Commit Graph
6761 Commits
Author SHA1 Message Date
dependabot[bot]andAlexandre Alapetite 8e57e28a9a Update phpmailer/phpmailer requirement from 6.10.0 to 6.11.1 in /lib (#8048)
* Update phpmailer/phpmailer requirement from 6.10.0 to 6.11.1 in /lib

Updates the requirements on [phpmailer/phpmailer](https://github.com/PHPMailer/PHPMailer) to permit the latest version.
- [Release notes](https://github.com/PHPMailer/PHPMailer/releases)
- [Changelog](https://github.com/PHPMailer/PHPMailer/blob/master/changelog.md)
- [Commits](https://github.com/PHPMailer/PHPMailer/compare/v6.10.0...v6.11.1)

---
updated-dependencies:
- dependency-name: phpmailer/phpmailer
  dependency-version: 6.11.1
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>

* composer update --no-autoloader

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>
2025-10-01 21:03:22 +02:00
Alexandre Alapetite df4b76f74b PHPStan 2.1.29 (#8052)
Replace:
* https://github.com/FreshRSS/FreshRSS/pull/8049
* https://github.com/FreshRSS/FreshRSS/pull/8050
2025-10-01 21:02:42 +02:00
dependabot[bot] bb7a20094b Bump the stylelint group with 2 updates (#8044)
Bumps the stylelint group with 2 updates: [stylelint](https://github.com/stylelint/stylelint) and [stylelint-config-recommended-scss](https://github.com/stylelint-scss/stylelint-config-recommended-scss).


Updates `stylelint` from 16.23.1 to 16.24.0
- [Release notes](https://github.com/stylelint/stylelint/releases)
- [Changelog](https://github.com/stylelint/stylelint/blob/main/CHANGELOG.md)
- [Commits](https://github.com/stylelint/stylelint/compare/16.23.1...16.24.0)

Updates `stylelint-config-recommended-scss` from 16.0.0 to 16.0.2
- [Release notes](https://github.com/stylelint-scss/stylelint-config-recommended-scss/releases)
- [Changelog](https://github.com/stylelint-scss/stylelint-config-recommended-scss/blob/master/CHANGELOG.md)
- [Commits](https://github.com/stylelint-scss/stylelint-config-recommended-scss/compare/v16.0.0...v16.0.2)

---
updated-dependencies:
- dependency-name: stylelint
  dependency-version: 16.24.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: stylelint
- dependency-name: stylelint-config-recommended-scss
  dependency-version: 16.0.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: stylelint
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-10-01 20:29:16 +02:00
dependabot[bot] 69974bf6a1 Bump sass from 1.91.0 to 1.93.2 (#8045)
Bumps [sass](https://github.com/sass/dart-sass) from 1.91.0 to 1.93.2.
- [Release notes](https://github.com/sass/dart-sass/releases)
- [Changelog](https://github.com/sass/dart-sass/blob/main/CHANGELOG.md)
- [Commits](https://github.com/sass/dart-sass/compare/1.91.0...1.93.2)

---
updated-dependencies:
- dependency-name: sass
  dependency-version: 1.93.2
  dependency-type: direct:development
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-10-01 20:22:44 +02:00
Alexandre AlapetiteandAlexis Degrugillier 2601897c55 API optimisation: more streaming of outputs (#8041)
* API optimisation: more streaming of outputs
I spotted a memory issue when testing https://github.com/FreshRSS/FreshRSS/pull/7714
Attempt to stream results more, instead of keeping too much in memory.
Could be further improved.

* Apply suggestions from code review

Co-authored-by: Alexis Degrugillier <aledeg@users.noreply.github.com>

* Minor whitespace JSON formatting

---------

Co-authored-by: Alexis Degrugillier <aledeg@users.noreply.github.com>
2025-10-01 20:21:24 +02:00
dependabot[bot] a2446e2b30 Bump peter-evans/dockerhub-description from 4.0.2 to 5.0.0 (#8046)
Bumps [peter-evans/dockerhub-description](https://github.com/peter-evans/dockerhub-description) from 4.0.2 to 5.0.0.
- [Release notes](https://github.com/peter-evans/dockerhub-description/releases)
- [Commits](https://github.com/peter-evans/dockerhub-description/compare/432a30c9e07499fd01da9f8a49f0faf9e0ca5b77...1b9a80c056b620d92cedb9d9b5a223409c68ddfa)

---
updated-dependencies:
- dependency-name: peter-evans/dockerhub-description
  dependency-version: 5.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-10-01 20:12:38 +02:00
dependabot[bot] 3d6b8f7f0f Bump actions/setup-node from 4 to 5 (#8047)
Bumps [actions/setup-node](https://github.com/actions/setup-node) from 4 to 5.
- [Release notes](https://github.com/actions/setup-node/releases)
- [Commits](https://github.com/actions/setup-node/compare/v4...v5)

---
updated-dependencies:
- dependency-name: actions/setup-node
  dependency-version: '5'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-10-01 20:06:31 +02:00
dependabot[bot] 046b172930 Bump the eslint group with 3 updates (#8043)
Bumps the eslint group with 3 updates: [eslint](https://github.com/eslint/eslint), [@eslint/js](https://github.com/eslint/eslint/tree/HEAD/packages/js) and [globals](https://github.com/sindresorhus/globals).


Updates `eslint` from 9.34.0 to 9.36.0
- [Release notes](https://github.com/eslint/eslint/releases)
- [Changelog](https://github.com/eslint/eslint/blob/main/CHANGELOG.md)
- [Commits](https://github.com/eslint/eslint/compare/v9.34.0...v9.36.0)

Updates `@eslint/js` from 9.34.0 to 9.36.0
- [Release notes](https://github.com/eslint/eslint/releases)
- [Changelog](https://github.com/eslint/eslint/blob/main/CHANGELOG.md)
- [Commits](https://github.com/eslint/eslint/commits/v9.36.0/packages/js)

Updates `globals` from 16.3.0 to 16.4.0
- [Release notes](https://github.com/sindresorhus/globals/releases)
- [Commits](https://github.com/sindresorhus/globals/compare/v16.3.0...v16.4.0)

---
updated-dependencies:
- dependency-name: eslint
  dependency-version: 9.36.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: eslint
- dependency-name: "@eslint/js"
  dependency-version: 9.36.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: eslint
- dependency-name: globals
  dependency-version: 16.4.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: eslint
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-10-01 20:06:03 +02:00
TijnvandenEijnde fcc272f692 Add your news to readme (#7714)
* Added Your News to README.md

https://github.com/FreshRSS/FreshRSS/issues/7694

* Reversed iOS table entry, reverted changes and modiffied Android entry to show both Android, iOS and remove checkmark for free software

* Removed checkmark for labels because it is not supported
2025-10-01 13:46:17 +02:00
Alexis Degrugillier dac275ce3a Add support for extension priority (#8038)
Extension can now define their hook priority. This will allow to define the order in which hooks are triggered.

See #7110

Closes #7110

Changes proposed in this pull request:

- Add support for extension priority

How to test the feature manually:

1. Create an extension with 2 hooks on the same hook type but different priority
2. The hooks must be prepending the title with different values
3. Validate that changing the hook priority changes the final title accordingly.
2025-10-01 11:01:31 +02:00
2bcc090622 configurable notification timeout (#7942)
Ref #7931
Ref #5466
Ref #6409

added configuration in "Display"
<img width="636" height="167" alt="grafik" src="https://github.com/user-attachments/assets/7bbc9f26-d91b-4dd2-b715-1d3f9b7a9ad3" />

* i18n: fr

* Update app/i18n/pl/conf.php

Co-authored-by: Inverle <inverle@proton.me>

* make fix-all

* max()

* Minor whitespace
(I am not a fan of excessive vertical indenting)

---------

Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>
Co-authored-by: Inverle <inverle@proton.me>
2025-10-01 10:48:07 +02:00
Alexis Degrugillier 72884813e1 Add hook enums (#8036)
- add an enum to handle hook types (enum are available since PHP 8.1)
- change hook calls from string value to enum value
2025-09-30 22:59:41 +02:00
Inverle bf6e634e04 Fix autocomplete issues in change password form (#7812)
## Screenshots

<details>
<summary>Before</summary>

<img width="773" height="652" alt="image" src="https://github.com/user-attachments/assets/89a0e58c-8c4a-41ff-b5d6-3e916079d563" />

</details>

<details>
<summary>After</summary>

<img width="1006" height="646" alt="image" src="https://github.com/user-attachments/assets/f4575103-7365-4870-a170-2742bf10eb27" />

</details>

This is an example on Firefox, where the `Master authentication token` field was incorrectly being autofilled.
Red borders are indicating that the fields are required.

## List of changes

* `required="required"` is now being added to the password fields if the section is open
* The `challenge` field is being added if section is open instead of when at least one of the password fields isn't empty due to autocomplete
* Added `autocomplete="new-password"` on fields that shouldn't be autocompleted
   * Unfortunately Chrome requires a workaround with CSS
   * Not tested on Safari yet
* User will be redirected to profile page after successfully changing their password instead of index page

## How to test

Autocomplete related changes should be tested on a HTTPS page with saved credentials for FreshRSS
2025-09-30 10:12:15 +02:00
Alexandre AlapetiteandInverle 34532c0dd4 Add new visibility priority *Show in its feed* (#7972)
* Add new visibility priority *Show in its feed*
fix https://github.com/FreshRSS/FreshRSS/pull/7970#issuecomment-3293917428 (you can't directly filter a hidden feed, it just shows a 404 page)
And add a new visibility *Show in its feed* to show the feed in the list but not its articles.
Ensure that visibility *hidden* is not shown to API.

* TODO for later

* Update app/i18n/pl/sub.php

Co-authored-by: Inverle <inverle@proton.me>
2025-09-30 10:05:17 +02:00
Inverle 11e6e0394c Fix more CSRFs (#8035)
Follow-up of #8000 

Some were still missed in `feedController`.
even had comments but no check:

https://github.com/FreshRSS/FreshRSS/blob/0d463b67bdade2e896b7fa74595950eeaadd55fe/app/Controllers/feedController.php#L1053-L1055

https://github.com/FreshRSS/FreshRSS/blob/0d463b67bdade2e896b7fa74595950eeaadd55fe/app/Controllers/feedController.php#L374-L376
2025-09-29 23:52:19 +02:00
Lars Kellogg-Stedman 0d463b67bd Reverse arguments to array_merge of cusotm config (#8033)
The installer was merging the initial configuration into the custom
configuration, which meant that any keys set in the system configuration
would take precedence over custom configuration. Practically, this meant it
was not possible to preconfigure the database connection via
`config.custom.php`.

This commit reverses the order of the arguments to the `array_merge`
function so that keys in the custom configuration will override keys in the
initial configuration.

See also: https://github.com/FreshRSS/FreshRSS/discussions/8030
2025-09-29 17:04:45 +02:00
Daniel Scharmach 5e413ef0ce Update German (#8028)
* Update index.php

"Vorgestern" was technically not correct here, in my opinion:

- "Vorgestern empfangen" implies this is only for the day before yesterday
- "Vor gestern empfangen" would instead include everything before yesterday, too

* Update sub.php

Correction of small typo
2025-09-29 15:24:28 +02:00
Alexandre Alapetite 5e8c964f6c Stable IDs during SQL import (#7988)
* Stable IDs during SQL import
Follow-up of https://github.com/FreshRSS/FreshRSS/pull/7949
Make sure that the original category IDs, feed IDs, and label IDs are kept identical during an SQL import.
Avoid breaking everything referring to categories, feeds, labels by their IDs such as searches and third-party extensions.

* Fix export of default category
2025-09-27 15:11:55 +02:00
Alexandre Alapetite fdbdd118bf Start 1.27.2-dev 2025-09-27 15:09:53 +02:00
Alexandre Alapetite 3f9b7b3331 Release 1.27.1 1.27.1 2025-09-27 14:51:48 +02:00
Alexandre Alapetite 5532025de2 Changelog 2025-09-27 14:49:57 +02:00
Alexandre Alapetite 3a795eb5db Fix regression in ext.php (#8021)
fix https://github.com/FreshRSS/Extensions/issues/370
Regression from https://github.com/FreshRSS/FreshRSS/pull/7857
2025-09-27 14:40:35 +02:00
Inverle 2da733b5cf Dark-pink theme: remove white background from configure buttons (#8020)
Before:

<img width="273" height="116" alt="image" src="https://github.com/user-attachments/assets/4fb9b1f2-b960-428e-9c3f-84e803cd0afa" />

After:

<img width="239" height="111" alt="image" src="https://github.com/user-attachments/assets/7528649b-47f0-4111-8cf8-ac54080d5573" />
2025-09-27 14:21:59 +02:00
maThandAlexandre Alapetite e79c2866bd fix: anonym. mode: Do not show config button in sharing menu (#8012)
* Ref #8001
Do not show the config button in the article sharing menu if it is in the anonym. mode

* Minor whitespace reduction
Because it is a section that is used many times

---------

Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>
2025-09-25 23:20:50 +02:00
Inverle 9dd30f03ec Improve restriction of curl params (#8009)
Rework #7979 
Forgot to change `httpGet()`, which is used in multiple places
2025-09-25 22:50:21 +02:00
maTh cec21f231f fix: anonym. mode: label management link (#8011)
Ref: #8001

Changes proposed in this pull request:

- do not show the "manage" dropdown menu for labels in anonym. mode (normal view)

Before:
<img width="304" height="139" alt="grafik" src="https://github.com/user-attachments/assets/2aff0299-febe-41b0-a99a-450559393cd6" />


After:
<img width="281" height="121" alt="grafik" src="https://github.com/user-attachments/assets/69ad334e-0a31-4546-9939-9b72306db046" />
2025-09-25 22:47:09 +02:00
Inverle f8b2b8c415 Prevent logout CSRFs (#7999)
By avoiding `FreshRSS_Context::initUser()` calls
2025-09-25 21:52:29 +02:00
maTh 960c6c88a5 Fix: sharing button in top line when 0 entries (#8010)
ref #8001 

Changes proposed in this pull request:

- count entries, do not show share button when 0 sharing services


How to test the feature manually:
1. having 0 sharing services
2. enable the sharing button in top line (settings -> display>
3. go to normal view -> sharing button should not be displayed in the article entry
4. add 1 sharing service
5. normal view -> sharing button is be displayed
2025-09-25 21:41:13 +02:00
Inverle f612a560d2 Fix some CSRFs (#8000)
In two bookmark actions and one in `entryController`

Completes one TODO from #7923:

https://github.com/FreshRSS/FreshRSS/blob/de624dc8ce63ec819c61216d9d44f828841c293e/app/Controllers/entryController.php#L257

(a POST request is already sent in the frontend)
2025-09-24 12:13:40 +02:00
Inverle 067479a9f1 Lazy-load <track src> (#7997)
Follow-up of #7636

I found it's the only missing element that needs to be lazy loaded by putting HTML of https://github.com/cure53/HTTPLeaks/blob/main/leak.html into a feed
2025-09-23 22:12:44 +02:00
Alexandre Alapetite 87087e4473 Changelog, credits 2025-09-23 21:45:39 +02:00
Alexandre Alapetite 833007f586 Upgrade to PHP_CodeSniffer 4 (#7993)
https://github.com/PHPCSStandards/PHP_CodeSniffer/wiki/Version-4.0-User-Upgrade-Guide
A couple of rules have changed name. Exclusion paths have slightly changed behaviour.
Main change is that it was unhappy with our i18n header comments, so minor edit there, since that rule kind of makes sense the rest of the time
2025-09-22 22:02:59 +02:00
KleinMann aadbdabd83 add rnkln to credits (#7992) 2025-09-22 19:26:47 +02:00
Alexandre Alapetite 92a73a2c4f Minor forgotten str_starts_with (#7991)
A couple of places, which have been forgotten when we moved to using `str_starts_with()` instead of `strpos()`.
2025-09-21 19:06:06 +02:00
f0388f64ac Update German (#7833)
* Update sub.php

German translation added.

* Update gen.php

German translation added

* make fix-all

* Update conf.php

* make fix-all

* Update index.php

* make fix-all

* Update admin.php

* Update feedback.php

* Update app/i18n/de/index.php

* make fix-all

* Apply suggestions from code review

Co-authored-by: maTh <1645099+math-GH@users.noreply.github.com>

* Update app/i18n/de/index.php

Co-authored-by: maTh <1645099+math-GH@users.noreply.github.com>

* Update app/i18n/de/feedback.php

Co-authored-by: maTh <1645099+math-GH@users.noreply.github.com>

* Icon

* make fix-all

---------

Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>
Co-authored-by: maTh <1645099+math-GH@users.noreply.github.com>
Co-authored-by: Alexis Degrugillier <aledeg@users.noreply.github.com>
2025-09-21 13:45:12 +02:00
Alexandre Alapetite bc3e4c8fa4 Add option for CSP frame-ancestors (#7857)
* Add option for CSP frame-ancestors
https://github.com/FreshRSS/FreshRSS/discussions/7856

* Revert contentSelectorPreviewAction

* Same for f.php and api

* Fix double init in f.php

* No sandbox for API page
2025-09-21 13:29:58 +02:00
Alexandre Alapetite f1cf57b5b7 Changelog 2025-09-21 13:24:25 +02:00
Inverle f2c6942a60 Move update one step before (#7989)
Closes https://github.com/FreshRSS/FreshRSS/issues/7897
2025-09-21 12:40:40 +02:00
Alexis Degrugillier caecc5decf fix linkding documentation link (#7985)
Closes #7984 

Changes proposed in this pull request:

- fix linkding documentation link

How to test the feature manually:

1. add a linkding sharing method
2. click on the documentation link
3. validate that the link is working
2025-09-20 18:06:55 +02:00
Horváth Zsolt 16c5d84166 Add myself to credits (#7987)
https://github.com/FreshRSS/FreshRSS/pull/7986
2025-09-20 13:30:09 +02:00
Horváth Zsolt 508b1bb1ce 6846 i18n update hungarian language (#7986)
* Update hungarian translation

* Update hungarian translation status as well
2025-09-20 00:10:26 +02:00
KleinMann d670bf1e72 Add entry_before_update and entry_before_add hooks (#7977)
Discussion: https://github.com/FreshRSS/FreshRSS/discussions/7973

Changes proposed in this pull request:

- Add new extension hook "entry_before_add"
- Add new extension hook "entry_before_update"

How to test the feature manually:

1. Create extension that uses the hooks and confirm they are invoked correctly.

Extension to use for testing
https://github.com/rnkln/freshrss-xExtension-Discord/pull/2
2025-09-18 23:44:17 +02:00
Inverle 055342118f Restrict allowed curl parameters (#7979)
For additional safety, also making sure in this PR that [`CURLOPT_COOKIEFILE`](https://curl.se/libcurl/c/CURLOPT_COOKIEFILE.html) is only allowed as an empty string during import.
2025-09-18 23:43:04 +02:00
Alexandre Alapetite b5ee1d8936 Keep sort and order after marking as read (#7974)
fix https://github.com/FreshRSS/FreshRSS/issues/7867
2025-09-17 14:03:00 +02:00
Inverle 25250f46b4 Safer calling of install.php (#7971)
To prevent `install.php` from being accessed in unintended places
2025-09-16 00:53:15 +02:00
Alexandre Alapetite f8310a587c Clarify: Visibility hidden vs. archived (#7970)
fix https://github.com/FreshRSS/FreshRSS/issues/7887
We have two concepts: how much a feed is shown or not (controlled by priority), and how often a feed is refreshed (or not, in which case it is archived).
This PR removes the wording *Archived* from the *visibility* parameter, since this is not what it does.
2025-09-15 23:43:46 +02:00
Alexandre Alapetite ea366d597f Minor RSS output whitespace reduction (#7969)
fix https://github.com/FreshRSS/FreshRSS/issues/7968
2025-09-15 22:26:45 +02:00
Inverle ddb51c0e95 Fix another user self-delete regression (#7877)
Regression from #7763 
Earlier regression which was fixed before #7626

In addition:
* get rid of `data-toggle` (refactor)
* show invalid login message if deleting account and entered incorrect password instead of redirect to 403
* remove unused reference to `r` parameter
* `forgetOpenCategories()` on login not on any crypto form
2025-09-15 22:17:14 +02:00
38b7daedf7 i18n zh-CN: Update conf.php (#7944)
* Update conf.php

Supplementary part of the translation.

* Update app/i18n/zh-cn/conf.php

* Update app/i18n/zh-cn/conf.php

* Update app/i18n/zh-cn/conf.php

* Fixes

---------

Co-authored-by: Frans de Jonge <fransdejonge@gmail.com>
Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>
2025-09-15 22:12:25 +02:00
Alexandre Alapetite 778d0668e2 Changelog 2025-09-15 22:06:00 +02:00