mirror of
https://github.com/FreshRSS/FreshRSS.git
synced 2026-10-28 05:58:40 -04:00
5a270c02b0
* auth: rotate session ID on all authenticated transitions (session fixation) The PHP session ID was regenerated on explicit form login, reauth, logout and password change, but NOT when access is (re)established from a remember-me cookie, via HTTP authentication, or on self-registration auto-login (CWE-384), so a fixed session ID could become authenticated. Regenerate the session ID at those transitions too: in FreshRSS_Auth::init when accessControl() first grants access (covers remember-me restore and HTTP auth; skipped for auth_type 'none', which has no authentication boundary), and in the self-registration auto-login path, mirroring the existing form-login idiom. Also enable session.use_strict_mode before session_start as defence in depth so an uninitialised, attacker-supplied session ID is not adopted. * auth: avoid duplicate cookie during session rotation * Code preferences, shorten some comments --------- Co-authored-by: Inverle <inverle@proton.me> Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>
Libraries
SimplePie
FreshRSS uses a forked version of SimplePie, with a number of patches.
See the read-me of our fork.
Updating libraries
Some of the libraries in this folder can be updated semi-automatically by invoking:
cd ./FreshRSS/lib/
composer update --no-autoloader
Remember to read the change-logs, proof-read the changes, preserve possible local patches, add irrelevant files to .gitignore (minimal installation), and test before committing.