951 Commits

Author SHA1 Message Date
Alexandre Alapetite
1a3912f25a Improve configuration checks (#8334)
Add a distinction between recommended and required extensions.
Add check for recommended php-intl extension as follow-up of https://github.com/FreshRSS/FreshRSS/pull/8329#issuecomment-3677686581
Improve related checks such as ZIP.
Reduce duplicated translations and tests.
2025-12-21 19:26:08 +01:00
Alexandre Alapetite
00cd5df294 Use native PHP #[Deprecated] (#8325)
https://php.watch/versions/8.4/Deprecated
And enfore it with PHPUnit + PHPStan.
Especially useful for extensions.
2025-12-17 10:11:18 +01:00
Alexandre Alapetite
4bd5035914 Rework encoding of search filters (#8324)
Rework:
* https://github.com/FreshRSS/FreshRSS/pull/8222

now that we have:
* https://github.com/FreshRSS/FreshRSS/pull/8293

Follow-up of:
* https://github.com/FreshRSS/FreshRSS/pull/8311

* More simplification

* Deprecate getRawInput
2025-12-17 10:07:52 +01:00
Alexandre Alapetite
4b6127ee04 New links in transitions and jump to next transition (#8294)
Easier to explain graphically:

<img width="408" height="266" alt="image" src="https://github.com/user-attachments/assets/0e3724a1-155b-4a87-89b3-cfe8a18cb100" />

The jump to next section ⏭ works when the sorting criterion is a date.

Need https://github.com/FreshRSS/FreshRSS/pull/8293
2025-12-13 11:38:33 +01:00
Alexandre Alapetite
a8a544a2a2 Fix search encoding and quoting (#8311)
Revised the encoding approach for searches: the HTML encoding is done just before its use for DB search.
Fix also some cases with wrong quoting.
Fix https://github.com/FreshRSS/FreshRSS/pull/8306#issuecomment-3643865439
Follow-up of https://github.com/FreshRSS/FreshRSS/pull/8293
2025-12-13 11:31:34 +01:00
Alexandre Alapetite
044f066c1c Fix htmlspecialchars for search (#8306)
Regression from https://github.com/FreshRSS/FreshRSS/pull/8293
2025-12-11 18:18:22 +01:00
Alexandre Alapetite
394411677e Add functions to modify a search expression (#8293)
* Allows easier modifications of the search expression.
* Add proper `__toString()` instead of just returning the raw input string. Allows in particular showing the result of the actual parsing of the raw input string in the UI.

Needed for https://github.com/FreshRSS/FreshRSS/pull/8294
2025-12-10 22:41:45 +01:00
Alexandre Alapetite
19975c22ec Fix minor backslashes (#8292) 2025-12-07 20:27:06 +01:00
Inverle
6d2bb24b37 Move unsafe autologin to an extension (#7958)
Completes the following TODO https://github.com/FreshRSS/FreshRSS/issues/7923:

de624dc8ce/app/Controllers/authController.php (L105)

Extension PR: https://github.com/FreshRSS/Extensions/pull/364

https://github.com/FreshRSS/Extensions/tree/main/xExtension-UnsafeAutologin
2025-12-04 20:10:20 +01:00
Alexandre Alapetite
78e40c6fe3 Scaling of user statistics (#8277)
Fix https://github.com/FreshRSS/FreshRSS/issues/8268
To better support user management on FreshRSS instance with many users.

SQL speed improved. On a reduced test with 5 users, including some large accounts (PostgreSQL on a very tiny and slow server), improving from ~2.3s to ~1.8s, which gives ~20% speed improvement.

Then tested with 1000 users, with only the default feed (on my old desktop computer):

```sh
for i in {1..1000}; do ./cli/create-user.php --user=freshrss$i --password=freshrss; done
app/actualize_script.php
cli/access-permissions.sh
```

SQLite:

```console
$ time cli/user-info.php | wc -l
1001

real    0m1.366s
user    0m0.908s
sys     0m0.475s
```

PostgreSQL:

```console
$ time cli/user-info.php | wc -l
1001

real    0m28.498s
user    0m12.137s
sys     0m2.217s
```

MariaDB:

```console
# time ./cli/user-info.php | wc -l
1001

real    0m49.485s
user    0m1.276s
sys     0m2.258s
```

Yes, SQLite is much faster - not a surprise for such use-cases, where the TCP connection is not re-used.

I have added some CLI options to disable some statistics:

```sh
cli/user-info.php --no-db-size --no-db-counts
```

For the Web UI, I have disabled detailed user statistics if it takes too long, and retrieve missing user statistics asynchronously via JavaScript. Lazy loading of the user details based on IntersectionObserver, with maximum 10 requests in parallel.
Web UI tested on 1000 users as well. Checked with SeaMonkey.
2025-12-04 19:11:31 +01:00
Inverle
60cf5ea297 Improve anonymous authentication logic (#8165)
* Improve anonymous authentication logic

* forgot to git add

* Fix incorrect token check

Because an empty parameter could be just passed if token for the user wasn't set: `&token=`
2025-12-04 08:46:11 +01:00
Alexandre Alapetite
1621f12a15 Fix HTML encoding in preview filters (alternative) (#8259)
Alternative to https://github.com/FreshRSS/FreshRSS/pull/8222
Follow-up of https://github.com/FreshRSS/FreshRSS/pull/8222

Co-authored-by: Inverle <inverle@proton.me>
2025-12-04 00:02:58 +01:00
Alexandre Alapetite
3c4a46e6ba Fix CLI user creation warning when language is not given (#8283)
Discovered during https://github.com/FreshRSS/FreshRSS/pull/8277
2025-12-03 23:41:06 +01:00
Inverle
fbfc5eacad Add data: to CSP in subscriptionController (#8253)
Quick fix for https://github.com/FreshRSS/FreshRSS/issues/8250
Regression from https://github.com/FreshRSS/FreshRSS/pull/7646

It seems the CSP is too permissive on some pages though (`img-src *`), so should fix that too later
2025-11-26 10:06:44 +01:00
Alexandre Alapetite
a7579e0cf5 Catch lack of exec function for git update (#8228) 2025-11-20 22:16:22 +01:00
Alexandre Alapetite
8fdc574827 Fix search form for regex (#8226)
Wrongly quoted
Cherry-picked from https://github.com/FreshRSS/FreshRSS/pull/8131
2025-11-17 20:39:45 +01:00
Inverle
f5d14af156 Show search query in the page title (#8217)
* Show search query in the page title

* Simplify encoding

---------

Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>
2025-11-17 18:32:56 +01:00
Alexandre Alapetite
a18c35046d Housekeeping lib_rss.php (#8193)
* Housekeeping lib_rss.php
`lib_rss.php` had become much too large, especially after https://github.com/FreshRSS/FreshRSS/pull/7924
Moved most functions to other places.
Mostly no change of code otherwise (see comments).

* Extension: composer run-script phpstan-third-party
2025-11-11 08:17:12 +01:00
Alexandre Alapetite
5e622c60fa Rename Extensions branch from master to main (#8194)
For uniformity with other repos
dd20c6003e
I made a tag https://github.com/FreshRSS/Extensions/releases/tag/master for back compatibility
2025-11-09 11:58:29 +01:00
Alexandre Alapetite
b6c63d2239 Better transitions between groups of articles (#8174)
fix https://github.com/FreshRSS/FreshRSS/issues/7520
fix https://github.com/FreshRSS/FreshRSS/issues/8168
fix https://github.com/FreshRSS/FreshRSS/discussions/8172
2025-11-04 12:49:21 +01:00
scollovati
04c55fa1b8 [sqlite export] add username and timestamp (#8169)
* [sqlite export] add username and timestamp
add username and timestamp to sqlite user export, similar to the ZIP export. Useful for archiving purposes.

* Fix case of backups and other DB types
https://github.com/FreshRSS/FreshRSS/pull/8169#issuecomment-3476079108

---------

Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>
2025-11-02 20:39:41 +01:00
Alexandre Alapetite
49a92c2437 Mark as read 1 or 7 days based on publication date (#8163)
Allow the UI for marking as read articles older than 1 or 7 days to also work when sorting by publication date (in which case, the publication date is used).

<img width="382" height="229" alt="image" src="https://github.com/user-attachments/assets/a630dec8-1e18-4766-8392-59fb593dd73d" />
2025-10-28 19:07:14 +01:00
Tommaso Ferrari
581b81006a Add option to apply filter actions to existing articles (#7959)
* Add option to apply filter actions to existing articles

* make fix-all

* Fixes

* Another approach with preview
New approach: 20479475c9

<img width="666" height="202" alt="image" src="https://github.com/user-attachments/assets/bb68ede4-60c8-4e0c-9317-c5ed7a6ad7df" />

Additional improvements:
* Also implemented at category level, and at global level
* Also implemented for favourites at global level

Shortcomings:
* Does not always work reliably with advanced regex, since the DB's flavour is not necessarily the same than PHP's

Related: https://github.com/FreshRSS/FreshRSS/pull/8141

* make fix-all

---------

Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>
2025-10-22 21:28:33 +02:00
Alexis Degrugillier
eee8b8c03f Add support for extension compatibility (#8081)
The compatibility does support only a minimum version of FreshRSS. If we need
something a bit more clever in the future, it is possible to handle a rule
with a bit more complexity.

See https://github.com/FreshRSS/FreshRSS/issues/5903

* Update app/Controllers/extensionController.php

Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>

* Update app/i18n/pl/admin.php

Co-authored-by: Inverle <inverle@proton.me>

* Minor move phpstan-type

---------

Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>
Co-authored-by: Inverle <inverle@proton.me>
2025-10-21 23:49:06 +02:00
Alexandre Alapetite
14fc3e9b64 Add to search UI the user modification date (#8122)
* Add to search UI the user modification date
Follow-up of:
* https://github.com/FreshRSS/FreshRSS/pull/8103
* https://github.com/FreshRSS/FreshRSS/pull/8093

* Easier UI to cancel filtering by date

* Add blank <option> to ease deselection of <select>
2025-10-16 21:23:32 +02:00
Alexandre Alapetite
f08f7dcff9 Sort by article length (#8119)
* Sort by article length
fix https://github.com/FreshRSS/Extensions/issues/378
Very basic using simply SQL `LENGTH()` function.

<img width="492" height="217" alt="image" src="https://github.com/user-attachments/assets/7cf37303-76c8-4411-b8b1-075e81535b60" />

* Improve content length retrieval
2025-10-16 21:15:44 +02:00
Alexandre Alapetite
e070c3ed2b Implement search form (#8103)
* Add UI for advanced search
To help users with the seach operators.
Obviously not as powerful as a manually-written search query.
Lack in particular negation and logical *and* for now, but I might try to do something about it.

<img width="939" height="1438" alt="image" src="https://github.com/user-attachments/assets/0bcad39b-eff3-4f44-876b-a2552af2af00" />

* Consistency: allow multiple user queries like S:1,2

* Fix user query and add tests
2025-10-15 00:08:40 +02:00
Alexandre Alapetite
b7bd18148e Option to show user labels instead of tags in RSS share (#8112)
* Option to show user labels instead of tags in RSS share
fix https://github.com/FreshRSS/FreshRSS/discussions/8108#discussioncomment-14668813

<img width="711" height="182" alt="image" src="https://github.com/user-attachments/assets/8effb2cd-fffb-4f00-b628-54e963e8b2dc" />
2025-10-14 15:43:43 +02:00
Alexandre Alapetite
5eba322cbd New stats overview of dates with most unread articles (#8089)
New view with direct links to dates with most unread articles:

<img width="734" height="581" alt="image" src="https://github.com/user-attachments/assets/159a39b3-3a06-4ae9-9cc0-62ae36d9db9c" />
2025-10-14 11:05:17 +02:00
Alexandre Alapetite
20ecbeb09c Fix drag&drop of user query losing information (#8113)
* Fix drag&drop of user query losing information
Information about RSS sharing was lost after a drag&drop

* Fix related type cast
2025-10-14 11:01:23 +02:00
Federico Scodelaro
673067a52d Last user modified (#7886)
* feat: Add user modified functionality

Closes https://github.com/FreshRSS/FreshRSS/issues/7862

Changes proposed in this pull request:

This is an implementation of the proposed feature. It allows entries to have a new field that will be updated whenever an item is marked as read/unread or bookmark/removed from bookmarks. And a new sort criteria to sort by it.

How to test the feature manually:

1. Mark items from a feed as read/unread
2. Mark items from a feed as bookmark / remove bookmark
3. Sort by the new criteria

* feat: Add sort functionality
* feat: Add sort nav button
* fix: Use correct migrations
* fix: Add internationalization
* fix: Linter errors
* chore: PR comments

* Update app/i18n/fr/index.php
Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>

* Update app/i18n/pl/index.php
Co-authored-by: Inverle <inverle@proton.me>

* Update app/i18n/nl/index.php
Co-authored-by: Frans de Jonge <fransdejonge@gmail.com>

* make fix-all
* Fixes
* More fixes sort
* Fix wrong index
* Fix unneeded column
* Fix auto-create indexes
* Some copilot suggestions
* One more fix
Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>

---------

Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>
Co-authored-by: Inverle <inverle@proton.me>
Co-authored-by: Frans de Jonge <fransdejonge@gmail.com>
2025-10-11 00:43:38 +02:00
Alexandre Alapetite
57e1a375cb Strengthen some crypto (#8061)
For login, tokens, nonces
2025-10-04 14:32:18 +02:00
maTh
2bcc090622 configurable notification timeout (#7942)
Ref #7931
Ref #5466
Ref #6409

added configuration in "Display"
<img width="636" height="167" alt="grafik" src="https://github.com/user-attachments/assets/7bbc9f26-d91b-4dd2-b715-1d3f9b7a9ad3" />

* i18n: fr

* Update app/i18n/pl/conf.php

Co-authored-by: Inverle <inverle@proton.me>

* make fix-all

* max()

* Minor whitespace
(I am not a fan of excessive vertical indenting)

---------

Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>
Co-authored-by: Inverle <inverle@proton.me>
2025-10-01 10:48:07 +02:00
Alexis Degrugillier
72884813e1 Add hook enums (#8036)
- add an enum to handle hook types (enum are available since PHP 8.1)
- change hook calls from string value to enum value
2025-09-30 22:59:41 +02:00
Inverle
bf6e634e04 Fix autocomplete issues in change password form (#7812)
## Screenshots

<details>
<summary>Before</summary>

<img width="773" height="652" alt="image" src="https://github.com/user-attachments/assets/89a0e58c-8c4a-41ff-b5d6-3e916079d563" />

</details>

<details>
<summary>After</summary>

<img width="1006" height="646" alt="image" src="https://github.com/user-attachments/assets/f4575103-7365-4870-a170-2742bf10eb27" />

</details>

This is an example on Firefox, where the `Master authentication token` field was incorrectly being autofilled.
Red borders are indicating that the fields are required.

## List of changes

* `required="required"` is now being added to the password fields if the section is open
* The `challenge` field is being added if section is open instead of when at least one of the password fields isn't empty due to autocomplete
* Added `autocomplete="new-password"` on fields that shouldn't be autocompleted
   * Unfortunately Chrome requires a workaround with CSS
   * Not tested on Safari yet
* User will be redirected to profile page after successfully changing their password instead of index page

## How to test

Autocomplete related changes should be tested on a HTTPS page with saved credentials for FreshRSS
2025-09-30 10:12:15 +02:00
Inverle
11e6e0394c Fix more CSRFs (#8035)
Follow-up of #8000 

Some were still missed in `feedController`.
even had comments but no check:

0d463b67bd/app/Controllers/feedController.php (L1053-L1055)

0d463b67bd/app/Controllers/feedController.php (L374-L376)
2025-09-29 23:52:19 +02:00
Inverle
f8b2b8c415 Prevent logout CSRFs (#7999)
By avoiding `FreshRSS_Context::initUser()` calls
2025-09-25 21:52:29 +02:00
Inverle
f612a560d2 Fix some CSRFs (#8000)
In two bookmark actions and one in `entryController`

Completes one TODO from #7923:

de624dc8ce/app/Controllers/entryController.php (L257)

(a POST request is already sent in the frontend)
2025-09-24 12:13:40 +02:00
Alexandre Alapetite
bc3e4c8fa4 Add option for CSP frame-ancestors (#7857)
* Add option for CSP frame-ancestors
https://github.com/FreshRSS/FreshRSS/discussions/7856

* Revert contentSelectorPreviewAction

* Same for f.php and api

* Fix double init in f.php

* No sandbox for API page
2025-09-21 13:29:58 +02:00
Inverle
f2c6942a60 Move update one step before (#7989)
Closes https://github.com/FreshRSS/FreshRSS/issues/7897
2025-09-21 12:40:40 +02:00
KleinMann
d670bf1e72 Add entry_before_update and entry_before_add hooks (#7977)
Discussion: https://github.com/FreshRSS/FreshRSS/discussions/7973

Changes proposed in this pull request:

- Add new extension hook "entry_before_add"
- Add new extension hook "entry_before_update"

How to test the feature manually:

1. Create extension that uses the hooks and confirm they are invoked correctly.

Extension to use for testing
https://github.com/rnkln/freshrss-xExtension-Discord/pull/2
2025-09-18 23:44:17 +02:00
Alexandre Alapetite
b5ee1d8936 Keep sort and order after marking as read (#7974)
fix https://github.com/FreshRSS/FreshRSS/issues/7867
2025-09-17 14:03:00 +02:00
Alexandre Alapetite
f8310a587c Clarify: Visibility hidden vs. archived (#7970)
fix https://github.com/FreshRSS/FreshRSS/issues/7887
We have two concepts: how much a feed is shown or not (controlled by priority), and how often a feed is refreshed (or not, in which case it is archived).
This PR removes the wording *Archived* from the *visibility* parameter, since this is not what it does.
2025-09-15 23:43:46 +02:00
Inverle
ddb51c0e95 Fix another user self-delete regression (#7877)
Regression from #7763 
Earlier regression which was fixed before #7626

In addition:
* get rid of `data-toggle` (refactor)
* show invalid login message if deleting account and entered incorrect password instead of redirect to 403
* remove unused reference to `r` parameter
* `forgetOpenCategories()` on login not on any crypto form
2025-09-15 22:17:14 +02:00
Alexandre Alapetite
29446a29f5 Recovery: skip broken entries during CLI export/import (#7949)
* Recovery: skip broken entries during CLI export/import
fix https://github.com/FreshRSS/FreshRSS/discussions/7927

```
25605/25605 (48 broken)
```

Help with *database malformed* or other corruption.

* Compatibility multiple databases
2025-09-14 22:36:01 +02:00
Inverle
087df1e5d9 Use Minz_Translate::exists() for language check in createUser() (#7934)
(consistency)
Related / follow-up: #7878
2025-09-09 23:11:38 +02:00
Alexis Degrugillier
6ad625812a Add a default language constant (#7933)
This replace the use of `en` through out the code.
2025-09-09 22:01:04 +02:00
Alexis Degrugillier
23ba48c71f Change how files are included (#7916)
1. `include`, `include_once`, `require` and `require_once` are expressions not functions, parentheses are not necessary.
2. to move up the directory tree, it's better to use the `dirname` function instead of relying on `/..`.
2025-09-05 15:56:46 +02:00
Inverle
858616f075 Fixes for no-cache.txt (#7907)
* Closes and fixes error from #7885
* `no-cache.txt` is now respected in `f.php`, `ext.php` and `serve` action in `extensionController`
   * And in all other places that weren't checking for `no-cache.txt` (some extensions maybe)
2025-09-05 08:16:52 +02:00
Alexis Degrugillier
b2a82b64b5 fix: add validation when creating a new tag (#7890)
A tag name must be unique and can't be used as a category. There were no error message when creating a tag identical to an existing category. Now, this is addressed.

See #7686

Closes #7686

Changes proposed in this pull request:

- add validation on tag creation

How to test the feature manually:

1. create a new category (ex: `HW`)
2. create a new tag with the same name as the new category (ex: `HW`)
3. validate that the appropriate error message is displayed
2025-09-01 23:29:54 +02:00