Commit Graph

6676 Commits

Author SHA1 Message Date
dependabot[bot]
fe448eaa11 Bump actions/checkout from 4 to 5 (#7895)
Bumps [actions/checkout](https://github.com/actions/checkout) from 4 to 5.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](https://github.com/actions/checkout/compare/v4...v5)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: '5'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-09-02 09:52:45 +02:00
Inverle
335addab5a CSS fixes for Swage (#7608)
- Fixes for Swage
	- Buttons not showing correctly #7465
	- Dropdown placement (some dropdowns couldn't fit in viewport)
	- Icons not appearing in some places due to color i.e. label management and subscription management page
	- Made `.form-group` and button inside search dropdown hover colors slightly darker, for better visibility
	- Nav menu style improvements on mobile
		- Smaller if not on main page
		- Align settings icon on configuration pages to the right
		- Support nav menu for feed statistics page
	- Text alignment in search dropdown
	- Ensure `input, select, textarea` don't overflow the page
	- Login link placement in anonymous view
	- Other fixes for
		- Add via bookmarklet page
		- About page
		- Shared HTML query page
		- Register page
	- Text visibility for debug log
- Provide classes `layout.phtml` within `<html>`:
	- `logged_in` if applicable
	- `controller_$NAME` if applicable
	- `file_$NAME` if applicable
- Some other fixes

---------

Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>
Co-authored-by: maTh <1645099+math-GH@users.noreply.github.com>
2025-09-01 23:45:54 +02:00
Alexis Degrugillier
b2a82b64b5 fix: add validation when creating a new tag (#7890)
A tag name must be unique and can't be used as a category. There were no error message when creating a tag identical to an existing category. Now, this is addressed.

See #7686

Closes #7686

Changes proposed in this pull request:

- add validation on tag creation

How to test the feature manually:

1. create a new category (ex: `HW`)
2. create a new tag with the same name as the new category (ex: `HW`)
3. validate that the appropriate error message is displayed
2025-09-01 23:29:54 +02:00
Alexis Degrugillier
d31f485973 fix: add default values on stat processing (#7891)
Before, there was an error when retrieving stats for a user without feeds. Now, there are default values to display empty stats instead of an exception.

See #7884

Closes #7884

Changes proposed in this pull request:

- add default values when retrieving stat data

How to test the feature manually:

1. create a new user
2. connect as the new user
3. display stats
4. validate that there is no errors
2025-09-01 23:28:17 +02:00
maTh
1b2293a57a Fix/config dropdown menu mobile view (#7893)
Before:
<img width="534" height="394" alt="grafik" src="https://github.com/user-attachments/assets/63cbf645-2380-448f-9e96-11cf454f9a13" />

1: menu is not right hand side aligned
2: rounded corner (Origine theme specific)

After:
<img width="533" height="359" alt="grafik" src="https://github.com/user-attachments/assets/bfb8fd79-3190-4d40-bba1-ef5fadb81f01" />

Menu is aligned on the right hand side
Sharp corner



Changes proposed in this pull request:

- CSS


How to test the feature manually:

1. small screen for mobile view
2. open config menu right top corner

Negative check:
other dropdown menus should not be touched (f.e. User Queries menu, search, article labels menu)
2025-09-01 23:27:17 +02:00
Inverle
e20b0c8c02 Fix displaying of current date in main statistics (#7892)
Before

<img width="1034" height="543" alt="image" src="https://github.com/user-attachments/assets/09408f81-42f1-4613-948b-b2c7e3ff2409" />

After

<img width="1031" height="536" alt="image" src="https://github.com/user-attachments/assets/d4dd3702-c8a5-4f8d-9014-b419a982d9ec" />

The current day is now included within statistics.

The `-1` thing started happening after #7752 but I'm not sure whether the correct solution is to display the current day or just fix it in the JS

For reference here's what the chart used to looked like:

<img width="1027" height="536" alt="image" src="https://github.com/user-attachments/assets/47a27bad-6593-4e84-a04f-e4385f601c6a" />
2025-09-01 23:25:58 +02:00
Inverle
c44bb029c0 Fix log CRLF injection (#7883)
* Fix log CRLF injection

* empty -> space

Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>
2025-08-31 20:05:30 +02:00
Inverle
87879e8392 Improve leave validation (#7830)
* Improve leave validation

* array_key_exists -> isset

Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>
2025-08-31 19:09:02 +02:00
maTh
94d4f942d3 <label> -> <div> (#7882)
Ref #7646

`<label>` needs to have an HTML input within or a `for=""` attribute

Changes proposed in this pull request:

- fixed 2 `<label>` who are not a 'real' label, so a `<div>` is the better choice


How to test the feature manually:

1. open feed configuration
2. click on "Icon" (first lines of config page) or "Export as OPML" (last lines of config page)
3. nothing will happen. Mouse cursor will not change while hovering over the labels.
2025-08-31 19:07:04 +02:00
Inverle
200eafb352 Regenerate session ID on login (#7829)
Follow-up to #7762

* Regenerate session ID on login
* Send only one cookie
* Improvements
* Delete old session file
* Simplify
* Make function consistent with others
2025-08-30 21:40:00 +02:00
maTh
585875cda7 Global view: use generic CSS class to open panel (#7868)
I found this todo and just did it. 😆 

Changes proposed in this pull request:

- use `open-class` instead of `.box a`


How to test the feature manually:

1. go to global view
2. click on a box title link: it will open the whole category in the panel
3. click on a feed name: it will open the feed articles in the panel
4. nothing will be different for the user as before
2025-08-30 21:32:50 +02:00
maTh
c55e2d317f delete sub.title.rename_label (#7881)
Ref #7871 
Ref #5954

Changes proposed in this pull request:

- `sub.title.rename_label ` has been not used anymore since #5954 (Version V1.24.0)
- `sub.title.rename_label ` deleted
2025-08-30 21:31:20 +02:00
maTh
266c1ce85e fix: Mapco/Ansum theme: read all button in mobile view (#7873)
Closes #7644

Before:
<img width="212" height="153" alt="grafik" src="https://github.com/user-attachments/assets/628034cf-421a-43c1-a762-21906d99d5d9" />


After:
<img width="249" height="186" alt="grafik" src="https://github.com/user-attachments/assets/8414aa34-4936-44e1-84e4-52dad70477b6" />


How to test the feature manually:

1. use Ansum/Mapco theme
2. have a small screen to see it in the mobile view
3. see the read all button in the normal view
2025-08-30 21:30:16 +02:00
Alexandre Alapetite
2b02ca59c6 Include port number for HTTP Retry-After (#7875)
fix https://github.com/FreshRSS/FreshRSS/issues/7870 (partially)
2025-08-30 16:28:37 +02:00
Inverle
379a387dde Disallow setting non-existent language (#7878)
The set language is used inside paths and can lead to issues by including PHP files from other locations
2025-08-30 16:26:24 +02:00
Inverle
43248b461d Fix curl response parsing (#7866)
* Fix curl response parsing

* Specify redirect count with `\SimplePie\HTTP\Parser::prepareHeaders()` instead

Simply notify SimplePie of the redirect count before parsing

* Better error check

* Simplify
2025-08-30 15:13:10 +02:00
maTh
5cb49094b8 Label config delete label (#7871)
* h2 -> h3

* delete a label -> delete this label

* i18n: fr

---------

Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>
2025-08-30 00:01:10 +02:00
maTh
4cb82682b4 dark mode scheme + delete useless shadow (#7872) 2025-08-29 23:48:40 +02:00
Alexandre Alapetite
288992d9ad Fix logic for searching labels (#7863)
`L:1 L:2` is supposed to be an implicit `AND`,
while `L:1,2` as well as `L:1 OR L:2` is an `OR` logic
2025-08-27 21:56:10 +02:00
John Marlo Evangelista
70f0d6d24f Fix Docker Traefik .yml and SERVER_DNS (#7858)
* Rename tls.yml to tls.yaml

Rename tls.yaml so it will be align to the entry in docker-compose-proxy.yml:

volumes:
  - ./tls.yaml:/etc/traefik/tls.yaml

To prevent error:
error="error reading configuration file: /etc/traefik/tls.yaml - read /etc/traefik/tls.yaml: is a directory"

* Update example.env

Added option for SERVER_URL

To prevent warning:
WARN[0000] The "SERVER_DNS" variable is not set. Defaulting to a blank string.

* Update example.env

Change SERVER_URL to SERVER_DNS

* Use .yml consistently

---------

Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>
2025-08-27 21:54:41 +02:00
Alexandre Alapetite
6c64e7b07b Docker CMD compatibility (#7861)
Some caller systems do not seem escape the CMD quotes correctly.
fix https://github.com/FreshRSS/FreshRSS/issues/7859#issuecomment-3225691432
fix https://github.com/FreshRSS/FreshRSS/discussions/5611
fix https://github.com/FreshRSS/FreshRSS/discussions/7267
2025-08-27 14:34:24 +02:00
Inverle
1481cf51f7 Fix fetching OPML url with special characters (#7843)
* Decode dynamic OPML url during fetch

* add ENT_QUOTES

* Store as plaintext instead of decoding
2025-08-25 10:37:23 +02:00
Alexandre Alapetite
339dcb1ea3 Start 1.27.1-dev 2025-08-18 18:06:30 +02:00
Alexandre Alapetite
66e2f00223 Release 1.27.0
https://github.com/FreshRSS/FreshRSS/issues?q=is%3Aopen%20milestone%3A1.27.0
1.27.0
2025-08-18 17:46:26 +02:00
Alexandre Alapetite
5a1f86b229 Changelog, credits 2025-08-18 17:18:19 +02:00
triatic
56df7f826a Should be REMOTE_USER not Remote-User (#7828)
For fastcgi, REMOTE_USER is the correct variable.
2025-08-15 12:15:54 +02:00
Alexandre Alapetite
ade9ba8817 Call cleanCache when refreshing feeds (#7827)
Otherwise, it is only called when calling `httpGet()` which can be rare for users not using Web Scraping.
https://github.com/FreshRSS/FreshRSS/discussions/7784#discussioncomment-14109207
2025-08-15 09:37:00 +02:00
Alexandre Alapetite
ddb9e91bf2 Fix some PHP 8.5 deprecations (#7826)
https://github.com/php/php-src/blob/php-8.5.0beta1/NEWS
https://php.net/function.curl-close
> This function has no effect. Prior to PHP 8.0.0, this function was used to close the resource.
2025-08-15 09:36:45 +02:00
Alexandre Alapetite
cc8afa7750 Minor change of signature on_http_response (#7825)
Follow-up of https://github.com/FreshRSS/FreshRSS/pull/7824
2025-08-14 09:40:53 +02:00
Alexandre Alapetite
531b9286d9 Fix regression on_http_response (#7824)
Fix regression (bad merge) from https://github.com/FreshRSS/FreshRSS/pull/7775
* https://github.com/FreshRSS/simplepie/pull/50
2025-08-14 09:35:30 +02:00
Alexandre Alapetite
4ef52d6825 Fix share XML encoding (#7822)
Maybe related to https://github.com/FreshRSS/FreshRSS/issues/7820
2025-08-13 22:53:09 +02:00
Inverle
18536409c0 Fix chart.js support for SeaMonkey (#7816)
SeaMonkey support was broken by #7752 

Reproduce JS file:
```bash
git clone https://github.com/chartjs/Chart.js && \
cd Chart.js && \
git checkout tags/v4.5.0 && \
sed -i 's/es2022/es2021/g' rollup.config.js && \
pnpm install && \
pnpm run build && \
sha256sum dist/chart.umd.min.js
# SHA256 of dist/chart.umd.min.js should be: 311a5a5e0db077a787b782977f359a72f8584f94d800e324dcc6aefe8a006dd7
```
2025-08-11 21:23:50 +02:00
Inverle
7df6c201f2 Put CSP everywhere (#7810)
* Puts CSP everywhere in `p/api`
   * including the HTML query page 
   * Also in `p/ext.php`
* Puts `X-Content-Type-Options: nosniff` everywhere
* Fixes custom icon configuration not showing `blob:` icon in statsController (idle feeds)
   * Also removes `style-src 'unsafe-inline'` since it doesn't seem to be needed
* Improves CSP of `p/f.php`

* Add `sandbox` directive
2025-08-11 19:35:54 +02:00
Inverle
2b1b268fc2 Fix privacy link not being highlighted in configure (#7811) 2025-08-11 00:58:03 +02:00
Alexandre Alapetite
eaf69f591f SimplePie Fix regex backtrack limit in clean_hash() (#7813)
https://github.com/FreshRSS/simplepie/pull/48
and merge upstream https://github.com/FreshRSS/simplepie/pull/49
fix https://github.com/FreshRSS/FreshRSS/issues/7807
We had a risk of hitting `Backtrack limit was exhausted` in case of open XML comment `<!--` not closed and followed by a very long document.
Fixed by:
* Limiting the max length of the comment
* Stopping at an apparent end of CDATA section `]]>` as it is likely an error

It does not matter much if there are rare cases when the regex does not work perfectly, as it is only used for a cache hint.
2025-08-11 00:52:09 +02:00
Inverle
2b85a50ed7 Show warning when unsafe CSP policy is in use (#7804)
* Show warning when unsafe CSP policy is in use

* Fix bare markdown URL

* i18n: fr

* Minor i18n: fr

* Add target="_blank" to i18n strings

---------

Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>
2025-08-09 21:47:39 +02:00
Alexandre Alapetite
1030973d90 Changelog 2025-08-09 19:52:58 +02:00
Alexandre Alapetite
8f0d69efb2 Docker Alpine PHP 8.4 (#7803)
Force our Alpine-based Docker image to PHP 8.4 (default is still PHP 8.3).
Related to the fact that we may have to [revert our Debian image to Debian 12 with PHP 8.2 instead of Debian 13 with PHP 8.4](https://github.com/FreshRSS/FreshRSS/pull/7805), so for the next FreshRSS release, we can offer at least one image with PHP 8.4.
2025-08-09 19:14:48 +02:00
Alexandre Alapetite
5c7ea3c7e5 Docker revert to Debian 12 Bookworm (#7805)
Fix https://github.com/FreshRSS/FreshRSS/issues/7798
Revert https://github.com/FreshRSS/FreshRSS/pull/7772
Revert af6f7f013a
2025-08-09 19:13:38 +02:00
Alexandre Alapetite
56d1d4f194 Remove unneeded execution permissions (#7802) 2025-08-08 22:39:33 +02:00
Inverle
d9197d7e32 New JS attribute: data-auto-leave-validation (#7785)
Instead of a repeating pattern like: `<input type="text" value="something" data-leave-validation="something">`, you can now put a `data-auto-leave-validation="1"` attribute on a `<form>` for example, and it will automatically set the `data-leave-validation` attributes inside the form elements.

`data_auto_leave_validation(parent)`  from `extra.js` is called on slider open and page load.

---------

Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>
Co-authored-by: Frans de Jonge <fransdejonge@gmail.com>
2025-08-08 17:39:38 +02:00
Ali Moslemi
a3854c2f59 Update CREDITS.md (#7800)
* Update CREDITS.md

Added my name (Ali Moslemi) with link to GitHub profile as Persian (fa) translation contributor.

* More uniform

---------

Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>
2025-08-08 13:46:18 +02:00
Carey Metcalfe
bb659ee27a Optimize how much data needs to be chown/chmoded on container startup (#7793)
* Optimize how much data needs to be `chown`/`chmod`ed on container startup

This works around an issue where `chmod`/`chown` operations inside a
container can be extremely slow when using the `overlay2` storage
driver, resulting in 10min+ container startup times.

It modifies the owner of the webapp when building the container so that
only the `data` and `extensions` directories (which are commonly mapped
as volumes into the container) have to be modified by the
`access-permissions.sh` script at container startup.

When not running via docker the behaviour of the `access-permissions.sh`
script is unchanged.

* Take DATA_PATH environment variable into account when fixing permissions

* Revert change to using bash for arrays

(the alpine image doesn't include `bash`)

* A few more improvements

* Slightly tweak reapply permissions variable

- lowercase to indicate it's not an env variable
- use 0/1 to address potentially-irrational paranoia about unset variables

* Remove conditional logic to skip reapplying permissions

Also documents why in a comment so it's not missed in the future.

---------

Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>
2025-08-08 13:36:57 +02:00
Ali Moslemi
084f954980 Add Persian (fa) translations for FreshRSS (#7795)
* Add Persian (fa) translations for FreshRSS

* Fix Persian translation and syntax issues

* Apply fix-all for Persian translation2

* Fix syntax errors and update Persian translations

* Mark untranslated strings as IGNORE and fix remaining TODOs

* make fix-all

---------

Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>
2025-08-08 11:01:47 +02:00
James Frost
d1f2e0f6be Avoid styling <code> inside of <pre> (#7797)
* Remove background from <code> inside <pre>

This caused an ugly effect where each line has a seperate background to
the whole pre block.

Fixes #7796

* Add James Frost to CREDITS.md
2025-08-08 10:50:27 +02:00
Alexandre Alapetite
1f8273803f Add more unicity criteria based on title and/or content (#7789)
* Add more unicity criteria based on title and/or content
https://github.com/FreshRSS/FreshRSS/discussions/7788

* More
2025-08-07 22:20:08 +02:00
Alexandre Alapetite
62f32ccadf PHPStan: finalise strictArrayFilter (#7794)
As well as reportPossiblyNonexistentConstantArrayOffset.
And disable PHPStan-next from GitHub Action, since the work is completed for now.
2025-08-07 22:19:45 +02:00
Inverle
149136fbe2 Improve sharing via Print (#7728)
List of changes:
* The temporary document for printing is now in an `<iframe>` instead of a new tab
* The whole `<head>` element is copied to the temporary document, except for `<script>` tags to copy over the `<meta>` tags as well
* URLs that contain the instance base URL are now removed from the printed PDF
* The saved filename (PDF) will now default to the article title
* `<details>` is auto expanded
* Styling:
   * The main document's `<html>` class is copied over to preserve some styling that might use those classes
   * Instead of writing `content_el.innerHTML` to the temporary document, `content_el.outerHTML` is now written instead to apply the styles that select `.content`
   * `.dropdown-menu` is now hidden in the printed document, because it can't be expanded anyway
   * Headers and footers are hidden in the printed document
* The printed document will now display correctly all the time, by waiting for it to load before calling `print()`
   * Before, the stylesheets might've not finished loading and the document was broken
* Better browser support on mobile for this feature
   * Before, the document would fail to print on Chrome Mobile
   
Tested on:
* Firefox - both desktop and mobile, works 
* Chrome - both desktop and mobile, works 
* Opera - desktop, works (same as Chrome) 
* Brave - both desktop and mobile (same as Chrome), works 
* Safari - both desktop and mobile, works
* Microsoft Edge - both desktop and mobile, works 
* GNOME Web - desktop, works 
* SeaMonkey - desktop, works 

Known issues:
* Images may not finish loading the first time the print dialog is opened

TODO:
* [x] Test on Safari
* [x] Try to fix GNOME Web
2025-08-06 21:49:13 +02:00
hilariousperson
9faf2c1fa3 GReader API: fix incorrect favicon URL (#7792)
* GReader API: fix incorrect favicon URL

* Fix compatibility with custom favicons

---------

Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>
2025-08-06 12:32:16 +02:00
Alexandre Alapetite
b7a39976f9 PHPStan start supporting PHP 8.5+ (#7787)
https://github.com/phpstan/phpstan/releases/tag/2.1.22
2025-08-05 23:31:11 +02:00