Commit Graph

3189 Commits

Author SHA1 Message Date
Inverle
6549932d59 Disallow setting non-existent theme (#7722)
Related: https://github.com/FreshRSS/xExtension-Demo/pull/2, https://github.com/FreshRSS/FreshRSS/pull/7559#issuecomment-2858083635

Mostly to make sure that no one is able to break the demo instance
But the issues below could possibly be exploited in other scenarios too:
* Setting a theme like `../../lib/core-extensions/UserJS`: this directory contains `metadata.json` like themes do, so FreshRSS treats it as a theme after setting it and doesn't load any CSS
* Setting a theme like `x dropdown-menu`: the `dropdown-menu` class was able to get injected into the `<body>` element since https://github.com/FreshRSS/FreshRSS/pull/7559 and turn every page blank
2025-07-07 23:32:35 +02:00
Inverle
7915abd833 Implement custom feed favicons (#7646)
Closes #3789, #6503

Icon setting when no custom icon is set yet:

![image](https://github.com/user-attachments/assets/28b07dd0-7dac-4c76-b1d7-77035f91a87a)

- `Change...` button opens a file dialog, and after selecting a file shows the chosen icon in the preview on the left. `Submit` must be clicked after selecting the icon.
- `Reset to default` changes the preview icon to the default one, and also requires `Submit` to be clicked to apply the changes.

Full list of changes:
- CSP now includes `blob:` in `img-src` for
   - `indexAction()` and `feedAction()` in `subscriptionController.php`
   - all of the view actions in `indexController.php`
- Introduce new attribute `customFavicon (boolean)` for feeds that indicates if the feed has a custom favicon
   - `hashFavicon()` in `Feed.php` is dependent on this attribute
      - `hashFavicon()` has a new parameter called `skipCache (boolean)` that allows the reset of the favicon hash for the Feed object
      - `resetFaviconHash()` just calls `hashFavicon(skipCache: true)`
- `f.php` URLs now have the format of `/f.php?h=XXXXX&t=cachebuster`, where the `t` parameter is only used for serving custom favicons
   - if `t` parameter is set, `f.php` returns a `Cache-Control: immutable` header
- `stripos` and `strpos` were changed to `str_contains` in various places (refactor)
- JS for handling the custom favicon configuration logic is in `extra.js` inside `init_update_feed()` which is called when feed configuration is opened from the aside or when the subscription management page with the feed is loaded
   - Server-side code for uploading the icon in `subscriptionController.php` under `feedAction()`
   - Errors that may occur during the setting of a custom favicon:
      - Unsupported image file type (handled only server-side with `isImgMime()`)
      - When the file is bigger than 1 MiB (default), handled both client-side and server-side
      - Standard feed error when `updateFeed()` fails
- JS vars `javascript_vars.phtml` are no longer escaped with `htmlspecialchars()`, instead with json encoding,
- CSS for disabled buttons was added
- Max favicon file size is configurable with the `max_favicon_upload_size` option in `config.php` (not exposed via UI)
- Custom favicons are currently deleted only when they are either reset to the default icon, or the feed gets deleted. They do not get deleted when the user deletes their account without removing their feeds first.
- ` faviconPrepare()` and `faviconRebuild()` are not allowed to be called when the `customFavicon` attribute is `true`
- New i18n strings:
   - `'sub.feed.icon' => 'Icon'`
   - `'sub.feed.change_favicon' => 'Change…'`
   - `'sub.feed.reset_favicon' => 'Reset to default'`
   - `'sub.feed.favicon_changed_by_ext' => 'The icon has been set by the <b>%s</b> extension.'`
   - `'feedback.sub.feed.favicon.too_large' => 'Uploaded icon is too large. The maximum file size is <em>%s</em>.'`
   - `'feedback.sub.feed.favicon.unsupported_format' => 'Unsupported image file format!'`
- Extension hook `custom_favicon_hash`
   - `setCustomFavicon()` method
   - `resetCustomFavicon()` method
   - `customFaviconExt` and `customFaviconDisallowDel` attributes
   - example of usage: https://github.com/FreshRSS/Extensions/pull/337
- Extension hook `custom_favicon_btn_url`
   - Allows extensions to implement a button for setting a custom favicon for individual feeds by providing an URL. The URL will be sent a POST request with the `extAction` field set to either `query_icon_info` or `update_icon`, along with an `id` field which describes the feed's ID.
2025-06-30 12:01:56 +02:00
Alexandre Alapetite
c8bbf35534 Add search operator c: for categories (#7696)
* Add search operator `c:` for categories
fix https://github.com/FreshRSS/FreshRSS/discussions/7692
Allow searching for e.g. `c:23,34`
2025-06-29 11:09:08 +02:00
Stefan
6bec627f79 Update feedController.php (#7688)
+ Fix for 404 error when trying to refresh the feeds from a view extension. Without this change, this happens:
1. Starting on the extension view: https://freshrss.example.net/i/?c=freshvibes&tab=test&rid=6858299a5c2f0
2. Clicking refresh redirects to https://freshrss.example.net/i/?c=feed&a=actualize with status 302
3. Then to https://freshrss.example.net/i/?get=f_0&rid=685872529cbe9 with status 302
4. Finally, to https://freshrss.example.net/i/?c=error&rid=685872529cbe9 with 404.
2025-06-24 09:22:08 +02:00
Stefan
51298cd6bc Exposed the reading modes for extensions through Minz (#7668)
* + Exposed the reading modes for extensions through Minz. Now extensions can add a custom view mode. Graceful fallback to normal view in case the extension was disabled without resetting the view_mode through the uninstall method. In that case the user will be informed via Minz_Request::setBadNotification that the view has been reset to normal.
+ Added translation strings for de, en and en-us for the notification

* + Added missing, generated translations

* Simplify indexAction, performance

* Minor settings htmlspecialchars

* i18n: fr

* Minor wording

* Doc

* Fix i18n

---------

Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>
2025-06-22 00:36:32 +02:00
Inverle
bea9ca12ad Restore user config from backup when it doesn't exist (#7682)
* Restore user config from backup when it doesn't exist

* Supress warnings

* Remove copied config if copy() fails

* `return false` after `unlink()`

* Performance

---------

Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>
2025-06-22 00:10:13 +02:00
the7thNightmare
50887f191b i18n:ID (#7683)
* id translation

* id translation

* Avoid problematic array sentence

---------

Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>
2025-06-22 00:09:52 +02:00
Inverle
18b5c8ec6d Handle redirects when scraping feed from HTML (#7654)
* Handle redirects when scraping feed from HTML

* pass codesniffer

* pass PHPStan

* Optimize

* Another approach relying on HTML base
Standard way to save an HTML document with relative references

* Fix case of existing HTML base
which should not be overriden

---------

Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>
2025-06-22 00:09:18 +02:00
Inverle
a6948218fb frame-ancestors CSP (#7677) 2025-06-18 22:20:17 +02:00
Alexandre Alapetite
67c42b0e7c Remove several PHPStan ignore (#7665)
* Remove several PHPStan ignore
* One syntax error
* PDO returns int, not bool (MySQL and SQLite Boolean types are aliases for tinyint).
* A few missing type hints

* Revert strange PHPStan bug
2025-06-15 01:17:20 +02:00
Alexandre Alapetite
f620f16e2b Install: add test PDO typing (#7651)
fix https://github.com/FreshRSS/FreshRSS/issues/7647
2025-06-06 09:56:27 +02:00
Alexandre Alapetite
4de7d0b813 PHPStan: pass checkImplicitMixed (#7642)
* PHPStan: pass checkImplicitMixed

* Complete
2025-06-04 14:00:33 +02:00
the7thNightmare
88de42085f i18n:ID (#7622)
* id translation

* small fix
2025-05-27 21:47:48 +02:00
Alexandre Alapetite
62592da283 Fix remove last share (#7613)
fix https://github.com/FreshRSS/FreshRSS/issues/7612
2025-05-25 13:05:23 +02:00
Alexandre Alapetite
648eddaf13 Fix important articles on reader view (#7602)
fix https://github.com/FreshRSS/FreshRSS/issues/7601
2025-05-20 07:07:00 +02:00
Alexandre Alapetite
9fbde0605b Keep sort and order during navigation (#7585)
* Keep sort and order during navigation
fix https://github.com/FreshRSS/FreshRSS/issues/7584

* Sanitize

* Minor format

* Avoid uneeded HTML escaping
2025-05-17 22:52:30 +02:00
Alexandre Alapetite
52848d414d Add info about PDO::ATTR_CLIENT_VERSION (#7591)
Help with https://github.com/FreshRSS/FreshRSS/issues/7586
2025-05-17 22:51:44 +02:00
Alexandre Alapetite
459ede2b7e Fix SQL request for user labels with custom sort (#7588)
The list or articles with a user label with a custom sort was broken when using PostgreSQL

Example: `https://freshrss.example.net/i/?a=normal&get=T&sort=title&order=ASC`

```
SQL error FreshRSS_EntryDAO::listWhereRaw["42P10",7,"ERROR: for SELECT DISTINCT, ORDER BY expressions must appear in select list\nLINE 3: ...d_entry = e.id WHERE 1=1 AND e.id <= $1 ORDER BY e.title DE...\n ^"]
```
2025-05-13 22:28:34 +02:00
Inverle
b401f152ca i18n: pl (#7587) 2025-05-13 20:47:40 +02:00
Alexandre Alapetite
532d229d33 Fix newest articles not shown (#7577)
* Fix newest articles not shown
Case when processing was faster than 1 second.
fix https://github.com/FreshRSS/FreshRSS/issues/7412
Regression from https://github.com/FreshRSS/FreshRSS/pull/7149

* Simplify uTimeString()
PHPStan has become a bit smarter
2025-05-10 23:17:25 +02:00
Inverle
84d4aeb9e6 Implement loading spinner for marking as favorite/read, read/unread (#7564)
* Implement loading spinner for marking as favorite

* Ensure that the correct previous icon gets set

* Remove delay

* Improve compatibility with various parsers

Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>

* Support multiple icons (top, bottom)

* Remove preload for now

* Fix CSS, remove !important

* Implement read/unread and alt

* Ensure correct bookmark icon gets set after error

---------

Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>
2025-05-10 21:06:58 +02:00
Inverle
4968ff7ccc Provide theme class for CSS (#7559)
* Provide theme class for CSS

* Replace more common characters with -

* Fix test error

* Make requested changes

* Make more requested changes

* Use htmlspecialchars_decode instead

* Replace whitespace

* One more whitespace character

* Simplify and move class to <html>

---------

Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>
2025-05-07 20:43:28 +02:00
Alexandre Alapetite
25f57beb90 Fix encoding of themes (#7565)
* Fix encoding of themes
Several HTML and URL encoding issues in the case of special chars in theme directory or in metadata.
Also usefull to simplify https://github.com/FreshRSS/FreshRSS/pull/7559

* Minor simplification

* Stricter decoding
2025-05-07 19:55:28 +02:00
Alexandre Alapetite
b2f80ad00a Fix duplicate HTTP header for POST (#7556)
Using POST with JSON would add `Content-Type: application/json` again and again everytime the feed's settings were saved
2025-05-05 18:55:43 +02:00
FabioL
f562b4ebff Updated italian translations (#7540)
Co-authored-by: loviuz <loviuz@mailbox.org>
2025-05-01 16:42:56 +02:00
dependabot[bot]
0cd23cca7c Bump phpstan/phpstan from 2.1.11 to 2.1.13 (#7534)
* Bump phpstan/phpstan from 2.1.11 to 2.1.13

Bumps [phpstan/phpstan](https://github.com/phpstan/phpstan) from 2.1.11 to 2.1.13.
- [Release notes](https://github.com/phpstan/phpstan/releases)
- [Changelog](https://github.com/phpstan/phpstan/blob/2.1.x/CHANGELOG.md)
- [Commits](https://github.com/phpstan/phpstan/compare/2.1.11...2.1.13)

---
updated-dependencies:
- dependency-name: phpstan/phpstan
  dependency-version: 2.1.13
  dependency-type: direct:development
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>

* Bump phpstan/phpstan from 2.1.11 to 2.1.13

Bumps [phpstan/phpstan](https://github.com/phpstan/phpstan) from 2.1.11 to 2.1.13.
- [Release notes](https://github.com/phpstan/phpstan/releases)
- [Changelog](https://github.com/phpstan/phpstan/blob/2.1.x/CHANGELOG.md)
- [Commits](https://github.com/phpstan/phpstan/compare/2.1.11...2.1.13)

---
updated-dependencies:
- dependency-name: phpstan/phpstan
  dependency-version: 2.1.13
  dependency-type: direct:development
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>

* Fix PHPStan

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>
2025-05-01 11:50:12 +02:00
Alexandre Alapetite
3776e1e48f Improve favicon hash (#7505)
* Favicon hash proxy
Content provided through a proxy may be completely different, so the feed hash must account for that

* Fix typing

* Hash of Web site in priority for favicons

* Continue

* Revert some minor changes
2025-04-26 14:19:54 +02:00
Inverle
4dbd98b1d5 Update Polish translation (#7508)
* Update Polish translation

* corrections

* make fix-all

---------

Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>
2025-04-13 23:45:30 +02:00
Alexandre Alapetite
0c33d27139 Secure serving of user files from extensions (#7495)
* Secure serving of user files from extensions
fix https://github.com/FreshRSS/FreshRSS/issues/4930

* More fixes

* Typo
2025-04-07 08:47:42 +02:00
Alexandre Alapetite
d3d9acca9f Web scraping forbid security headers in cURL (#7496)
Prevent using `Remote-User`, `X-WebAuth-User` during Web scraping.
2025-04-07 08:33:13 +02:00
Alexandre Alapetite
d858053a7c Use HTTP POST for logout (#7489)
* Use HTTP POST for logout
To avoid potential CSRF risks

* Fixed button font issue

* Minor whitespace
2025-04-05 23:15:37 +02:00
Alexandre Alapetite
78dfb44060 Pass phpstan-strict-rules 2.0.4 (#7488)
New check for Boolean in while conditions
Replace https://github.com/FreshRSS/FreshRSS/pull/7481
2025-04-02 00:46:28 +02:00
Alexandre Alapetite
3336631a84 Catch extension exceptions in override (#7475)
* Catch extension exceptions in override
https://github.com/FreshRSS/Extensions/pull/300#issuecomment-2768578464

* Fix error message
2025-04-01 17:55:20 +02:00
Alexandre Alapetite
dbdadbb410 Make update URL readonly (#7477)
The security risks look higher than the minor convinience
Modify https://github.com/FreshRSS/FreshRSS/pull/1024
2025-04-01 17:54:52 +02:00
maTh
1f624bc5e2 Referrer-Policy: same-origin (#6303)
* Referrer-Policy: same-origin

* same-origin for our own images

---------

Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>
2025-04-01 12:23:56 +02:00
𝗛𝗼𝗹𝗶
4c6bd24eec Improve Turkish Language (#7442)
* Improve Turkish Language

* fix

* Update gen.php

* Update app/i18n/tr/gen.php

Co-authored-by: Frans de Jonge <fransdejonge@gmail.com>

* Update sub.php

* edit

* edit

* make fix-all

* Mark lines as ignored

* Typo

* Update sub.php

---------

Co-authored-by: Frans de Jonge <fransdejonge@gmail.com>
Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>
2025-04-01 11:30:09 +02:00
Alexandre Alapetite
d81dbc44b8 Fix escaping of tag search (#7468)
* Fix escaping of tag search
fix https://github.com/FreshRSS/FreshRSS/issues/7466

* Minor clarity
2025-04-01 09:39:16 +02:00
Alexandre Alapetite
d0b9611319 Update bcrypt.js from 2.4.4 to 3.0.2 (#7449)
https://github.com/dcodeIO/bcrypt.js/releases/tag/v3.0.0
Can be updated to the latest version with:
`curl -L https://unpkg.com/bcryptjs/umd/index.js > p/scripts/vendor/bcrypt.js`
2025-03-25 10:19:51 +01:00
Alexandre Alapetite
9114b9a06a Support multiple JSON fragments in HTML+XPath+JSON mode (#7369)
* Support multiple JSON fragments in HTML+XPath+JSON mode
fix https://github.com/FreshRSS/FreshRSS/discussions/7352#discussioncomment-12295475
E.g. HTML with one `<script type="application/ld+json">...</script>` per item.

* Better help messages
2025-03-24 14:08:43 +01:00
Glyn Normington
b0a3ae1e7a Clarify MINZ usage (#7426)
* Clarify MINZ usage

MINZ (archived, read-only) is not a dependency
of FreshRSS, which would be very concerning.

Instead, FreshRSS copied MINZ and has evolved
it since then under the same license.

Ref: https://github.com/FreshRSS/FreshRSS/discussions/7425

* Move credits to README

* Delete credits from web UI

* Additional changes

---------

Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>
2025-03-24 14:04:10 +01:00
Machou
f49e5cc7fe fr update (#7432)
* Update admin.php

* Update conf.php
2025-03-14 23:45:28 +01:00
maTh
7de384bf9c Mark as read button: config for the size (#7314)
* settings

* i18n: mark_read_button

* big, small, none

* fix

* Fixes

* make fix-all

---------

Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>
2025-03-13 23:10:48 +01:00
Alexandre Alapetite
a7361a3e7c Implement JSON string concatenation with & operator (#7414)
Inspired by [JSONata syntax](https://docs.jsonata.org/expressions).
fix https://github.com/FreshRSS/FreshRSS/issues/6565
2025-03-13 22:40:41 +01:00
Bryan Butler
802fc89ca6 Fix issue #7383: Finish Translation issue requiring character escape out. (#7423)
Escape out "klo" ("at") characters found in format_date_hour for Finnish/Suomi
translation. Specifically to resolve issue #7383
2025-03-12 22:35:49 +01:00
Alexandre Alapetite
d80171ebfd Back-compatibility cURL 7.51 (#7409)
* Back-compatibility cURL 7.51
fix https://github.com/FreshRSS/FreshRSS/issues/7381
And add cURL version to system info.
Do not require a specific version of cURL for now, but maybe later.

* Fix CI

* make fix-all

* Add TODOs

* Add ssl_version

* Update app/i18n/it/index.php

Co-authored-by: UserRoot-Luca <55756898+UserRoot-Luca@users.noreply.github.com>

---------

Co-authored-by: UserRoot-Luca <55756898+UserRoot-Luca@users.noreply.github.com>
2025-03-08 11:49:05 +01:00
Jackson Culbreth
fdc564dd9e Added api password indicator text (#7340)
* Added api password indicator text

* make fix-all

* i18n

* i18n: it

Co-authored-by: UserRoot-Luca <55756898+UserRoot-Luca@users.noreply.github.com>

---------

Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>
Co-authored-by: UserRoot-Luca <55756898+UserRoot-Luca@users.noreply.github.com>
2025-03-07 23:34:56 +01:00
Bryan Butler
3ec0bdab38 Fix issue where $keepMax is defaulted to const when non-zero value is compared. (#7416)
Fix issue where $keepMax is defaulted to const when non-zero value is compared.

Fix an issue where $keepMax var is set to ARCHIVING_RETENTION_COUNT_LIMIT
when a user sets "Archiving" -> "Maximum number of articles to keep per
feed" to a non-zero value for a given category.

[EXAMPLE]:
User sets value to 50 (int), This matches the !== comparison and
thus is overridden by ARCHIVING_RETENTION_COUNT_LIMIT.
2025-03-07 23:29:27 +01:00
Rui Melo
ecb7a836ec Add Portuguese from Portugal Language (#7329)
* Good day to deal with people in high places; particularly lonely stewardesses.

* You're currently going through a difficult transition period called "Life."

* You're at the end of the road again.

* Fixes

* Add references to  pt-pt

* Fix order

* Config typos

* Update conf.php

* Fix whitespace

* Update app/i18n/pt-pt/sub.php

---------

Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>
2025-03-06 17:30:16 +01:00
berumuron
40cdeb8687 fix: Update the user's last activity on login action (#7406) 2025-03-05 22:36:41 +01:00
Alexandre Alapetite
ecdb63c335 Fix regression cURL HTTP headers (#7403)
* Fix regression cURL HTTP headers
fix https://github.com/FreshRSS/FreshRSS/issues/6712#issuecomment-2697961491
We would sometimes wrongly override the default HTTP headers of SimplePie
https://github.com/FreshRSS/simplepie/pull/33
https://github.com/simplepie/simplepie/pull/912

* Sync SimplePie
https://github.com/FreshRSS/simplepie/pull/33
2025-03-05 16:45:06 +01:00