Commit Graph
3237 Commits
Author SHA1 Message Date
335addab5a CSS fixes for Swage (#7608)
- Fixes for Swage
	- Buttons not showing correctly #7465
	- Dropdown placement (some dropdowns couldn't fit in viewport)
	- Icons not appearing in some places due to color i.e. label management and subscription management page
	- Made `.form-group` and button inside search dropdown hover colors slightly darker, for better visibility
	- Nav menu style improvements on mobile
		- Smaller if not on main page
		- Align settings icon on configuration pages to the right
		- Support nav menu for feed statistics page
	- Text alignment in search dropdown
	- Ensure `input, select, textarea` don't overflow the page
	- Login link placement in anonymous view
	- Other fixes for
		- Add via bookmarklet page
		- About page
		- Shared HTML query page
		- Register page
	- Text visibility for debug log
- Provide classes `layout.phtml` within `<html>`:
	- `logged_in` if applicable
	- `controller_$NAME` if applicable
	- `file_$NAME` if applicable
- Some other fixes

---------

Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>
Co-authored-by: maTh <1645099+math-GH@users.noreply.github.com>
2025-09-01 23:45:54 +02:00
Alexis Degrugillier b2a82b64b5 fix: add validation when creating a new tag (#7890)
A tag name must be unique and can't be used as a category. There were no error message when creating a tag identical to an existing category. Now, this is addressed.

See #7686

Closes #7686

Changes proposed in this pull request:

- add validation on tag creation

How to test the feature manually:

1. create a new category (ex: `HW`)
2. create a new tag with the same name as the new category (ex: `HW`)
3. validate that the appropriate error message is displayed
2025-09-01 23:29:54 +02:00
Alexis Degrugillier d31f485973 fix: add default values on stat processing (#7891)
Before, there was an error when retrieving stats for a user without feeds. Now, there are default values to display empty stats instead of an exception.

See #7884

Closes #7884

Changes proposed in this pull request:

- add default values when retrieving stat data

How to test the feature manually:

1. create a new user
2. connect as the new user
3. display stats
4. validate that there is no errors
2025-09-01 23:28:17 +02:00
Inverle e20b0c8c02 Fix displaying of current date in main statistics (#7892)
Before

<img width="1034" height="543" alt="image" src="https://github.com/user-attachments/assets/09408f81-42f1-4613-948b-b2c7e3ff2409" />

After

<img width="1031" height="536" alt="image" src="https://github.com/user-attachments/assets/d4dd3702-c8a5-4f8d-9014-b419a982d9ec" />

The current day is now included within statistics.

The `-1` thing started happening after #7752 but I'm not sure whether the correct solution is to display the current day or just fix it in the JS

For reference here's what the chart used to looked like:

<img width="1027" height="536" alt="image" src="https://github.com/user-attachments/assets/47a27bad-6593-4e84-a04f-e4385f601c6a" />
2025-09-01 23:25:58 +02:00
InverleandAlexandre Alapetite c44bb029c0 Fix log CRLF injection (#7883)
* Fix log CRLF injection

* empty -> space

Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>
2025-08-31 20:05:30 +02:00
InverleandAlexandre Alapetite 87879e8392 Improve leave validation (#7830)
* Improve leave validation

* array_key_exists -> isset

Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>
2025-08-31 19:09:02 +02:00
maTh 94d4f942d3 <label> -> <div> (#7882)
Ref #7646

`<label>` needs to have an HTML input within or a `for=""` attribute

Changes proposed in this pull request:

- fixed 2 `<label>` who are not a 'real' label, so a `<div>` is the better choice


How to test the feature manually:

1. open feed configuration
2. click on "Icon" (first lines of config page) or "Export as OPML" (last lines of config page)
3. nothing will happen. Mouse cursor will not change while hovering over the labels.
2025-08-31 19:07:04 +02:00
Inverle 200eafb352 Regenerate session ID on login (#7829)
Follow-up to #7762

* Regenerate session ID on login
* Send only one cookie
* Improvements
* Delete old session file
* Simplify
* Make function consistent with others
2025-08-30 21:40:00 +02:00
maTh 585875cda7 Global view: use generic CSS class to open panel (#7868)
I found this todo and just did it. 😆 

Changes proposed in this pull request:

- use `open-class` instead of `.box a`


How to test the feature manually:

1. go to global view
2. click on a box title link: it will open the whole category in the panel
3. click on a feed name: it will open the feed articles in the panel
4. nothing will be different for the user as before
2025-08-30 21:32:50 +02:00
maTh c55e2d317f delete sub.title.rename_label (#7881)
Ref #7871 
Ref #5954

Changes proposed in this pull request:

- `sub.title.rename_label ` has been not used anymore since #5954 (Version V1.24.0)
- `sub.title.rename_label ` deleted
2025-08-30 21:31:20 +02:00
Alexandre Alapetite 2b02ca59c6 Include port number for HTTP Retry-After (#7875)
fix https://github.com/FreshRSS/FreshRSS/issues/7870 (partially)
2025-08-30 16:28:37 +02:00
Inverle 379a387dde Disallow setting non-existent language (#7878)
The set language is used inside paths and can lead to issues by including PHP files from other locations
2025-08-30 16:26:24 +02:00
maThandAlexandre Alapetite 5cb49094b8 Label config delete label (#7871)
* h2 -> h3

* delete a label -> delete this label

* i18n: fr

---------

Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>
2025-08-30 00:01:10 +02:00
Alexandre Alapetite 288992d9ad Fix logic for searching labels (#7863)
`L:1 L:2` is supposed to be an implicit `AND`,
while `L:1,2` as well as `L:1 OR L:2` is an `OR` logic
2025-08-27 21:56:10 +02:00
Inverle 1481cf51f7 Fix fetching OPML url with special characters (#7843)
* Decode dynamic OPML url during fetch

* add ENT_QUOTES

* Store as plaintext instead of decoding
2025-08-25 10:37:23 +02:00
Alexandre Alapetite ade9ba8817 Call cleanCache when refreshing feeds (#7827)
Otherwise, it is only called when calling `httpGet()` which can be rare for users not using Web Scraping.
https://github.com/FreshRSS/FreshRSS/discussions/7784#discussioncomment-14109207
2025-08-15 09:37:00 +02:00
Alexandre Alapetite ddb9e91bf2 Fix some PHP 8.5 deprecations (#7826)
https://github.com/php/php-src/blob/php-8.5.0beta1/NEWS
https://php.net/function.curl-close
> This function has no effect. Prior to PHP 8.0.0, this function was used to close the resource.
2025-08-15 09:36:45 +02:00
Alexandre Alapetite cc8afa7750 Minor change of signature on_http_response (#7825)
Follow-up of https://github.com/FreshRSS/FreshRSS/pull/7824
2025-08-14 09:40:53 +02:00
Alexandre Alapetite 531b9286d9 Fix regression on_http_response (#7824)
Fix regression (bad merge) from https://github.com/FreshRSS/FreshRSS/pull/7775
* https://github.com/FreshRSS/simplepie/pull/50
2025-08-14 09:35:30 +02:00
Alexandre Alapetite 4ef52d6825 Fix share XML encoding (#7822)
Maybe related to https://github.com/FreshRSS/FreshRSS/issues/7820
2025-08-13 22:53:09 +02:00
Inverle 7df6c201f2 Put CSP everywhere (#7810)
* Puts CSP everywhere in `p/api`
   * including the HTML query page ❗
   * Also in `p/ext.php`
* Puts `X-Content-Type-Options: nosniff` everywhere
* Fixes custom icon configuration not showing `blob:` icon in statsController (idle feeds)
   * Also removes `style-src 'unsafe-inline'` since it doesn't seem to be needed
* Improves CSP of `p/f.php`

* Add `sandbox` directive
2025-08-11 19:35:54 +02:00
Inverle 2b1b268fc2 Fix privacy link not being highlighted in configure (#7811) 2025-08-11 00:58:03 +02:00
InverleandAlexandre Alapetite 2b85a50ed7 Show warning when unsafe CSP policy is in use (#7804)
* Show warning when unsafe CSP policy is in use

* Fix bare markdown URL

* i18n: fr

* Minor i18n: fr

* Add target="_blank" to i18n strings

---------

Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>
2025-08-09 21:47:39 +02:00
Alexandre Alapetite 56d1d4f194 Remove unneeded execution permissions (#7802) 2025-08-08 22:39:33 +02:00
d9197d7e32 New JS attribute: data-auto-leave-validation (#7785)
Instead of a repeating pattern like: `<input type="text" value="something" data-leave-validation="something">`, you can now put a `data-auto-leave-validation="1"` attribute on a `<form>` for example, and it will automatically set the `data-leave-validation` attributes inside the form elements.

`data_auto_leave_validation(parent)`  from `extra.js` is called on slider open and page load.

---------

Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>
Co-authored-by: Frans de Jonge <fransdejonge@gmail.com>
2025-08-08 17:39:38 +02:00
Ali MoslemiandAlexandre Alapetite 084f954980 Add Persian (fa) translations for FreshRSS (#7795)
* Add Persian (fa) translations for FreshRSS

* Fix Persian translation and syntax issues

* Apply fix-all for Persian translation2

* Fix syntax errors and update Persian translations

* Mark untranslated strings as IGNORE and fix remaining TODOs

* make fix-all

---------

Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>
2025-08-08 11:01:47 +02:00
Alexandre Alapetite 1f8273803f Add more unicity criteria based on title and/or content (#7789)
* Add more unicity criteria based on title and/or content
https://github.com/FreshRSS/FreshRSS/discussions/7788

* More
2025-08-07 22:20:08 +02:00
Alexandre Alapetite 62f32ccadf PHPStan: finalise strictArrayFilter (#7794)
As well as reportPossiblyNonexistentConstantArrayOffset.
And disable PHPStan-next from GitHub Action, since the work is completed for now.
2025-08-07 22:19:45 +02:00
hilariouspersonandAlexandre Alapetite 9faf2c1fa3 GReader API: fix incorrect favicon URL (#7792)
* GReader API: fix incorrect favicon URL

* Fix compatibility with custom favicons

---------

Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>
2025-08-06 12:32:16 +02:00
Alexandre Alapetite 05c7aac84e Improve security of form for user details (#7771)
Related to https://github.com/FreshRSS/FreshRSS/pull/7684
The form buttons requiring confirmation are disabled in HTML in the case of Ajax, and only enabled again if our own JavaScript is running
2025-08-03 23:30:35 +02:00
Inverle 26377b543d Fix create user bugs (#7783)
* Fix registration regression due to #7753
* Add missing access check
2025-08-03 23:14:59 +02:00
Inverle 502090edcd Redirect to the login page from bookmarklet instead of 403 (#7782)
Makes it easier than having to sign in then go back to the website I clicked the bookmarklet on.
2025-08-03 13:44:18 +02:00
Alexandre Alapetite e915ebe46e Rework fetch favicons (#7767)
* Use main function `httpGet()` instead of local one;
* Use HTTP cache, also between users;
* Do not default to feed URL when there is no website URL

TODO for later: consider supporting Atom's `<icon>` and RSS 2.0's `<image>` https://github.com/FreshRSS/FreshRSS/issues/7774
2025-08-01 08:30:49 +02:00
InverleandAlexandre Alapetite 3ce64d271b Implement sudo mode / reauthentication (#7753)
* Implement sudo mode / reauthentication

* i18n: fr

* generate flags

* Improvements

* Remove HMAC check
* Don't require reauth to access logs when signed in as admin
* Notify user of bad login via notification instead

---------

Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>
2025-07-31 13:53:14 +02:00
Inverle d0425f8c3a Add missing access checks for feed-related actions (#7768)
* Add missing access checks for feed-related actions

* fix whitespace
2025-07-31 13:48:42 +02:00
InverleandAlexandre Alapetite f85333e98a Require current password when setting new password (#7763)
* Require current password when setting new password

* i18n: fr

---------

Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>
2025-07-31 09:24:37 +02:00
Alexandre Alapetite 7a0c423357 Implement support for HTTP 429 Too Many Requests (#7760)
* Implement support for HTTP 429 Too Many Requests
Will obey the corresponding HTTP `Retry-After` header at domain level.

* Implement 503 Service Unavailable

* Sanitize Retry-After

* Reduce default value when Retry-After is absent
And make configuration parameter

* Retry-After also for favicons
2025-07-31 09:17:42 +02:00
InverleandAlexandre Alapetite e33ef74af9 before_login_btn hook + system conf attributes (#7761)
* `before_login_btn` hook + system conf attributes

* phpstan fix

* Refactoring

---------

Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>
2025-07-30 08:03:04 +02:00
Inverle e967b07589 Regenerate cookie ID after logging out (#7762)
To make the session cookie no longer usable if hijacked and put in another browser after user logs out
2025-07-29 14:44:14 +02:00
Alexandre Alapetite fe9ef3b506 Include enclosures in entries hash (#7719)
* Include enclosures in entries hash
Fix https://github.com/FreshRSS/FreshRSS/issues/7718
Negative side-effect: users using the option to automatically mark updated articles as unread will have some articles with enclosures appear as unread

* Changelog with warning
2025-07-26 15:57:58 +02:00
Inverle 6f7bea4a5a Update chart.js from 3.5.1 to 4.5.0 (#7752) 2025-07-25 23:05:13 +02:00
Inverle 1ef3bd34d6 Fix no registration limit setting (#7751) 2025-07-24 07:59:00 +02:00
Alexandre Alapetite 01eae00ca2 WebSub: only perform a redirect when coming from WebSub (#7738)
And add support for HTTP Link header for "self" URL
Changing URL based on "self" URL will only be done when coming from a WebSub push
fix https://github.com/FreshRSS/FreshRSS/issues/7737
2025-07-19 22:52:06 +02:00
Inverle edda6f0159 Fixes for frss.css (#7616)
* Fixes for frss.css and make more buttons accessible in anonymous view

* Suggested changes and page overflow fix

* Forgot rtlcss

* Revert anonymous view changes
2025-07-16 16:13:58 +02:00
InverleandAlexandre Alapetite f9a42adade Show translation status in README.md (#7715)
* Show translation status in README.md

* Fix colon

* markdownlint: Allow tag `<translations>`

* Use mostly Unicode flags instead

* Only `oc.svg` remains in an image format
* `check.translation.php` still supports `.png` even though there aren't any PNGs as of right now

* Fix CodeSniffer

* Attempt approach with generating local SVGs

* Fixes for local SVG approach

* Cleanup old code

* PHPStan fix

* Remove decimal precision from percentages

* Suggestions + better error messages

* codesniffer fix v2

* Revert `ghSearchUrl` change

* Generate readme

* Fix syntax highlight, maybe

* Regenerate

* Update help message

* Use existing translation files instead of .txt

* Add test against wrong Unicode flag

---------

Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>
2025-07-16 16:11:51 +02:00
5f61e426dc Sort by category title, feed title (#7702)
* Sort by category name, feed name
fix https://github.com/FreshRSS/FreshRSS/issues/7698
Note that sorting is done with the default SQL collation for now, meaning that lower-case vs. upper-case and diacritics are influencing the sorting order. Improvements left for future work.
Watch out that those sorting criteria are slower due to additional joins, additional requests, and poorer indexes.

* i18n:pl

Co-authored-by: Inverle <inverle@proton.me>

* i18n: nl

Co-authored-by: Frans de Jonge <fransdejonge@gmail.com>

* Fix preserve sort

---------

Co-authored-by: Inverle <inverle@proton.me>
Co-authored-by: Frans de Jonge <fransdejonge@gmail.com>
2025-07-15 12:39:51 +02:00
Alexandre Alapetite 8a44d1045a Honor "disable update" on index page (#7733)
fix https://github.com/FreshRSS/FreshRSS/issues/7272
2025-07-14 23:10:07 +02:00
the7thNightmareandAlexandre Alapetite 8385eadf49 i18n:ID (#7721)
* id translation

* make fix-all

---------

Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>
2025-07-09 21:24:12 +02:00
Inverle 6549932d59 Disallow setting non-existent theme (#7722)
Related: https://github.com/FreshRSS/xExtension-Demo/pull/2, https://github.com/FreshRSS/FreshRSS/pull/7559#issuecomment-2858083635

Mostly to make sure that no one is able to break the demo instance
But the issues below could possibly be exploited in other scenarios too:
* Setting a theme like `../../lib/core-extensions/UserJS`: this directory contains `metadata.json` like themes do, so FreshRSS treats it as a theme after setting it and doesn't load any CSS
* Setting a theme like `x dropdown-menu`: the `dropdown-menu` class was able to get injected into the `<body>` element since https://github.com/FreshRSS/FreshRSS/pull/7559 and turn every page blank
2025-07-07 23:32:35 +02:00
Inverle 7915abd833 Implement custom feed favicons (#7646)
Closes #3789, #6503

Icon setting when no custom icon is set yet:

![image](https://github.com/user-attachments/assets/28b07dd0-7dac-4c76-b1d7-77035f91a87a)

- `Change...` button opens a file dialog, and after selecting a file shows the chosen icon in the preview on the left. `Submit` must be clicked after selecting the icon.
- `Reset to default` changes the preview icon to the default one, and also requires `Submit` to be clicked to apply the changes.

Full list of changes:
- CSP now includes `blob:` in `img-src` for
   - `indexAction()` and `feedAction()` in `subscriptionController.php`
   - all of the view actions in `indexController.php`
- Introduce new attribute `customFavicon (boolean)` for feeds that indicates if the feed has a custom favicon
   - `hashFavicon()` in `Feed.php` is dependent on this attribute
      - `hashFavicon()` has a new parameter called `skipCache (boolean)` that allows the reset of the favicon hash for the Feed object
      - `resetFaviconHash()` just calls `hashFavicon(skipCache: true)`
- `f.php` URLs now have the format of `/f.php?h=XXXXX&t=cachebuster`, where the `t` parameter is only used for serving custom favicons
   - if `t` parameter is set, `f.php` returns a `Cache-Control: immutable` header
- `stripos` and `strpos` were changed to `str_contains` in various places (refactor)
- JS for handling the custom favicon configuration logic is in `extra.js` inside `init_update_feed()` which is called when feed configuration is opened from the aside or when the subscription management page with the feed is loaded
   - Server-side code for uploading the icon in `subscriptionController.php` under `feedAction()`
   - Errors that may occur during the setting of a custom favicon:
      - Unsupported image file type (handled only server-side with `isImgMime()`)
      - When the file is bigger than 1 MiB (default), handled both client-side and server-side
      - Standard feed error when `updateFeed()` fails
- JS vars `javascript_vars.phtml` are no longer escaped with `htmlspecialchars()`, instead with json encoding,
- CSS for disabled buttons was added
- Max favicon file size is configurable with the `max_favicon_upload_size` option in `config.php` (not exposed via UI)
- Custom favicons are currently deleted only when they are either reset to the default icon, or the feed gets deleted. They do not get deleted when the user deletes their account without removing their feeds first.
- ` faviconPrepare()` and `faviconRebuild()` are not allowed to be called when the `customFavicon` attribute is `true`
- New i18n strings:
   - `'sub.feed.icon' => 'Icon'`
   - `'sub.feed.change_favicon' => 'Change…'`
   - `'sub.feed.reset_favicon' => 'Reset to default'`
   - `'sub.feed.favicon_changed_by_ext' => 'The icon has been set by the <b>%s</b> extension.'`
   - `'feedback.sub.feed.favicon.too_large' => 'Uploaded icon is too large. The maximum file size is <em>%s</em>.'`
   - `'feedback.sub.feed.favicon.unsupported_format' => 'Unsupported image file format!'`
- Extension hook `custom_favicon_hash`
   - `setCustomFavicon()` method
   - `resetCustomFavicon()` method
   - `customFaviconExt` and `customFaviconDisallowDel` attributes
   - example of usage: https://github.com/FreshRSS/Extensions/pull/337
- Extension hook `custom_favicon_btn_url`
   - Allows extensions to implement a button for setting a custom favicon for individual feeds by providing an URL. The URL will be sent a POST request with the `extAction` field set to either `query_icon_info` or `update_icon`, along with an `id` field which describes the feed's ID.
2025-06-30 12:01:56 +02:00