)
- [Commits](https://github.com/eslint/eslint/commits/v9.32.0/packages/js)

Updates `neostandard` from 0.12.1 to 0.12.2
- [Release notes](https://github.com/neostandard/neostandard/releases)
- [Changelog](https://github.com/neostandard/neostandard/blob/main/CHANGELOG.md)
- [Commits](https://github.com/neostandard/neostandard/compare/v0.12.1...v0.12.2)

---
updated-dependencies:
- dependency-name: eslint
  dependency-version: 9.32.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: eslint
- dependency-name: "@eslint/js"
  dependency-version: 9.32.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: eslint
- dependency-name: neostandard
  dependency-version: 0.12.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: eslint
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-08-01 21:09:53 +02:00
Alexandre Alapetite
f512664d4e Changelog 2025-08-01 08:36:08 +02:00
Alexandre Alapetite
e915ebe46e Rework fetch favicons (#7767)
* Use main function `httpGet()` instead of local one;
* Use HTTP cache, also between users;
* Do not default to feed URL when there is no website URL

TODO for later: consider supporting Atom's `<icon>` and RSS 2.0's `<image>` https://github.com/FreshRSS/FreshRSS/issues/7774
2025-08-01 08:30:49 +02:00
Alexandre Alapetite
188cc0d063 Docker dev image :newest updated to PHP 8.5 (#7773)
Now that PHP 8.4 is covered by our main Debian image https://github.com/FreshRSS/FreshRSS/pull/7772, let's bump the :newest dev image to PHP 8.5.
Note: OPCache is now included in the core https://wiki.php.net/rfc/make_opcache_required
No other apparent breaking change.
2025-08-01 08:15:36 +02:00
Alexandre Alapetite
af6f7f013a Docker: Debian 13 RC with PHP 8.4 (#7772)
Help final testing of Debian 13 Trixie before the release (9 August)
https://lists.debian.org/debian-devel-announce/2025/07/msg00003.html
PHP 8.4.10, Apache 2.4.64
I will make another PR after the release to update to `debian:13-slim` when it gets available.
2025-08-01 07:53:40 +02:00
Inverle
c952256564 Strip more unsafe attributes e.g. referrerpolicy (#7770) 2025-07-31 17:04:47 +02:00
Inverle
3ce64d271b Implement sudo mode / reauthentication (#7753)
* Implement sudo mode / reauthentication

* i18n: fr

* generate flags

* Improvements

* Remove HMAC check
* Don't require reauth to access logs when signed in as admin
* Notify user of bad login via notification instead

---------

Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>
2025-07-31 13:53:14 +02:00
Inverle
d0425f8c3a Add missing access checks for feed-related actions (#7768)
* Add missing access checks for feed-related actions

* fix whitespace
2025-07-31 13:48:42 +02:00
Alexandre Alapetite
97f1bd2dcb Fix regression Minz_Configuration (#7765)
Follow-up of https://github.com/FreshRSS/FreshRSS/pull/7761
Partially avoid calls to deprecated functions.
Avoid warnings:
```
[warning] --- old_entries does not exist in configuration
[warning] --- keep_history_default does not exist in configuration
```
2025-07-31 09:53:21 +02:00
Inverle
f85333e98a Require current password when setting new password (#7763)
* Require current password when setting new password

* i18n: fr

---------

Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>
2025-07-31 09:24:37 +02:00
Alexandre Alapetite
7a0c423357 Implement support for HTTP 429 Too Many Requests (#7760)
* Implement support for HTTP 429 Too Many Requests
Will obey the corresponding HTTP `Retry-After` header at domain level.

* Implement 503 Service Unavailable

* Sanitize Retry-After

* Reduce default value when Retry-After is absent
And make configuration parameter

* Retry-After also for favicons
2025-07-31 09:17:42 +02:00
Inverle
e33ef74af9 before_login_btn hook + system conf attributes (#7761)
* `before_login_btn` hook + system conf attributes

* phpstan fix

* Refactoring

---------

Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>
2025-07-30 08:03:04 +02:00
Inverle
e967b07589 Regenerate cookie ID after logging out (#7762)
To make the session cookie no longer usable if hijacked and put in another browser after user logs out
2025-07-29 14:44:14 +02:00
Alexandre Alapetite
fe9ef3b506 Include enclosures in entries hash (#7719)
* Include enclosures in entries hash
Fix https://github.com/FreshRSS/FreshRSS/issues/7718
Negative side-effect: users using the option to automatically mark updated articles as unread will have some articles with enclosures appear as unread

* Changelog with warning
2025-07-26 15:57:58 +02:00
Alexandre Alapetite
fbcf0b00fa Changelog 2025-07-26 15:42:23 +02:00
Inverle
6f7bea4a5a Update chart.js from 3.5.1 to 4.5.0 (#7752) 2025-07-25 23:05:13 +02:00
Inverle
1ef3bd34d6 Fix no registration limit setting (#7751) 2025-07-24 07:59:00 +02:00
Alexandre Alapetite
e6540335ca DevContainer: Alpine 3.22 (#7740)
Follow-up of https://github.com/FreshRSS/FreshRSS/pull/7627
https://gitlab.alpinelinux.org/alpine/aports/-/issues/17215 has been merged
2025-07-19 22:53:10 +02:00
Alexandre Alapetite
01eae00ca2 WebSub: only perform a redirect when coming from WebSub (#7738)
And add support for HTTP Link header for "self" URL
Changing URL based on "self" URL will only be done when coming from a WebSub push
fix https://github.com/FreshRSS/FreshRSS/issues/7737
2025-07-19 22:52:06 +02:00
Sam Edwards
0d158f3762 Add dotsam to CREDITS.md (#7745) 2025-07-17 23:40:12 +02:00
Sam Edwards
5bbd299c7e Call DOMNode::insertBefore() on the parent of it's $child (#7741)
Follow-up to https://github.com/FreshRSS/FreshRSS/pull/7654#discussion_r2208901108

Changes proposed in this pull request:

- `DOMNode::insertBefore()` needs to be called on an element that is the parent of the `$child` param being passed
- Update code to call this on `$doc->documentElement` instead of directly on the `$doc` (`DOMDocument`)

How to test the feature manually:

1. Set up an HTML + XPath feed for a URL that contains partial HTML content (eg. https://victoria.citified.ca/modules/blog/news.php?n=7&c=8)
1. Observe that the feed is processed successfully without error, and that the `<base>` is still inserted
2025-07-17 01:44:10 +02:00
Alexandre Alapetite
5489d864f6 Fix i18n translation flags 2025-07-16 17:03:39 +02:00
Inverle
6744a2fdce Fix mark as read request showing popup due to onbeforeunload (#7554)
* Prevent onbeforeunload from showing a popup before leaving

* Send mark as read request when leaving and revert interval

* Use visibilitychange event instead of onbeforeunload, and refactor send_mark_read_queue to use fetch

* Move removed code to the new `catch` block

* Refactor with async fetch
2025-07-16 16:59:06 +02:00
Inverle
edda6f0159 Fixes for frss.css (#7616)
* Fixes for frss.css and make more buttons accessible in anonymous view

* Suggested changes and page overflow fix

* Forgot rtlcss

* Revert anonymous view changes
2025-07-16 16:13:58 +02:00
Inverle
f9a42adade Show translation status in README.md (#7715)
* Show translation status in README.md

* Fix colon

* markdownlint: Allow tag `<translations>`

* Use mostly Unicode flags instead

* Only `oc.svg` remains in an image format
* `check.translation.php` still supports `.png` even though there aren't any PNGs as of right now

* Fix CodeSniffer

* Attempt approach with generating local SVGs

* Fixes for local SVG approach

* Cleanup old code

* PHPStan fix

* Remove decimal precision from percentages

* Suggestions + better error messages

* codesniffer fix v2

* Revert `ghSearchUrl` change

* Generate readme

* Fix syntax highlight, maybe

* Regenerate

* Update help message

* Use existing translation files instead of .txt

* Add test against wrong Unicode flag

---------

Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>
2025-07-16 16:11:51 +02:00
Alexandre Alapetite
5f61e426dc Sort by category title, feed title (#7702)
* Sort by category name, feed name
fix https://github.com/FreshRSS/FreshRSS/issues/7698
Note that sorting is done with the default SQL collation for now, meaning that lower-case vs. upper-case and diacritics are influencing the sorting order. Improvements left for future work.
Watch out that those sorting criteria are slower due to additional joins, additional requests, and poorer indexes.

* i18n:pl

Co-authored-by: Inverle <inverle@proton.me>

* i18n: nl

Co-authored-by: Frans de Jonge <fransdejonge@gmail.com>

* Fix preserve sort

---------

Co-authored-by: Inverle <inverle@proton.me>
Co-authored-by: Frans de Jonge <fransdejonge@gmail.com>
2025-07-15 12:39:51 +02:00
Alexandre Alapetite
8a44d1045a Honor "disable update" on index page (#7733)
fix https://github.com/FreshRSS/FreshRSS/issues/7272
2025-07-14 23:10:07 +02:00
Inverle
a7e29fa258 Fix HTML queries with a single feed (#7730)
* Fix HTML queries with single feed

* Suggestion
2025-07-14 09:53:37 +02:00
the7thNightmare
8385eadf49 i18n:ID (#7721)
* id translation

* make fix-all

---------

Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>
2025-07-09 21:24:12 +02:00
Tarow
f00ebbb2e6 Update CREDITS.md (#7726)
In addition to https://github.com/FreshRSS/FreshRSS/pull/7725
2025-07-09 21:23:49 +02:00