0 Fork 0

mirror of https://github.com/FreshRSS/FreshRSS.git synced 2026-10-28 14:08:45 -04:00

Files

T

tomac4tandInverle 859a2ad039 Fix local DNS leak when fetching feeds through a proxy (#9451 )

* Fix local DNS leak when fetching feeds through a proxy

Follow-up to #9390: `getRetryAfterFile()` passed the full URL to
`Minz_Request::serverIsPublic()`, which then resolved the target hostname
with the local resolver (`dns_get_record()`), even when a proxy was
configured. With a socks5h/socks4a proxy this leaks the target hostname
to the local DNS and defeats remote name resolution.

- `Minz_Request::serverIsPublic()`: add an `$allowDnsResolve` parameter,
  and forward it to the recursive call so the guard holds for the whole
  recursion.
- `FreshRSS_http_Util::getRetryAfterFile()`: do not resolve the host name
  when a proxy is configured (`$proxy === ''`), since the proxy is
  responsible for DNS.

---------

Co-authored-by: Inverle <inverle@proton.me>

2026-10-17 17:37:27 +02:00

core-extensions

Document how to use the User CSS and User JS core extensions (#9424 )

2026-10-09 23:04:22 +02:00

marienfressinaud/lib_opml

Fix LibOPML warnings (#8652 )

2026-05-15 12:12:28 +02:00

Minz

Fix local DNS leak when fetching feeds through a proxy (#9451 )

2026-10-17 17:37:27 +02:00

phpgt/cssxpath

Update to GT\CssXPath 1.6.0 (#9411 )

2026-10-05 21:44:57 +02:00

phpmailer/phpmailer

chore(deps): update phpmailer/phpmailer requirement from 7.0.2 to 7.1.1 in /lib (#8907 )

2026-06-03 13:06:28 +02:00

simplepie/simplepie

Sanitizer: block data: URI scheme while keeping data:image for images (#9417 )

2026-10-11 20:36:09 +02:00

.gitignore

Fix LibOPML warnings (#8652 )

2026-05-15 12:12:28 +02:00

.htaccess

Apache protect more non-public folders and files (#6881 )

2024-10-11 09:25:43 +02:00

composer.json

Fix local DNS leak when fetching feeds through a proxy (#9451 )

2026-10-17 17:37:27 +02:00

favicons.php

Add checkUrl() to favicon functions (#8714 )

2026-04-23 15:01:07 +02:00

http-conditional.php

Fix minor backslashes (#8292 )

2025-12-07 20:27:06 +01:00

index.html

Apache protect more non-public folders and files (#6881 )

2024-10-11 09:25:43 +02:00

lib_date.php

Fix all broken links in the entire repository (#9207 )

2026-08-19 16:19:21 +02:00

lib_install.php

Check GMP during 32-bit installation (#9046 )

2026-07-18 21:54:36 +02:00

lib_rss.php

Update to GT\CssXPath 1.6.0 (#9411 )

2026-10-05 21:44:57 +02:00

README.md

Allow SimplePie updates with composer (#4374 )

2024-09-14 23:11:10 +02:00

README.md

Libraries

SimplePie

FreshRSS uses a forked version of SimplePie, with a number of patches.

See the read-me of our fork.

Updating libraries

Some of the libraries in this folder can be updated semi-automatically by invoking:

cd ./FreshRSS/lib/
composer update --no-autoloader

Remember to read the change-logs, proof-read the changes, preserve possible local patches, add irrelevant files to .gitignore (minimal installation), and test before committing.