Commit Graph

120 Commits

Author SHA1 Message Date
berumuron
cc6c529562 tec: Remove data/do-install.txt (#3555)
* Remove file data/do-install.txt

This file was painful during update because we had to remember to delete
it each time. It added a security issue by allowing an attacker to
reinstall FreshRSS during the update process.

The (more powerful) file data/applied_migrations.txt has been introduced
in 8619cf6fa to replace do-install.txt. We had to wait for at least one
release in order to make sure existing instances of FreshRSS created the
migration file. It should be ok now.

* Replace i18n install.not_deleted key

* Update documentation to update FreshRSS
2021-03-26 19:41:33 +01:00
Alexandre Alapetite
a62d6288b1 Fix init in CLI install (#3544)
#fix https://github.com/FreshRSS/FreshRSS/issues/3528
config was not properly reloaded after being populated
2021-03-20 18:25:55 +01:00
ThomasSmallert
efba11ee37 If cURL is not installed, the script stops with a fatal error. (#3519)
* If cURL is not installed, the script stops with a fatal error.

The script stops with the following message.
Fatal error: Uncaught Error: Call to undefined function curl_version()

* Update app/install.php

Fix whitespace

Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>
2021-03-14 16:53:34 +01:00
Alexandre Alapetite
947e918f05 Travis: Enforce phpcs line length + whitespace (#3488)
* Update Travis line length

* Also check whitespace in CSS files

* Fix line length ext.php

* More syntax, string templates

* Fix exclude-pattern

* Test JS files as well
2021-02-28 12:26:24 +01:00
hesch
13b03b232b refactor: remove referer checks, as they are no longer needed (replaced by csrf tokens) (#3432) 2021-02-11 17:38:39 +01:00
Alexandre Alapetite
a626e5fff8 Check that PHP session is working during install (#3430)
* Check that PHP session is working during install

#fix https://github.com/FreshRSS/FreshRSS/issues/3198

* Minor whitespace

* Missing he
2021-02-07 15:19:29 +01:00
Alexis Degrugillier
afc30cef3d Add missing variable (#3427)
When refactoring the install in #3368, a variable was unwillingly removed.
It's back in the code now.
2021-02-06 18:09:05 +01:00
Alexis Degrugillier
3e89086e45 Add username hint for permissions during install (#3373)
The username is retrieved by 2 different means to support different
configurations and architectures. If there is no way to find the
username, the "unknown" string is displayed instead.

See #2758
2021-01-23 23:04:01 +01:00
Alexis Degrugillier
297d188a46 Refactor requirement check in install (#3368)
I've extracted the template in the check requirement to
ensure that future modifications will be easier.
2021-01-23 22:53:17 +01:00
Alexis Degrugillier
29fe125b4a Add constant for PHP requirements (#3369)
* Add constant for PHP requirements

This new constant is used for PHP version check.
This way, we won't forget to modify some part of the code base.

* Remove PHP version checks

Some checks were obsolete because they were checking unsupported
PHP versions.
2021-01-14 23:28:45 +01:00
Alexandre Alapetite
9c6682e7ed Avoid manual initialisations of system or user configuration (#3070)
* Avoid manual intialisations of system or user configuration

More consistent use of Context

* Simplify FreshRSS_Context::initUser

* Remove a few manual get_user_configuration

* A bit of debugging

* Fix context user init

* Fix install

* Fix concurrency

Concurrent requests could lead to bad race condition

* Fix actualize cron

Fix case when system i initialised several times
2021-01-02 21:20:19 +01:00
Alexis Degrugillier
08d76967b0 Add temp folder check during install (#3312)
Before, the temp path was not check during install. With some configuration,
FRSS was not working because of a non-writable temp directory. It happened
with XAMPP on MacOS X but it might be the case for other platforms.
Now, the temp path is checked during install to make sure it is writable.

See #3310
2021-01-02 17:14:23 +01:00
Alexis Degrugillier
618cbaf0ce Remove Minz validation during install. (#3302)
As FRSS always comes with Minz, there is no need to validate that
it is there during install. If it turns out we need to validate that,
we might need to validate other libraries as well.
2020-12-29 00:12:17 +01:00
Alexandre Alapetite
abfbeb6b71 Cleaner use of session in install script (#3276)
Fix warning about session already started during install.
Refactor more code to use the same approach than in main FreshRSS.
Did not address all read accesses (not important) but did cover all
write accesses (important)
2020-12-22 17:37:19 +01:00
GuillaumePugnet
b00a06dc8d db username regex relaxed to allow @ (#3241)
Co-authored-by: Guillaume Pugnet <guillaume.pugnet@avanade.com>
2020-11-02 18:03:48 +01:00
Alexandre Alapetite
0319cc9d23 Minz allow parallel sessions (#3096)
* Minz allow parallel sessions

#fix https://github.com/FreshRSS/FreshRSS/issues/3093

* Array optimisation

* Array optimisation missing

* Reduce direct access to $_SESSION except in install process

* Fix session start headers warning

* Use cookie only the first time the session is started:
`PHP Warning:  session_start(): Cannot start session when headers
already sent in /var/www/FreshRSS/lib/Minz/Session.php on line 39`

* New concept of volatile session for API calls

Optimisation: do not use cookies or local storage at all for API calls
without a Web session
Fix warning:

```
PHP Warning:  session_destroy(): Trying to destroy uninitialized session
in Unknown on line 0
```

* Only call Minz_Session::init once in our index

It was called twice (once indirectly via FreshRSS->init())

* Whitespace

* Mutex for notifications

Implement mutex for notifications
https://github.com/FreshRSS/FreshRSS/pull/3208#discussion_r499509809

* Typo

* Install script is not ready for using Minz_Session
2020-10-06 23:19:45 +02:00
Marien Fressinaud
8619cf6fa6 Add a migration system (#2760)
* Add a Minz_Migrator class

Until now, we updated the database structure somewhere in the code but
it wasn't always consistent and somehow complicated to find. Also, this
code was always checked for nothing.

The Migrator aims to improve and ease the creation of migrations. It
should improve the way we apply the updates, making the update server
almost useless.

References:

- example of migration (before Migrator): cc0db9af4f (diff-11a53443fa81512b128c66b065df0679R10)
- update server: https://github.com/FreshRSS/update.freshrss.org
- PR moving the code of the update server to the core: https://github.com/FreshRSS/FreshRSS/pull/1760

* Automatically apply migrations

For now, administrators are used to have nothing to do during an update
else than getting the new code. I suggest to keep this behaviour and
automatically apply migrations if we detect new ones.

Another solution would be to create a CLI command and ask admins to call
it after getting the new code. It could hide migrations errors to end
users, but admin can forget to apply migrations since there are not used
to it.

* Add documentation for Minz Migrator

* Execute migrations even if next ones are applied

* Change mechanism to prevent multiple update at once

* Use mkdir to create the lock and to test it exists

Reference: https://stackoverflow.com/a/731634

* Append .lock to applied_migrations_path

There are no needs to define another file to serve as a lock.

* Change migrations naming convention

* Apply suggestions from code review

Co-Authored-By: Alexandre Alapetite <alexandre@alapetite.fr>

* Perform a low-cost migration versions comparaison

* Clarify version numbers concerning the migration system

Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>
2020-07-08 12:11:55 +02:00
Alexis Degrugillier
caeb660f29 Add a way to disable/enable users (#3056)
If you want to block users without deleting their account, you can now
disable them from the interface.
2020-06-14 19:50:09 +02:00
Julien-Pierre Avérous
acca89505b Enhance the way help elements are displayed (#2911)
* - Always display help under the targeted element.
- Use same help place for HTTP authentication in 'add' feed view than in 'update' feed view.
- Move help under input field in register view, as all other places (homogeneity).

* - Don't use "!important" as suggested by @Alkarex.
2020-04-20 23:27:17 +02:00
Frans de Jonge
25666ec5d3 [UI] Add RTL support with RTLCSS (#2776)
* Add dir info to gen.php & install.php!

* Add `make rtl` command

Using rtlcss because it has actually has a command-line application!
2020-03-01 21:15:17 +01:00
Alexis Degrugillier
3c099c7853 Add an admin flag on users (#2709)
Now FRSS supports more than one admin. Admins have the same rights as
the default user. Admins can promote or demote other users. The default
user is considered as an admin even if it does not have the admin flag
enabled.

See #2096
2020-01-06 20:28:04 +01:00
Alexandre Alapetite
2aff347b2e Fix wrong getHeader refactoring (#2749)
* Fix wrong getHeader refactoring

Fix regression introduced by
https://github.com/FreshRSS/FreshRSS/pull/2373
The refactoring required a call to init() even for static functions,
which is most of the time not done.
Removed premature abstraction of `$_SERVER`, which was the root cause of
the bug.
https://github.com/FreshRSS/FreshRSS/issues/2748#issuecomment-569898931

* Refactoring: Move serverIsPublic to Minz_Request

* Add mitigations for wrong configurations

Due to the regression, we have some existing configurations with a bad
base_url

* Forgot one instance
2020-01-04 23:35:42 +01:00
Marien Fressinaud
d0f1f9f141 Separate the update API password endpoint (#2675)
* Extract hashPassword method from userController

* Extract and refactor fever key-related methods

* Move update of API password to dedicated action

* Simplify the controller by refactoring feverUtil

* Add locales
2019-12-03 23:11:06 +01:00
Alexandre Alapetite
22030155f8 Fix database autocreate at install (#2635)
* Fix database autocreate at install

Several bugs prevented the auto-creation of the database in Web and CLI
installs.
Fix
https://github.com/YunoHost-Apps/freshrss_ynh/issues/84#issuecomment-549818408

* initDb

https://github.com/FreshRSS/FreshRSS/pull/2635#discussion_r343107795
2019-11-06 15:16:00 +01:00
Alexandre Alapetite
7a5236de3f Take advantage of PHP 5.4+ short echo (#2585)
* Take advantage of PHP 5.4+ short echo

https://php.net/migration54.new-features thanks to
https://github.com/FreshRSS/FreshRSS/pull/2495

Use `<?=  ?>` instead of `<?php echo; ?>`
10kB of code saved :-)

Done with regular expression:
```
<\?php echo (.+?);? *\?>
<?= \1 ?>
```

* Try Travis fix

https://github.com/squizlabs/PHP_CodeSniffer/issues/2045#issuecomment-395238272
2019-10-23 11:18:20 +02:00
Alexis Degrugillier
cc0db9af4f Feature/new archiving (#2335)
* Change archiving config page layout

I've changed some wording and moved actions into a
maintenance section.

* Update purge action

Now we have more control on the purge action. The configuration allows
us to choose what to keep and what to discard in a more precise way.
At the moment, the configuration applies for all feeds.

* Add purge configuration on feed level

Now the extend purge configuration is available on feed level.
It is stored as attributes and will be used in the purge action.

* Update purge action

Now the purge action uses the feed configuration if it exists and
defaults on user configuration if not.

* Add empty option in period list

* Fix configuration warnings

* Add archiving configuration on categories

See #2369

* Add user info back

* Add explanations in UI

* Fixes for SQLite + error + misc.

* Fix invalid feed reference

* Short array syntax

Only for new code, so far

* Fix prefix error

* Query performance, default values

Work in progress

* Fix default values and confirm before leaving

Form cancel and confirm changes before leaving were broken.
And start taking advantage of the short echo syntax `<?= ?>` as we have
moved to PHP 5.4+

* More work

* Tuning SQL

* Fix MariaDB + performance issue

* SQL performance

* Fix SQLite bug

* Fix some attributes JSON encoding bugs

Especially for SQLite export/import

* More uniform, fix bugs

More uniform between global, category, feed settings

* Drop special cases for old articles during refresh

Instead will use lastSeen date with the new archiving logic.
This was generating problems anyway
https://github.com/FreshRSS/FreshRSS/issues/2154

* Draft drop index keep_history

Not needed anymore

* MySQL typo

Now properly tested with MySQL, PostgreSQL, SQLite

* More work for legacy values

Important to avoid overriding user's preference and risking deleting
data erroneously

* Fix PHP 7.3 / 7.4 warnings

@aledeg "Trying to use values of type null, bool, int, float or resource
as an array (such as $null["key"]) will now generate a notice. "
https://php.net/migration74.incompatible

* Reintroduce min articles and take care of legacy parameters

* A few changes forgotten

* Draft of migration + DROP of feed.keep_history

* Fix several errors

And give up using const for SQL to allow multiple database types (and we
cannot redefine a const)

* Add keep_min to categories + factorise archiving logic

* Legacy fix

* Fix bug yield from

* Minor: Use JSON_UNESCAPED_SLASHE for attributes

And make more uniform

* Fix sign and missing variable

* Fine tune the logic
2019-10-23 00:52:15 +02:00
Alexandre Alapetite
40686d68df Catch error in install (#2556) 2019-10-05 17:12:05 +02:00
Alexandre Alapetite
e3e5954394 PDO refactoring for code simplification (#2522)
* PDO refactor

* Automatic prefix when using the syntax `_tableName`
* Uniformity: MySQL is now PDO::ATTR_EMULATE_PREPARES = false just like SQLite and PostgreSQL, with consequences such as only one statement per query
* Use PDO methods exec(), query(), prepare() + execute() in a more efficient way
* Remove auto-update SQL code for versions older than FreshRSS 1.5 (3 years old)
* The name of the default category is set in PHP instead of in the DB (simplies SQL and allows changing the name according to the FreshRSS language)
* Rename `->bd` to `->pdo` (less of a frenshism, and more informative)
* Fix some requests, which were not compatible with MySQL prepared statements

* Whitespace

* Fix syntax for PostgreSQL sequences

+ MySQL install

* Minor formatting

* Fix lastInsertId for PostgreSQL

* Use PHP 5.6+ const

Take advantage of https://github.com/FreshRSS/FreshRSS/pull/2527
https://www.php.net/manual/en/migration56.new-features.php

* A bit of forgotten PHP 5.6 simplification for cURL

* Forgotten $s

* Mini fix custom user config

https://github.com/FreshRSS/FreshRSS/pull/2490/files#r326290346

* More work on install.php but not finished

* install.php working

* More cleaning of PDO in install

* Even more simplification

Take advantage of PDO->exec() to run multiple statements

* Disallow changing the name of the default category

https://github.com/FreshRSS/FreshRSS/pull/2522#discussion_r326967724
2019-09-29 16:22:50 +02:00
Alexandre Alapetite
e761202f8a Remove JSON.php fallback (#2528)
After moving to PHP 5.6+ https://github.com/FreshRSS/FreshRSS/pull/2527
it should not be necessary to have the JSON.php fallback anymore, which
was mainly there due to an obscure licensing issue 6 years ago in Debian
https://wiki.debian.org/qa.debian.org/jsonevil , which broke Ubuntu
13.10 https://github.com/FreshRSS/FreshRSS/issues/306
2019-09-18 17:18:36 +02:00
Alexandre Alapetite
38117df976 Require PHP 5.6+
Discussion
https://github.com/FreshRSS/FreshRSS/pull/2495#issuecomment-531911473
Needed for constant arrays
https://www.php.net/manual/en/migration56.new-features.php which will be
used in https://github.com/FreshRSS/FreshRSS/pull/2522
2019-09-17 20:28:07 +02:00
Marien Fressinaud
7b4cd3abae add: Allow admins to configure default feeds (#2515)
* Homogenize SQL_INSERT_FEEDS across database types

* Extract default feeds into system configuration

* Adapt default feeds init during installation
2019-09-11 18:40:17 +02:00
Alexandre Alapetite
6cedeeeae5 Minz: New environment variable to control development mode (#2508)
* New environment variable to control development mode

Suggestion of new enviromnent variable, as discussed
https://github.com/FreshRSS/FreshRSS/pull/2492#issuecomment-523613920

* Update Docker/README.md

Co-Authored-By: Frans de Jonge <fransdejonge@gmail.com>

* Update Docker/README.md

Co-Authored-By: Frans de Jonge <fransdejonge@gmail.com>

* Update Docker/README.md

Co-Authored-By: Frans de Jonge <fransdejonge@gmail.com>

* Declare ENV in Dockerfile

Tested
2019-08-22 20:04:26 +02:00
Alexandre Alapetite
fd33d92d41 Require PHP 5.5+ (#2495)
* Require PHP 5.5+

https://github.com/FreshRSS/FreshRSS/issues/2469#issuecomment-522255093
I think it would be reasonable to require PHP 5.5+ for the core of
FreshRSS after all.

As Frenzie said, WordPress currently requires PHP 5.6.20+, and it is the
most popular PHP application.

We would loose about 20% of the PHP servers according to
https://w3techs.com/technologies/details/pl-php/5/all but I expect this
number to drop fast after the release of CentOS 8 (CentOS accounts for
17% of Linux servers
https://w3techs.com/technologies/details/os-linux/all/all ).

Distributions:
* no impact on Ubuntu, Fedora, Alpine, OpenWRT, FreeBSD, OpenSuze,
Mageia, as all active versions have PHP > 7
* no impact on OpenSuze, Synology, as all active versions have PHP > 5.5
* we drop Debian 8 Jessie (-2020) - we keep supporting Debian 9 Stretch
(2017-06) - current is Debian 10 Buster
* we drop Red Hat 7 (-2024) - we keep supporting RHEL 8 (2019-05)
* we drop CentOS 7 (-2024) - we will support CentOS 8 (to be released
soonish)

When dropping older versions, I can better like when it is for a good
reason, and there is actually one with PHP 5.5, namely generators
(yield) https://php.net/language.generators.overview which I consider
using.

* Version note for JSON.php

* hex2bin

* Update .travis.yml

Co-Authored-By: Frans de Jonge <fransdejonge@gmail.com>
2019-08-20 14:55:43 +02:00
Alexandre Alapetite
f5fb8e8d2a Default to SQLite (#2443)
Move SQLite as first option in install instead of MySQL. Lower barrier
to entry.
2019-07-14 14:37:46 +02:00
Alexandre Alapetite
8c2cf1b4dd Docker healthcheck+ labels (#2438)
* Add Docker labels

And try to fix the platform metadata for ARM, and add health check

* Execution rights

* Remove experimental features not supported by Docker Hub

"--squash" is only supported on a Docker daemon with experimental
features enabled. build hook failed! (1)

* Fix paths
2019-07-07 20:07:01 +02:00
Alexandre Alapetite
6fe9ec9f76 Allow email as admin username (#2421)
Fix https://github.com/FreshRSS/FreshRSS/issues/2418
https://github.com/FreshRSS/FreshRSS/pull/2407
2019-06-22 00:06:08 +02:00
Alexandre Alapetite
e9d50f48eb HTTP_X_FORWARDED_PREFIX for cookie path (#2201)
Forgotten. Follow-up of https://github.com/FreshRSS/FreshRSS/pull/2191
2018-12-27 22:57:30 +01:00
Alexandre Alapetite
8ee8a573f1 Custom labels (#2027)
* First draft of custom tags

https://github.com/FreshRSS/FreshRSS/issues/928
https://github.com/FreshRSS/FreshRSS/issues/1367

* SMALLINT to BIGINT for id_entry

And uppercase SQL types

* Fix layout for unreads

* Start UI menu

* Change menu order

* Clean database helpers

https://github.com/FreshRSS/FreshRSS/pull/2027#discussion_r217971535

* Travis rules do not understand PostgreSQL constants

Grrr

* Tag controller + UI

* Add column attributes to tags

* Use only favicon for now, for label

* Fix styling for different themes

* Constant for maximum InnoDB index length in Unicode

https://github.com/FreshRSS/FreshRSS/pull/2027#discussion_r219052200
(I would have personnally prefered keeping the readability of a real
value instead of a constant, in this case of many SQL fields)

* Use FreshRSS_Factory::createCategoryDao

* Add view of all articles containing any tag

* Fix search in tags

* Mark as read tags

* Partial auto-update unread tags

* More auto update tag unreads

* Add tag deletion

* Do not purge tagged articles

* Minor comment

* Fix SQLite and UI bug

* Google Reader API support for user tags

Add SQL check that tag names must be distinct from category names

* whitespace

* Add missing API for EasyRSS

* Compatibility SQLite

Problematic parentheses

* Add SQL DISTINCT for cases with multiple tags

* Fix for PostgreSQL

PostgreSQL needs some additional type hint to avoid "could not determine
data type of parameter $1"

http://www.postgresql-archive.org/Could-not-determine-data-type-of-parameter-1-tp2171092p2171094.html
2018-09-29 20:47:17 +02:00
Alexandre Alapetite
de4db714f5 MySQL allow dash in database name (#2005)
Allow `-` in database name
https://diasp.eu.com/posts/d2e36450847101364cab0007cb0b6c8d
2018-09-08 11:42:18 +02:00
Alexandre Alapetite
32d9c3b790 Use mb_strcut (#1996)
* Use mb_strcut

Avoid cutting in the middle of a multi-byte UTF-8 character

* Forgotten php5-*

* Typo

* Whitespace

* More mb_strcut
2018-09-02 13:19:58 +02:00
Alexandre Alapetite
0513ba8d9f Use HTML autocomplete new-password (#1877)
* Use HTML autocomplete new-password

https://github.com/FreshRSS/FreshRSS/issues/1841#issuecomment-376551901
autocomplete="new-password" for user management pages

https://developer.mozilla.org/en-US/docs/Web/Security/Securing_your_site/Turning_off_form_autocompletion

* autocomplete username

https://html.spec.whatwg.org/multipage/form-control-infrastructure.html#attr-fe-autocomplete-username
2018-05-01 21:50:45 +02:00
Frans de Jonge
4e174ed9dd [ci] Add Travis (#1619)
* [ci] Add Travis

* Exclude some libs

* Semi-auto whitespace fixes

* line length in SQLite

* Exclude tests from line length

* Feed.php line length

* Feed.php: get rid of unnecessary concat

* Feed.php: line length

* bootstrap.php: no newline at end of file

* Allow concatenating across multiple lines

* Add Travis badge

* do-install line length

* update-or-create-user line length

* cli/create-user line length

* tests/app/Models/SearchTest.php fix indentation

* tests/app/Models/UserQueryTest.php fix indentation

* tests/app/Models/CategoryTest.php fix indentation

* [fix] PHP 5.3 on precise

* cli/do-install no spaces

* cli/list-users line length

* cli/reconfigure line length

* empty catch statements

* api/index line length nonsense

* spaces before semicolon

* app/Models/EntryDAO bunch of indentation

* extra blank lines

* spaces before comma in function call

* testing tabwidth

* increase to 10

* comment out tabwidth line

* try older phpcs version 3.0.0RC4

* line length exception for app/install.php

* proper spaces

* stray spaces in i18n

* Minz/ModelPdo line length

* Minz whitespace

* greader line length

* greader elseif placement

* app/Models/Feed.php spacing in function argument

* ignore php 5.3

* app/Models/ConfigurationSetter.php stray whitespace

* EntryDAOSQLite line length

* I vote for higher max line length =P

* ignore SQL

* remove classname complaint

* line length/more legible SQL

* ignore line length nonsense

* greader line length

* feedController issues

* uppercase TRUE, FALSE, NULL

* revert

* importExportController lowercase null

* Share.php default value not necessary because ! is_array () a few lines down

* CategoryDAO constants should be UPPERCASE

* EntryDAO reduce line length

* contentious autofix

* Allow failures on all versions of PHP except 7.1 because reasons
2017-09-22 12:13:46 +02:00
Alexandre Alapetite
a72ad940df Increase minimal support to PHP 5.3.8+
https://github.com/FreshRSS/FreshRSS/issues/1604
2017-08-21 12:29:12 +02:00
Alexandre Alapetite
c3f2302be7 Update username constraints
https://github.com/FreshRSS/FreshRSS/issues/1597
2017-07-22 15:47:13 +02:00
Alexandre Alapetite
af8960b8b3 Move default configuration files
https://github.com/FreshRSS/FreshRSS/issues/1531
2017-05-12 23:33:58 +02:00
Alexandre Alapetite
a542ab8fff Make fileinfo extension optional 2017-04-08 18:12:12 +02:00
Alexandre Alapetite
7d6ab5fc4e Merge branch 'postgress-uniqueness' into defered-insertion 2017-04-01 11:26:24 +02:00
Alexandre Alapetite
50fd3a359e Fix PostgreSQL uniqueness
And remove "experimental" warning
2017-04-01 11:24:59 +02:00
Alexandre Alapetite
22b41f3bfc Candidate implementation of defered insertion
https://github.com/FreshRSS/FreshRSS/issues/530
2017-03-26 00:01:11 +01:00
Alexandre Alapetite
be2bf83e3c Remove maxlength for usernames
pattern is already used
2017-02-25 12:56:57 +01:00