Commit Graph

11 Commits

Author SHA1 Message Date
Alexandre Alapetite
56ffc115d1 Do not mix POST and GET params
Avoid returning CSRF POST token for a GET
2016-08-13 19:10:32 +02:00
Alexandre Alapetite
e6fd34bdda CSRF token, update HTTP Referrer policy to same-origin
https://www.w3.org/TR/referrer-policy/#referrer-policy-no-referrer
https://github.com/FreshRSS/FreshRSS/issues/570
https://github.com/FreshRSS/FreshRSS/issues/955
https://github.com/FreshRSS/FreshRSS/issues/1198
https://github.com/FreshRSS/FreshRSS/issues/565
https://github.com/FreshRSS/FreshRSS/issues/554
2016-08-13 17:49:31 +02:00
Alexandre Alapetite
c1548e732d Remove Mozilla Persona login
https://github.com/FreshRSS/FreshRSS/issues/1052
2016-07-31 14:58:19 +02:00
Marien Fressinaud
8e6ab12e89 Fix a bug in FreshRSS_Auth::giveAccess()
See https://github.com/FreshRSS/FreshRSS/issues/730
2015-01-06 22:43:24 +01:00
Marien Fressinaud
5f9672111f Fix last calls to Minz_Configuration methods
- We have still to fix actualize_script and greader api (refactoring?)
- We have to fix the FreshRSS_Configuration calls
- We have to fix availableLanguages calls

See https://github.com/FreshRSS/FreshRSS/issues/730
2015-01-06 20:50:58 +01:00
Marien Fressinaud
d3a93ea290 BREAKING FEATURE: Remove general in config
General attribute has been removed from system config.
Now subattributes (e.g. environment, salt, title, etc.) are directly accessible.

YOU HAVE TO FIX YOUR ./data/config.php file!

- Remove the general array
- Values inside this array must be kept
- To see what it must look like, please have a look to ./data/config.default.php
  (but keep your values!!).

See https://github.com/FreshRSS/FreshRSS/issues/730
2015-01-06 18:53:36 +01:00
Marien Fressinaud
51a71ec4b9 New configuration system (not working yet)
- Use only Minz_Configuration
- register() method to load a new configuration file
- get() to get a configuration
- new exceptions related to configuration
- fix a list configuration calls to have FRSS working

Current problems to resolve:

- How to handle configuration param verifications (i.e. check auth_type
  is a value from none, http_auth, persona or form)
- We must use $conf = Minz_Configuration::get('system'); $general_conf = $conf->general;
  to access global system configuration which is quite annoying. How to change that?

See https://github.com/FreshRSS/FreshRSS/issues/730
2015-01-05 16:54:16 +01:00
Alexandre Alapetite
9f97f7df88 Ne pas rafraîchir les flux des utilisateurs non logués depuis x jours
https://github.com/marienfressinaud/FreshRSS/issues/681
Warning: needs some testing
2014-10-29 00:45:42 +01:00
Marien Fressinaud
1252b3dd86 Authentication system moved + Persona comes back!
AuthController is dedicated to auhentication.
Persona is back, greater than ever!

See https://github.com/marienfressinaud/FreshRSS/issues/655
2014-10-07 16:37:10 +02:00
Marien Fressinaud
6009990935 Introduce FreshRSS_Auth::hasAccess('admin')
Replace Minz_Configuration::isAdmin($user). FreshRSS_Auth::hasAccess() could
be extended to others scopes later.

See https://github.com/marienfressinaud/FreshRSS/issues/655
2014-10-07 10:16:38 +02:00
Marien Fressinaud
79aa5beaf4 Refactor authentication system.
Big work, not finished. A lot of features have been removed.

See https://github.com/marienfressinaud/FreshRSS/issues/655
2014-10-06 23:29:20 +02:00