Follow-up to #9541.
In `p/api/query.php`, the optional `search` parameter of a shared user query was appended as a string to the user query's own search, and the result was parsed again.
This keeps both searches as parsed objects and combines them with a structural AND via `FreshRSS_BooleanSearch::add()`, avoiding the serialise/re-parse round trip. Adds a test for combining Boolean searches with `add()`.
* Support choosing the sort type when creating or editing a user query
Changes
- User queries can now store a sort field (sort type), not only the sort
direction. The create and edit forms expose a single combined dropdown
(field + direction) that reuses the existing `index.menu.sort.*` options,
matching the global reading-settings sort UI.
- The "Bookmark current query" action now also remembers the current sort
field, where it previously kept only the order direction.
- Relabel the query sort control from "Sort by date" to "Sort by"; other
languages are marked for re-translation (// TODO).
- Add a CHANGELOG entry and credit the contributor in CREDITS.
Implementation
- `FreshRSS_UserQuery`: add an optional `sort` property mirroring `order`
(constructor parsing, `toArray()`, `getSort()` falling back to the user
default sort, and a `hasParameters()` check).
- `configureController`: split the combined dropdown value into `sort` and
`order`, validating the field against the implemented sort types
(`id`, `c.name`, `date`, `f.name`, `length`, `link`, `title`, `rand`);
separate `sort`/`order` request parameters are still accepted so the
"bookmark current query" flow keeps working.
- Views render the combined dropdown and persist `sort` as a hidden field.
- `p/api/query.php`: back-fill `sort` from the saved query when the request
does not provide one, mirroring the existing `order` handling.
- Add unit tests covering the sort round-trip and `toArray()` inclusion.
Compatibility
- No database or schema change: user queries are stored in the per-user PHP
config array, which keeps arbitrary keys verbatim, so no migration is
required.
- Upgrade: existing queries without `sort` fall back to the user default
sort; behaviour is unchanged until a sort is explicitly chosen.
- Downgrade: older versions ignore the extra `sort` key and keep working;
re-saving under an old version simply drops the key with no data loss.
- Shared query URLs without a `sort` parameter remain valid.
* Refresh README translation statistics
* i18n: fr
---------
Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>
* Fix infinite redirect loop due to `SCRIPT_NAME` in `PATH_INFO`
* Move to Minz_Request::pathInfo()
---------
Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>
* Limit the length and parentheses nesting depth of a search query.
* Use exception
---------
Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>
* Gate greader/json share formats behind Share by OPML
Follow-up to #9246, per @Alkarex's suggestion on GHSA-rpmm-h4hx-5p6p.
The greader and json share formats expose origin.feedUrl (the feed's subscription
URL). Sharing feed URLs is what the "Share by OPML" option explicitly means, whereas
"Share by RSS" is meant to share article content. This moves greader and json in
p/api/query.php from the shareRss gate to the shareOpml gate, so feed URLs are only
served when the owner opted into OPML sharing.
Note: moved json alongside greader too, since both emit feedUrl (same toGReader path).
* sharedUrlGreader: gate on shareOpml
* Move greader share link under Share by OPML group
* Redirect away from wrong URL paths to fix displaying of relative URLs
* Also strip path info for API pages
* Error for API
---------
Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>
I already changed some places that were using normal string comparison to hash_equals before, but didn't check other places.
Now the checks should be consistent.
The internal search was shown in the UI as the user search.
This was due to the lazy nature of the Generator. Improve the try/catch behaviour at the same time.
How to test:
* Make a user query with a search parameter
* Share the user query as HTML
* Observe the search field (should be empty with this PR, while it contained the internal search before)
1. `include`, `include_once`, `require` and `require_once` are expressions not functions, parentheses are not necessary.
2. to move up the directory tree, it's better to use the `dirname` function instead of relying on `/..`.
* Closes and fixes error from #7885
* `no-cache.txt` is now respected in `f.php`, `ext.php` and `serve` action in `extensionController`
* And in all other places that weren't checking for `no-cache.txt` (some extensions maybe)
* Puts CSP everywhere in `p/api`
* including the HTML query page ❗
* Also in `p/ext.php`
* Puts `X-Content-Type-Options: nosniff` everywhere
* Fixes custom icon configuration not showing `blob:` icon in statsController (idle feeds)
* Also removes `style-src 'unsafe-inline'` since it doesn't seem to be needed
* Improves CSP of `p/f.php`
* Add `sandbox` directive
* PHPStan 2.0
fix https://github.com/FreshRSS/FreshRSS/issues/6989https://github.com/phpstan/phpstan/releases/tag/2.0.0https://github.com/phpstan/phpstan/blob/2.0.x/UPGRADING.md
* More
* More
* Done
* fix i18n CLI
* Restore a PHPStan Next test
For work towards PHPStan Level 10
* 4 more on Level 10
* fix getTagsForEntry
* API at Level 10
* More Level 10
* Finish Minz at Level 10
* Finish CLI at Level 10
* Finish Controllers at Level 10
* More Level 10
* More
* Pass bleedingEdge
* Clean PHPStan options and add TODOs
* Level 10 for main config
* More
* Consitency array vs. list
* Sanitize themes get_infos
* Simplify TagDAO->getTagsForEntries()
* Finish reportAnyTypeWideningInVarTag
* Prepare checkBenevolentUnionTypes and checkImplicitMixed
* Fixes
* Refix
* Another fix
* Casing of __METHOD__ constant
* Add default API CORS HTTP Headers
To allow interacting with our APIs from a JavaScript application.
So far limited to the APIs: Greader, User queries
Fix https://github.com/FreshRSS/FreshRSS/discussions/6654#discussioncomment-10131144
* Early abort for OPTIONS requests
* Move a bit OPTIONS test
* No content!
* More cleaning
* add description to user queries and rss feed
* add image url to user queries and rss feed
* Fix i18n
* remove itunes image tag and xml definition
---------
Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>
* New feature: shareable user query
Share the output of a user query by RSS / HTML / OPML with other people through unique URLs.
Replaces the global admin token, which was the only option (but unsafe) to share RSS outputs with other people.
Also add a new HTML output for people without an RSS reader.
fix https://github.com/FreshRSS/FreshRSS/issues/3066#issuecomment-648977890
fix https://github.com/FreshRSS/FreshRSS/issues/3178#issuecomment-769435504
* Remove unused method
* Fix token saving
* Implement HTML view
* Update i18n for master token
* Revert i18n get_favorite
* Fix missing i18n for user queries from before this PR
* Remove irrelevant tests
* Add link to RSS version
* Fix getGet
* Fix getState
* Fix getSearch
* Alternative getSearch
* Default getOrder
* Explicit default state
* Fix test
* Add OPML sharing
* Remove many redundant SQL queries from original implementation of user queries
* Fix article tags
* Use default user settings
* Prepare public search
* Fixes
* Allow user search on article tags
* Implement user search
* Revert filter bug
* Revert wrong SQL left outer join change
* Implement checkboxes
* Safe check of OPML
* Fix label
* Remove RSS button to favour new sharing method
That sharing button was using a global admin token
* First version of HTTP 304
* Disallow some recusrivity
fix https://github.com/FreshRSS/FreshRSS/issues/6086
* Draft of nav
* Minor httpConditional
* Add support for offset for pagination
* Fix offset pagination
* Fix explicit order ASC
* Add documentation
* Help links i18n
* Note about deprecated master token
* Typo
* Doc about format
Mehmet