Commit Graph

37 Commits

Author SHA1 Message Date
Alexis Degrugillier
caeb660f29 Add a way to disable/enable users (#3056)
If you want to block users without deleting their account, you can now
disable them from the interface.
2020-06-14 19:50:09 +02:00
Alexis Degrugillier
36bda2e715 Add language detection when the user is not logged in (#3022)
Before, when the user was not logged in, pages where translated with the '_' user language.
Now, they are translated with the user preferred language if there is one supported by FreshRSS or with the system default language.
2020-06-05 10:10:46 +02:00
Alexandre Alapetite
a49db010e4 A wrong login must return HTTP 403 (#2903)
* A wrong login must produce HTTP 403

#fix https://github.com/FreshRSS/FreshRSS/issues/2901
https://github.com/FreshRSS/FreshRSS/pull/2794/files#r389319248

* Just for consistency
2020-04-17 10:56:06 +02:00
Marien Fressinaud
51edbc1578 Improve login and registration pages (#2794)
* Keep the user on login page on failure

* Show an error if username already exists

* Check the password format in the backend

* Return a better message if username is invalid

* Add a title to the login page

* wip: Improve look of login and register pages

* Set a capital M in username help message

On the registration page, username tip started with a minuscule, while
the password tip started with a capital.

* Change message if username is taken
2020-03-08 00:14:29 +01:00
Marien Fressinaud
410c4af6bb Redirect connected users accessing registration page (#2530) 2019-09-18 17:25:31 +02:00
Marien Fressinaud
a2ed6626c2 Add support for terms of service
This feature is optional. It is based on the presence of a
`data/tos.html` file that an administrator can create. If this file
exists, FreshRSS will automatically add a "ToS" checkbox on the
registration page that users must check to be able to create their
account.
2019-09-17 09:21:23 +02:00
Marien Fressinaud
75632e70f0 Provide email address verification feature (#2481)
* Add an email field to the profile page

I reuse the `mail_login` from the configuration. I'm not sure if it's
useful today (I would say it was used when Persona login was available).

A good improvement would be to rename `mail_login` into `email` so it
would be more intuitive to use.

* Add boolean to the conf to force email validation

This commit only adds a configuration item.

* Add email during registration if email must be validated

* Set email token to validate when email changes

* Block access to FreshRSS if email is not validated

* Send email when address is changed

* Allow to resend the validation email

* Allow the user to change its email while blocked

* Document the email validation feature

* fixup! Allow the user to change its email while blocked

* tec: Autoload PHPMailer lib

* Validate email address format

* Add feedback on validation email resend action

* Allow to logout when user is blocked

* fix: Change default email "from"

* Reorganize i18n keys

* Complete all the locales with default english

* Hide sidebar (profile page) if email is not validated

* Check email requirements on registration

* Allow admin to specify email when creating users

* Don't check email format if value is empty

* Remove trailing comma in userController

Co-Authored-By: Alexandre Alapetite <alexandre@alapetite.fr>

* Set PHPMailer validator to html5 before sending email

* fixup! Remove trailing comma in userController
2019-08-29 12:02:05 +02:00
Alexandre Alapetite
fd33d92d41 Require PHP 5.5+ (#2495)
* Require PHP 5.5+

https://github.com/FreshRSS/FreshRSS/issues/2469#issuecomment-522255093
I think it would be reasonable to require PHP 5.5+ for the core of
FreshRSS after all.

As Frenzie said, WordPress currently requires PHP 5.6.20+, and it is the
most popular PHP application.

We would loose about 20% of the PHP servers according to
https://w3techs.com/technologies/details/pl-php/5/all but I expect this
number to drop fast after the release of CentOS 8 (CentOS accounts for
17% of Linux servers
https://w3techs.com/technologies/details/os-linux/all/all ).

Distributions:
* no impact on Ubuntu, Fedora, Alpine, OpenWRT, FreeBSD, OpenSuze,
Mageia, as all active versions have PHP > 7
* no impact on OpenSuze, Synology, as all active versions have PHP > 5.5
* we drop Debian 8 Jessie (-2020) - we keep supporting Debian 9 Stretch
(2017-06) - current is Debian 10 Buster
* we drop Red Hat 7 (-2024) - we keep supporting RHEL 8 (2019-05)
* we drop CentOS 7 (-2024) - we will support CentOS 8 (to be released
soonish)

When dropping older versions, I can better like when it is for a good
reason, and there is actually one with PHP 5.5, namely generators
(yield) https://php.net/language.generators.overview which I consider
using.

* Version note for JSON.php

* hex2bin

* Update .travis.yml

Co-Authored-By: Frans de Jonge <fransdejonge@gmail.com>
2019-08-20 14:55:43 +02:00
Alexandre Alapetite
ebd8c31c02 Rework CSRF interaction with sessions (#2290)
* Rework CSRF interaction with sessions

Fix https://github.com/FreshRSS/FreshRSS/issues/2288
Improve security in some edge cases
Maybe relevant for
https://github.com/FreshRSS/FreshRSS/issues/2125#issuecomment-474992671

* Forgotten mime type
2019-03-22 19:05:38 +01:00
Alexandre Alapetite
2374374ba9 Less jQuery (#2234)
* Less jQuery

Follow-up of https://github.com/FreshRSS/FreshRSS/pull/2199

* Even less jQuery + global view unread title fix

* Even less jQuery

* Yet even less jQuery

* Even less jQuery

* Reduce some events

* Even less jQuery

* jQuery gone from main view

+Fixed English i18n

* Fix feed folded view

* Remove Firefox 64 workaround

Remove workaround for Gecko bug 1514498 in Firefox 64, fixed in Firefox
65

* Split to extra.js

Avoid loading unneeded JavaScript code for the main view.
+ several adjustements

* Improve CSS transition fold category

* Rewrite shortcuts

Remove library. Much faster, shorter, one listener instead of many.
Control of the shortcut context.
Fix https://github.com/FreshRSS/FreshRSS/issues/2215

* Remove debug

* Minor syntax

* Filter out unwanted shortcut modifiers

* Menu overflow fix

* Typo

* Fix unfolding in mobile view

* Remove jQuery from category.js

* Remove jQuery from Global view
2019-02-13 15:06:28 +01:00
Alexandre Alapetite
945cf832ad HTTP authenfication fixes (#2204)
* Security fixes when HTTP user does not exist in FreshRSS
* Accept HTTP header X-WebAuth-User for delegated HTTP Authentication (e.g. Træfik)
* Document delegated HTTP authentication from https://github.com/FreshRSS/FreshRSS/pull/2202
2019-01-02 21:43:05 +01:00
Alexandre Alapetite
0ce43be9de Multi-user token
https://github.com/FreshRSS/FreshRSS/issues/1390
https://github.com/FreshRSS/FreshRSS/issues/366
2017-04-09 00:25:04 +02:00
Alexandre Alapetite
332a4dec86 Option for cookie duration
https://github.com/FreshRSS/FreshRSS/issues/1384
2016-12-24 16:33:28 +01:00
Alexandre Alapetite
c1548e732d Remove Mozilla Persona login
https://github.com/FreshRSS/FreshRSS/issues/1052
2016-07-31 14:58:19 +02:00
Alexandre Alapetite
ad1f0cb96b Return after 403
https://github.com/FreshRSS/FreshRSS/pull/1016
https://github.com/FreshRSS/FreshRSS/issues/1015
2015-10-25 19:31:41 +01:00
Alexandre Alapetite
7bb28c3f2b HTTP 403 for invalid login
https://github.com/FreshRSS/FreshRSS/issues/1015
And does not leak if user exists or not
2015-10-25 13:24:48 +01:00
Marien Fressinaud
f0a1b26584 Add title to the account creation page
See https://github.com/FreshRSS/FreshRSS/issues/679
2015-07-22 23:06:46 +02:00
Marien Fressinaud
f560c44a00 Hide registration form if max registration reached
See https://github.com/FreshRSS/FreshRSS/issues/679
2015-07-22 14:00:08 +02:00
Marien Fressinaud
37f0679958 First draft for registration form
See https://github.com/FreshRSS/FreshRSS/issues/679
2015-07-21 16:03:46 +02:00
Alexandre Alapetite
079150eee4 Updated log visibility
In particular, ensure that ERROR is only used for errors that may affect
FreshRSS integrity, and ensure that feed errors are visible also in
production, i.e. visibility of WARNING
https://github.com/FreshRSS/FreshRSS/issues/885
https://github.com/FreshRSS/FreshRSS/issues/884
2015-07-03 23:47:18 +02:00
Marien Fressinaud
ce9298439b Fix a call to $system_conf
See https://github.com/FreshRSS/FreshRSS/issues/730
2015-01-06 22:15:51 +01:00
Marien Fressinaud
eff804572f Fix setters on $user_conf
Old setters does not exist anymore, remove them.

See https://github.com/FreshRSS/FreshRSS/issues/730
2015-01-06 21:54:46 +01:00
Marien Fressinaud
dd41642ce6 Fix calls to FreshRSS_Configuration
Replaced by a get_user_configuration() function in lib_rss.
This function register a new configuration based on the given username
and return the corresponding configuration.

See https://github.com/FreshRSS/FreshRSS/issues/730
2015-01-06 21:40:19 +01:00
Marien Fressinaud
5f9672111f Fix last calls to Minz_Configuration methods
- We have still to fix actualize_script and greader api (refactoring?)
- We have to fix the FreshRSS_Configuration calls
- We have to fix availableLanguages calls

See https://github.com/FreshRSS/FreshRSS/issues/730
2015-01-06 20:50:58 +01:00
Marien Fressinaud
d3a93ea290 BREAKING FEATURE: Remove general in config
General attribute has been removed from system config.
Now subattributes (e.g. environment, salt, title, etc.) are directly accessible.

YOU HAVE TO FIX YOUR ./data/config.php file!

- Remove the general array
- Values inside this array must be kept
- To see what it must look like, please have a look to ./data/config.default.php
  (but keep your values!!).

See https://github.com/FreshRSS/FreshRSS/issues/730
2015-01-06 18:53:36 +01:00
Marien Fressinaud
7cca47d1ab Change name of user configuration var in Context
- FreshRSS_Context::$conf is replaced by FreshRSS_Context::$user_conf
- Introduce FreshRSS_Context::$system_conf
- Remove FreshRSS_Configuration object

See https://github.com/FreshRSS/FreshRSS/issues/730
2015-01-05 22:45:03 +01:00
Marien Fressinaud
51a71ec4b9 New configuration system (not working yet)
- Use only Minz_Configuration
- register() method to load a new configuration file
- get() to get a configuration
- new exceptions related to configuration
- fix a list configuration calls to have FRSS working

Current problems to resolve:

- How to handle configuration param verifications (i.e. check auth_type
  is a value from none, http_auth, persona or form)
- We must use $conf = Minz_Configuration::get('system'); $general_conf = $conf->general;
  to access global system configuration which is quite annoying. How to change that?

See https://github.com/FreshRSS/FreshRSS/issues/730
2015-01-05 16:54:16 +01:00
Marien Fressinaud
fee1ae997a Fix i18n for conf, entry, error, feed Controllers 2014-12-11 19:02:05 +01:00
Marien Fressinaud
c1a3412b97 Fix i18n for auth and category controllers 2014-12-11 18:15:41 +01:00
Marien Fressinaud
58deab37cd Fix Minz_Error::error() -> use default values 2014-10-30 19:57:08 +01:00
Marien Fressinaud
4dec7bf127 Fix i18n string
Order has been changed due to a little bug in sort order function.
2014-10-26 12:37:38 +01:00
Marien Fressinaud
5d6407a0bf Update i18n
- Fix i18n strings
- Fix typo profil -> profile

See https://github.com/marienfressinaud/FreshRSS/issues/678
2014-10-26 12:22:13 +01:00
Marien Fressinaud
1a22a87fb1 Use FreshRSS_Context::$conf only
- Replace $this->view->conf in controllers
- Replace $this->conf in views
2014-10-20 18:45:22 +02:00
Marien Fressinaud
df4ddf0e55 Unsafe autologin comes back
Should be moved in an extension later!

See https://github.com/marienfressinaud/FreshRSS/issues/655
2014-10-20 13:31:49 +02:00
Marien Fressinaud
c5fe3bd659 Reorganize user pages
Three pages:

- User profil
- User management
- Authentication
2014-10-17 16:24:21 +02:00
Marien Fressinaud
dbf57266b2 Reset auth system comes back!
It has moved to authController.
2014-10-07 16:58:11 +02:00
Marien Fressinaud
1252b3dd86 Authentication system moved + Persona comes back!
AuthController is dedicated to auhentication.
Persona is back, greater than ever!

See https://github.com/marienfressinaud/FreshRSS/issues/655
2014-10-07 16:37:10 +02:00