Commit Graph

77 Commits

Author SHA1 Message Date
Alexandre Alapetite
ebd8c31c02 Rework CSRF interaction with sessions (#2290)
* Rework CSRF interaction with sessions

Fix https://github.com/FreshRSS/FreshRSS/issues/2288
Improve security in some edge cases
Maybe relevant for
https://github.com/FreshRSS/FreshRSS/issues/2125#issuecomment-474992671

* Forgotten mime type
2019-03-22 19:05:38 +01:00
Alexandre Alapetite
75356c64a2 Remove deprecated CSP child-src
It's been probably long enough since
https://github.com/FreshRSS/FreshRSS/pull/1099
2019-02-13 17:18:21 +01:00
Alexandre Alapetite
2374374ba9 Less jQuery (#2234)
* Less jQuery

Follow-up of https://github.com/FreshRSS/FreshRSS/pull/2199

* Even less jQuery + global view unread title fix

* Even less jQuery

* Yet even less jQuery

* Even less jQuery

* Reduce some events

* Even less jQuery

* jQuery gone from main view

+Fixed English i18n

* Fix feed folded view

* Remove Firefox 64 workaround

Remove workaround for Gecko bug 1514498 in Firefox 64, fixed in Firefox
65

* Split to extra.js

Avoid loading unneeded JavaScript code for the main view.
+ several adjustements

* Improve CSS transition fold category

* Rewrite shortcuts

Remove library. Much faster, shorter, one listener instead of many.
Control of the shortcut context.
Fix https://github.com/FreshRSS/FreshRSS/issues/2215

* Remove debug

* Minor syntax

* Filter out unwanted shortcut modifiers

* Menu overflow fix

* Typo

* Fix unfolding in mobile view

* Remove jQuery from category.js

* Remove jQuery from Global view
2019-02-13 15:06:28 +01:00
Alexandre Alapetite
1cc891be35 Remove some preload / prefetch (#2040)
* Remove next prefetch

This approach was only efficient in the specific case when no change was
made (no mark-as-read, favourites, tags), and useless in the other
situations.
Removed to reduce server load.

* Remove next prefetch from JavaScript too

* Remove some preload / prefetch

While useful for the first request, those preload / prefetch hints are
slightly negative for the following requets, especially server-side,
e.g. generating one log entry in Apache, and a bit more network traffic.

* Revert mistake

* Remove comment

https://github.com/FreshRSS/FreshRSS/pull/2040#discussion_r223214915
2018-10-14 00:35:43 +02:00
Alexandre Alapetite
a66b995be7 Explicit quotes decoding (#1947)
* Explicit quotes decoding

* Explicit htmlspecialchars_decode and htmlspecialchars
2018-06-22 16:07:48 +02:00
Alexandre Alapetite
b8094f8044 Move shares (#1812)
From ./data/ to ./app/
Fix manual updates like
https://github.com/FreshRSS/FreshRSS/issues/1803#issuecomment-369371907
Left for later: support a ./data/shares.local.php for user-defined
shares.
2018-03-03 15:06:22 +01:00
Alexandre Alapetite
38de643d09 Small fix Mastodon share
$a['method'] can be undefined.
https://github.com/FreshRSS/FreshRSS/pull/1674
https://github.com/FreshRSS/FreshRSS/issues/1521
2017-11-04 21:34:34 +01:00
Alexis Degrugillier
afffbfce07 Add a Mastodon share (#1674)
See #1521
2017-11-04 21:19:51 +01:00
Alexandre Alapetite
3a5427ea7f Change CSS load order to help CustomCSS extension
https://github.com/FreshRSS/Extensions/issues/13
2017-05-26 14:00:52 +02:00
Alexandre Alapetite
af8960b8b3 Move default configuration files
https://github.com/FreshRSS/FreshRSS/issues/1531
2017-05-12 23:33:58 +02:00
Alexandre Alapetite
e6e8cac3c4 Allow extensions for default accout in anonymous mode
https://github.com/FreshRSS/FreshRSS/issues/1257#issuecomment-248111169
2016-10-06 21:00:02 +02:00
Alexandre Alapetite
a180485f91 sticky-kit fix, and compatible async defer
And set correct parent option
https://github.com/FreshRSS/FreshRSS/pull/1172
2016-08-13 23:39:52 +02:00
Alexandre Alapetite
0c4add6913 Merge conflicts
https://github.com/FreshRSS/FreshRSS/pull/1172
2016-08-13 21:35:34 +02:00
Alexandre Alapetite
e6fd34bdda CSRF token, update HTTP Referrer policy to same-origin
https://www.w3.org/TR/referrer-policy/#referrer-policy-no-referrer
https://github.com/FreshRSS/FreshRSS/issues/570
https://github.com/FreshRSS/FreshRSS/issues/955
https://github.com/FreshRSS/FreshRSS/issues/1198
https://github.com/FreshRSS/FreshRSS/issues/565
https://github.com/FreshRSS/FreshRSS/issues/554
2016-08-13 17:49:31 +02:00
Alexandre Alapetite
c1548e732d Remove Mozilla Persona login
https://github.com/FreshRSS/FreshRSS/issues/1052
2016-07-31 14:58:19 +02:00
romibi
d9e14621b5 Make Sidebar Sticky 2016-07-08 19:39:02 +02:00
Alexandre Alapetite
6466fc87ec Load styles for two JSON cases 2016-04-29 18:24:46 +02:00
Alexandre Alapetite
805ec6392c Revert; Notifications needed also for non-layout requests 2016-04-23 23:12:08 +02:00
Alexandre Alapetite
b042d3a772 HTTP2 optimization
Fast flush HTTP headers, push promise CSS.
Requires PHP 5.3+ due to anonymous function.
Do not load syles, scripts, and notifications for Ajax requests.
https://github.com/FreshRSS/FreshRSS/issues/1089
2016-04-23 19:10:32 +02:00
Alexandre Alapetite
44be16d4fb X-Content-Type-Options: nosniff
https://github.com/FreshRSS/FreshRSS/issues/1114
2016-03-08 18:28:04 +01:00
Alexandre Alapetite
cbac2afd23 CSP compatibility with Firefox older than 45
https://github.com/FreshRSS/FreshRSS/pull/1075
https://github.com/FreshRSS/FreshRSS/pull/1078
https://developer.mozilla.org/en-US/Firefox/Releases/45#Security
https://bugzilla.mozilla.org/show_bug.cgi?id=1045891
2016-03-01 21:56:19 +01:00
Alexandre Alapetite
38c2d671e3 CSP different policies per controller
https://github.com/FreshRSS/FreshRSS/issues/1075
2016-02-21 21:25:23 +01:00
Alexandre Alapetite
cb913a3a76 CSP for statistics and forms
https://github.com/FreshRSS/FreshRSS/issues/1075
2016-02-21 19:15:23 +01:00
Alexandre Alapetite
e3dc7d46e1 CSP: Use inline JSON instead of one-time cookie
Simpler, lighter
https://github.com/FreshRSS/FreshRSS/issues/1075
2016-02-21 14:23:24 +01:00
Alexandre Alapetite
8cdf44c87b CSP allow iframes
E.g. for YouTube videos, etc.
https://github.com/FreshRSS/FreshRSS/issues/1075
2016-02-17 01:17:56 +01:00
Alexandre Alapetite
e4a459a6ed CSP no inline javascript draft
https://github.com/FreshRSS/FreshRSS/issues/1075
2016-02-16 23:53:39 +01:00
Alexandre Alapetite
79f0f2bbb4 Bug Page 403 ne peut s'afficher si Translate n'est pas instancié avant
https://github.com/FreshRSS/FreshRSS/issues/821
2015-05-10 18:21:21 +02:00
Marien Fressinaud
789d9fc6c8 Fix coding style in extension manager
Yep, same as 8968288...
2015-01-14 23:40:18 +01:00
Marien Fressinaud
67375537e4 Init auth before user configuration
Add a lot of comments to explain how work the FRSS front controller and
the order of initializations.

Fix https://github.com/FreshRSS/FreshRSS/issues/745
2015-01-09 19:34:02 +01:00
Marien Fressinaud
73023bc12b Merge branch 'dev' into 252-extensions
Conflicts:
	app/FreshRSS.php
	app/Models/Configuration.php
	app/views/index/index.phtml
	app/views/index/normal.phtml
	lib/Minz/Configuration.php
	lib/Minz/Translate.php
	lib/lib_rss.php
2015-01-08 14:18:32 +01:00
Marien Fressinaud
2fd8a80878 Add first test for a generic ConfigurationSetter
We are blocked if a setter has to update several values.
ConfigurationSetter will be updated.

See https://github.com/FreshRSS/FreshRSS/issues/730
2015-01-07 16:36:55 +01:00
Marien Fressinaud
4c128e05a4 Reorganize FreshRSS init
See https://github.com/FreshRSS/FreshRSS/issues/730
2015-01-07 16:13:57 +01:00
Marien Fressinaud
0140448a56 Refactor FreshRSS_Share object to be more usable
- FreshRSS_Share is the only object we manipulate
- Add a way to register new share options easily
- Move some i18n keys from index.php to gen.php

See https://github.com/FreshRSS/FreshRSS/issues/730
2015-01-07 14:59:18 +01:00
Marien Fressinaud
ce10f48274 Fix a bug in i18n init
See https://github.com/FreshRSS/FreshRSS/issues/730
2015-01-06 23:20:54 +01:00
Marien Fressinaud
addcea9cd4 Fix i18n loading and availableLanguages calls
- Change the way to init i18n
- Add a availableLanguages() method to Minz_Translate

See https://github.com/FreshRSS/FreshRSS/issues/730
2015-01-06 21:10:51 +01:00
Marien Fressinaud
d3a93ea290 BREAKING FEATURE: Remove general in config
General attribute has been removed from system config.
Now subattributes (e.g. environment, salt, title, etc.) are directly accessible.

YOU HAVE TO FIX YOUR ./data/config.php file!

- Remove the general array
- Values inside this array must be kept
- To see what it must look like, please have a look to ./data/config.default.php
  (but keep your values!!).

See https://github.com/FreshRSS/FreshRSS/issues/730
2015-01-06 18:53:36 +01:00
Marien Fressinaud
7cca47d1ab Change name of user configuration var in Context
- FreshRSS_Context::$conf is replaced by FreshRSS_Context::$user_conf
- Introduce FreshRSS_Context::$system_conf
- Remove FreshRSS_Configuration object

See https://github.com/FreshRSS/FreshRSS/issues/730
2015-01-05 22:45:03 +01:00
Marien Fressinaud
51a71ec4b9 New configuration system (not working yet)
- Use only Minz_Configuration
- register() method to load a new configuration file
- get() to get a configuration
- new exceptions related to configuration
- fix a list configuration calls to have FRSS working

Current problems to resolve:

- How to handle configuration param verifications (i.e. check auth_type
  is a value from none, http_auth, persona or form)
- We must use $conf = Minz_Configuration::get('system'); $general_conf = $conf->general;
  to access global system configuration which is quite annoying. How to change that?

See https://github.com/FreshRSS/FreshRSS/issues/730
2015-01-05 16:54:16 +01:00
Marien Fressinaud
2232d1e02a Load user extensions after all the global inits
See https://github.com/FreshRSS/FreshRSS/issues/252
2014-12-07 15:45:34 +01:00
Marien Fressinaud
4c888590e6 Improve system/user types for extensions
- system extensions can only be managed by an administrator
- system extensions are loaded for all users (even if not logged)
- user extensions are loaded for logged users only
- system extensions loading is saved in global config.php file

See https://github.com/FreshRSS/FreshRSS/issues/252
2014-12-06 16:41:06 +01:00
Marien Fressinaud
f1fd1091b9 Remove old code for extensions 2014-12-04 20:43:05 +01:00
Marien Fressinaud
1086ba4a2b Enable extensions for users 2014-12-04 19:47:43 +01:00
Marien Fressinaud
86f69ca396 First draft for the new extension feature
- Only system extensions can be loaded for the moment by adding them in the config.php
  file.
- Remove previous system (it will be added properly in the new system in the next step).
2014-12-04 19:33:29 +01:00
Marien Fressinaud
eb60b82959 Move back i18n init in FreshRSS.php 2014-10-22 18:06:28 +02:00
Marien Fressinaud
80cffa6de5 Views are in dedicated actions + improve Context
- Seperate normal, global and rss outputs in dedicated actions (NOT WORKING YET!)
- Rewrite aside_flux and nav_menu to use Context object
- Improve Context object

See https://github.com/marienfressinaud/FreshRSS/issues/634
2014-10-21 16:55:19 +02:00
Marien Fressinaud
1a22a87fb1 Use FreshRSS_Context::$conf only
- Replace $this->view->conf in controllers
- Replace $this->conf in views
2014-10-20 18:45:22 +02:00
Marien Fressinaud
ad92dd7dae First draft for Context object.
See https://github.com/marienfressinaud/FreshRSS/issues/634
2014-10-20 18:21:10 +02:00
Marien Fressinaud
1252b3dd86 Authentication system moved + Persona comes back!
AuthController is dedicated to auhentication.
Persona is back, greater than ever!

See https://github.com/marienfressinaud/FreshRSS/issues/655
2014-10-07 16:37:10 +02:00
Marien Fressinaud
79aa5beaf4 Refactor authentication system.
Big work, not finished. A lot of features have been removed.

See https://github.com/marienfressinaud/FreshRSS/issues/655
2014-10-06 23:29:20 +02:00
Marien Fressinaud
d8f4681382 Replace Minz_Log::record by corresponding methods
Please not use Minz_Log::record anymore!

See https://github.com/marienfressinaud/FreshRSS/issues/655
2014-10-05 19:35:29 +02:00