FreshRSS

mirror of https://github.com/FreshRSS/FreshRSS.git synced 2026-02-05 19:11:06 -05:00

Files

Inverle 6549932d59 Disallow setting non-existent theme (#7722 )

Related: https://github.com/FreshRSS/xExtension-Demo/pull/2, https://github.com/FreshRSS/FreshRSS/pull/7559#issuecomment-2858083635

Mostly to make sure that no one is able to break the demo instance
But the issues below could possibly be exploited in other scenarios too:
* Setting a theme like `../../lib/core-extensions/UserJS`: this directory contains `metadata.json` like themes do, so FreshRSS treats it as a theme after setting it and doesn't load any CSS
* Setting a theme like `x dropdown-menu`: the `dropdown-menu` class was able to get injected into the `<body>` element since https://github.com/FreshRSS/FreshRSS/pull/7559 and turn every page blank

2025-07-07 23:32:35 +02:00

apiController.php

Upgrade to PHP 8.1 (#6711 )

2024-09-06 09:06:46 +02:00

authController.php

Use HTTP POST for logout (#7489 )

2025-04-05 23:15:37 +02:00

categoryController.php

Fix issue where $keepMax is defaulted to const when non-zero value is compared. (#7416 )

2025-03-07 23:29:27 +01:00

configureController.php

Disallow setting non-existent theme (#7722 )