3272 Commits

Author SHA1 Message Date
maTh
e79c2866bd fix: anonym. mode: Do not show config button in sharing menu (#8012)
* Ref #8001
Do not show the config button in the article sharing menu if it is in the anonym. mode

* Minor whitespace reduction
Because it is a section that is used many times

---------

Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>
2025-09-25 23:20:50 +02:00
maTh
cec21f231f fix: anonym. mode: label management link (#8011)
Ref: #8001

Changes proposed in this pull request:

- do not show the "manage" dropdown menu for labels in anonym. mode (normal view)

Before:
<img width="304" height="139" alt="grafik" src="https://github.com/user-attachments/assets/2aff0299-febe-41b0-a99a-450559393cd6" />


After:
<img width="281" height="121" alt="grafik" src="https://github.com/user-attachments/assets/69ad334e-0a31-4546-9939-9b72306db046" />
2025-09-25 22:47:09 +02:00
Inverle
f8b2b8c415 Prevent logout CSRFs (#7999)
By avoiding `FreshRSS_Context::initUser()` calls
2025-09-25 21:52:29 +02:00
maTh
960c6c88a5 Fix: sharing button in top line when 0 entries (#8010)
ref #8001 

Changes proposed in this pull request:

- count entries, do not show share button when 0 sharing services


How to test the feature manually:
1. having 0 sharing services
2. enable the sharing button in top line (settings -> display>
3. go to normal view -> sharing button should not be displayed in the article entry
4. add 1 sharing service
5. normal view -> sharing button is be displayed
2025-09-25 21:41:13 +02:00
Inverle
f612a560d2 Fix some CSRFs (#8000)
In two bookmark actions and one in `entryController`

Completes one TODO from #7923:

de624dc8ce/app/Controllers/entryController.php (L257)

(a POST request is already sent in the frontend)
2025-09-24 12:13:40 +02:00
Alexandre Alapetite
833007f586 Upgrade to PHP_CodeSniffer 4 (#7993)
https://github.com/PHPCSStandards/PHP_CodeSniffer/wiki/Version-4.0-User-Upgrade-Guide
A couple of rules have changed name. Exclusion paths have slightly changed behaviour.
Main change is that it was unhappy with our i18n header comments, so minor edit there, since that rule kind of makes sense the rest of the time
2025-09-22 22:02:59 +02:00
beerisgood
f0388f64ac Update German (#7833)
* Update sub.php

German translation added.

* Update gen.php

German translation added

* make fix-all

* Update conf.php

* make fix-all

* Update index.php

* make fix-all

* Update admin.php

* Update feedback.php

* Update app/i18n/de/index.php

* make fix-all

* Apply suggestions from code review

Co-authored-by: maTh <1645099+math-GH@users.noreply.github.com>

* Update app/i18n/de/index.php

Co-authored-by: maTh <1645099+math-GH@users.noreply.github.com>

* Update app/i18n/de/feedback.php

Co-authored-by: maTh <1645099+math-GH@users.noreply.github.com>

* Icon

* make fix-all

---------

Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>
Co-authored-by: maTh <1645099+math-GH@users.noreply.github.com>
Co-authored-by: Alexis Degrugillier <aledeg@users.noreply.github.com>
2025-09-21 13:45:12 +02:00
Alexandre Alapetite
bc3e4c8fa4 Add option for CSP frame-ancestors (#7857)
* Add option for CSP frame-ancestors
https://github.com/FreshRSS/FreshRSS/discussions/7856

* Revert contentSelectorPreviewAction

* Same for f.php and api

* Fix double init in f.php

* No sandbox for API page
2025-09-21 13:29:58 +02:00
Inverle
f2c6942a60 Move update one step before (#7989)
Closes https://github.com/FreshRSS/FreshRSS/issues/7897
2025-09-21 12:40:40 +02:00
Alexis Degrugillier
caecc5decf fix linkding documentation link (#7985)
Closes #7984 

Changes proposed in this pull request:

- fix linkding documentation link

How to test the feature manually:

1. add a linkding sharing method
2. click on the documentation link
3. validate that the link is working
2025-09-20 18:06:55 +02:00
Horváth Zsolt
508b1bb1ce 6846 i18n update hungarian language (#7986)
* Update hungarian translation

* Update hungarian translation status as well
2025-09-20 00:10:26 +02:00
KleinMann
d670bf1e72 Add entry_before_update and entry_before_add hooks (#7977)
Discussion: https://github.com/FreshRSS/FreshRSS/discussions/7973

Changes proposed in this pull request:

- Add new extension hook "entry_before_add"
- Add new extension hook "entry_before_update"

How to test the feature manually:

1. Create extension that uses the hooks and confirm they are invoked correctly.

Extension to use for testing
https://github.com/rnkln/freshrss-xExtension-Discord/pull/2
2025-09-18 23:44:17 +02:00
Inverle
055342118f Restrict allowed curl parameters (#7979)
For additional safety, also making sure in this PR that [`CURLOPT_COOKIEFILE`](https://curl.se/libcurl/c/CURLOPT_COOKIEFILE.html) is only allowed as an empty string during import.
2025-09-18 23:43:04 +02:00
Alexandre Alapetite
b5ee1d8936 Keep sort and order after marking as read (#7974)
fix https://github.com/FreshRSS/FreshRSS/issues/7867
2025-09-17 14:03:00 +02:00
Inverle
25250f46b4 Safer calling of install.php (#7971)
To prevent `install.php` from being accessed in unintended places
2025-09-16 00:53:15 +02:00
Alexandre Alapetite
f8310a587c Clarify: Visibility hidden vs. archived (#7970)
fix https://github.com/FreshRSS/FreshRSS/issues/7887
We have two concepts: how much a feed is shown or not (controlled by priority), and how often a feed is refreshed (or not, in which case it is archived).
This PR removes the wording *Archived* from the *visibility* parameter, since this is not what it does.
2025-09-15 23:43:46 +02:00
Alexandre Alapetite
ea366d597f Minor RSS output whitespace reduction (#7969)
fix https://github.com/FreshRSS/FreshRSS/issues/7968
2025-09-15 22:26:45 +02:00
Inverle
ddb51c0e95 Fix another user self-delete regression (#7877)
Regression from #7763 
Earlier regression which was fixed before #7626

In addition:
* get rid of `data-toggle` (refactor)
* show invalid login message if deleting account and entered incorrect password instead of redirect to 403
* remove unused reference to `r` parameter
* `forgetOpenCategories()` on login not on any crypto form
2025-09-15 22:17:14 +02:00
scmaybee
38b7daedf7 i18n zh-CN: Update conf.php (#7944)
* Update conf.php

Supplementary part of the translation.

* Update app/i18n/zh-cn/conf.php

* Update app/i18n/zh-cn/conf.php

* Update app/i18n/zh-cn/conf.php

* Fixes

---------

Co-authored-by: Frans de Jonge <fransdejonge@gmail.com>
Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>
2025-09-15 22:12:25 +02:00
Alexandre Alapetite
29446a29f5 Recovery: skip broken entries during CLI export/import (#7949)
* Recovery: skip broken entries during CLI export/import
fix https://github.com/FreshRSS/FreshRSS/discussions/7927

```
25605/25605 (48 broken)
```

Help with *database malformed* or other corruption.

* Compatibility multiple databases
2025-09-14 22:36:01 +02:00
Inverle
697240813d i18n: add missing string in pl (#7963)
It was supposed to be done in https://github.com/FreshRSS/FreshRSS/pull/7712#discussion_r2179851787, but that PR hasn't been yet finished for some time now.
2025-09-14 21:25:21 +02:00
Denys Nykula
6d0bec14e5 Translate to Ukrainian (#7961) 2025-09-14 21:17:30 +02:00
Inverle
8a0436ede2 Minor CSS underline fix in label management (#7952)
Before

<img width="255" height="159" alt="image" src="https://github.com/user-attachments/assets/9b80659c-c646-47de-8436-45aa38afd465" />

After

<img width="238" height="161" alt="image" src="https://github.com/user-attachments/assets/27dcb572-5935-405b-9cfc-33eb95d78bf0" />

(ignore CSS in branch name, it's just HTML changes - although this could've been solved with `display: inline-block` too)
2025-09-12 08:14:46 +02:00
Alexandre Alapetite
8bd9bd95d8 Minor update syntax echo (#7941)
* Minor update syntax echo
Follow-up of https://github.com/FreshRSS/FreshRSS/pull/7939

* Fix layout
Whitespace optimisation needed to avoid style glitch
2025-09-11 21:19:31 +02:00
scmaybee
e7c9c3d11e i18n zh-CN: Update index.php (#7943)
Fixed a translation errors.
2025-09-11 00:56:25 +02:00
Alexis Degrugillier
c2009b5090 Rewrite PHP opening tags (#7939)
This allows to remove the use of `echo` and be consistent through out the file.
Some empty PHP tags where removed as well.
2025-09-10 21:53:08 +02:00
Frans de Jonge
c6c2e1bc55 Translate Dutch (#7940)
* Translate Dutch

* ignore

* update the SVG file

* without newline
2025-09-10 21:34:34 +02:00
Alexis Degrugillier
a1411c7f2c Translate the API information page (#7922)
Closes #6222
Translate the `api/index.php` page

* Update app/i18n/pl/api.php

Co-authored-by: Inverle <inverle@proton.me>

* Update app/i18n/de/api.php

Co-authored-by: maTh <1645099+math-GH@users.noreply.github.com>

* i18n: fr
* <kbd>

Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>

---------

Co-authored-by: Inverle <inverle@proton.me>
Co-authored-by: maTh <1645099+math-GH@users.noreply.github.com>
Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>
2025-09-10 07:04:17 +02:00
Inverle
087df1e5d9 Use Minz_Translate::exists() for language check in createUser() (#7934)
(consistency)
Related / follow-up: #7878
2025-09-09 23:11:38 +02:00
Alexis Degrugillier
6ad625812a Add a default language constant (#7933)
This replace the use of `en` through out the code.
2025-09-09 22:01:04 +02:00
nhirokinet
2404a29ee5 Update Japanese translation for "Duration to keep logged in" (#7918)
If this corresponds to "Duration to keep logged in", then current Japanese text says different thing: "Time to store log (not login)".

There are multiple choices for translation of this one and I thought a bit which one is the best, and I'm not sure this is the best, but at least this explains "the time after user logged in until user is logged out", not "the time the log is stored".
2025-09-05 19:32:49 +02:00
Alexis Degrugillier
23ba48c71f Change how files are included (#7916)
1. `include`, `include_once`, `require` and `require_once` are expressions not functions, parentheses are not necessary.
2. to move up the directory tree, it's better to use the `dirname` function instead of relying on `/..`.
2025-09-05 15:56:46 +02:00
Inverle
858616f075 Fixes for no-cache.txt (#7907)
* Closes and fixes error from #7885
* `no-cache.txt` is now respected in `f.php`, `ext.php` and `serve` action in `extensionController`
   * And in all other places that weren't checking for `no-cache.txt` (some extensions maybe)
2025-09-05 08:16:52 +02:00
Alexis Degrugillier
94c53ae1fb refactor value setting for javascript variables (#7906)
When retrieving an unset shortcut value, the error is not silenced but
instead we use the null-coalesce operator to define a default value.

See #7290
2025-09-03 06:45:01 +02:00
Alexandre Alapetite
14a5ffe6a7 Fix typo in Japanese translation (#7903)
I just found a typo in Japanese translation.

開業: opening business
改行: newline

Co-authored-by: nhirokinet <nhirokinet@nhiroki.net>
2025-09-02 21:52:52 +02:00
Inverle
335addab5a CSS fixes for Swage (#7608)
- Fixes for Swage
	- Buttons not showing correctly #7465
	- Dropdown placement (some dropdowns couldn't fit in viewport)
	- Icons not appearing in some places due to color i.e. label management and subscription management page
	- Made `.form-group` and button inside search dropdown hover colors slightly darker, for better visibility
	- Nav menu style improvements on mobile
		- Smaller if not on main page
		- Align settings icon on configuration pages to the right
		- Support nav menu for feed statistics page
	- Text alignment in search dropdown
	- Ensure `input, select, textarea` don't overflow the page
	- Login link placement in anonymous view
	- Other fixes for
		- Add via bookmarklet page
		- About page
		- Shared HTML query page
		- Register page
	- Text visibility for debug log
- Provide classes `layout.phtml` within `<html>`:
	- `logged_in` if applicable
	- `controller_$NAME` if applicable
	- `file_$NAME` if applicable
- Some other fixes

---------

Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>
Co-authored-by: maTh <1645099+math-GH@users.noreply.github.com>
2025-09-01 23:45:54 +02:00
Alexis Degrugillier
b2a82b64b5 fix: add validation when creating a new tag (#7890)
A tag name must be unique and can't be used as a category. There were no error message when creating a tag identical to an existing category. Now, this is addressed.

See #7686

Closes #7686

Changes proposed in this pull request:

- add validation on tag creation

How to test the feature manually:

1. create a new category (ex: `HW`)
2. create a new tag with the same name as the new category (ex: `HW`)
3. validate that the appropriate error message is displayed
2025-09-01 23:29:54 +02:00
Alexis Degrugillier
d31f485973 fix: add default values on stat processing (#7891)
Before, there was an error when retrieving stats for a user without feeds. Now, there are default values to display empty stats instead of an exception.

See #7884

Closes #7884

Changes proposed in this pull request:

- add default values when retrieving stat data

How to test the feature manually:

1. create a new user
2. connect as the new user
3. display stats
4. validate that there is no errors
2025-09-01 23:28:17 +02:00
Inverle
e20b0c8c02 Fix displaying of current date in main statistics (#7892)
Before

<img width="1034" height="543" alt="image" src="https://github.com/user-attachments/assets/09408f81-42f1-4613-948b-b2c7e3ff2409" />

After

<img width="1031" height="536" alt="image" src="https://github.com/user-attachments/assets/d4dd3702-c8a5-4f8d-9014-b419a982d9ec" />

The current day is now included within statistics.

The `-1` thing started happening after #7752 but I'm not sure whether the correct solution is to display the current day or just fix it in the JS

For reference here's what the chart used to looked like:

<img width="1027" height="536" alt="image" src="https://github.com/user-attachments/assets/47a27bad-6593-4e84-a04f-e4385f601c6a" />
2025-09-01 23:25:58 +02:00
Inverle
c44bb029c0 Fix log CRLF injection (#7883)
* Fix log CRLF injection

* empty -> space

Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>
2025-08-31 20:05:30 +02:00
Inverle
87879e8392 Improve leave validation (#7830)
* Improve leave validation

* array_key_exists -> isset

Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>
2025-08-31 19:09:02 +02:00
maTh
94d4f942d3 <label> -> <div> (#7882)
Ref #7646

`<label>` needs to have an HTML input within or a `for=""` attribute

Changes proposed in this pull request:

- fixed 2 `<label>` who are not a 'real' label, so a `<div>` is the better choice


How to test the feature manually:

1. open feed configuration
2. click on "Icon" (first lines of config page) or "Export as OPML" (last lines of config page)
3. nothing will happen. Mouse cursor will not change while hovering over the labels.
2025-08-31 19:07:04 +02:00
Inverle
200eafb352 Regenerate session ID on login (#7829)
Follow-up to #7762

* Regenerate session ID on login
* Send only one cookie
* Improvements
* Delete old session file
* Simplify
* Make function consistent with others
2025-08-30 21:40:00 +02:00
maTh
585875cda7 Global view: use generic CSS class to open panel (#7868)
I found this todo and just did it. 😆 

Changes proposed in this pull request:

- use `open-class` instead of `.box a`


How to test the feature manually:

1. go to global view
2. click on a box title link: it will open the whole category in the panel
3. click on a feed name: it will open the feed articles in the panel
4. nothing will be different for the user as before
2025-08-30 21:32:50 +02:00
maTh
c55e2d317f delete sub.title.rename_label (#7881)
Ref #7871 
Ref #5954

Changes proposed in this pull request:

- `sub.title.rename_label ` has been not used anymore since #5954 (Version V1.24.0)
- `sub.title.rename_label ` deleted
2025-08-30 21:31:20 +02:00
Alexandre Alapetite
2b02ca59c6 Include port number for HTTP Retry-After (#7875)
fix https://github.com/FreshRSS/FreshRSS/issues/7870 (partially)
2025-08-30 16:28:37 +02:00
Inverle
379a387dde Disallow setting non-existent language (#7878)
The set language is used inside paths and can lead to issues by including PHP files from other locations
2025-08-30 16:26:24 +02:00
maTh
5cb49094b8 Label config delete label (#7871)
* h2 -> h3

* delete a label -> delete this label

* i18n: fr

---------

Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>
2025-08-30 00:01:10 +02:00
Alexandre Alapetite
288992d9ad Fix logic for searching labels (#7863)
`L:1 L:2` is supposed to be an implicit `AND`,
while `L:1,2` as well as `L:1 OR L:2` is an `OR` logic
2025-08-27 21:56:10 +02:00
Inverle
1481cf51f7 Fix fetching OPML url with special characters (#7843)
* Decode dynamic OPML url during fetch

* add ENT_QUOTES

* Store as plaintext instead of decoding
2025-08-25 10:37:23 +02:00