mirror of
https://github.com/FreshRSS/FreshRSS.git
synced 2026-02-06 11:31:08 -05:00
7df6c201f2
* Puts CSP everywhere in `p/api`
* including the HTML query page ❗
* Also in `p/ext.php`
* Puts `X-Content-Type-Options: nosniff` everywhere
* Fixes custom icon configuration not showing `blob:` icon in statsController (idle feeds)
* Also removes `style-src 'unsafe-inline'` since it doesn't seem to be needed
* Improves CSP of `p/f.php`
* Add `sandbox` directive
54 lines
1.4 KiB
PHP
54 lines
1.4 KiB
PHP
<?php
|
|
declare(strict_types=1);
|
|
header("Content-Security-Policy: default-src 'self'; frame-ancestors 'none'");
|
|
header('X-Content-Type-Options: nosniff');
|
|
?>
|
|
<!DOCTYPE html>
|
|
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-GB" lang="en-GB">
|
|
<head>
|
|
<meta charset="UTF-8" />
|
|
<title>FreshRSS API endpoints</title>
|
|
<meta name="robots" content="noindex" />
|
|
<link rel="start" href="../i/" />
|
|
<script src="../scripts/api.js" defer="defer"></script>
|
|
<script id="jsonVars" type="application/json">
|
|
<?php
|
|
require(__DIR__ . '/../../constants.php');
|
|
require(LIB_PATH . '/lib_rss.php'); //Includes class autoloader
|
|
FreshRSS_Context::initSystem();
|
|
echo json_encode([
|
|
'greader' => Minz_Url::display('/api/greader.php', 'php', true),
|
|
'fever' => Minz_Url::display('/api/fever.php', 'php', true),
|
|
]);
|
|
?>
|
|
</script>
|
|
</head>
|
|
|
|
<body>
|
|
<h1>FreshRSS API endpoints</h1>
|
|
|
|
<h2>Google Reader compatible API</h2>
|
|
<dl>
|
|
<dt>Your API address:</dt>
|
|
<dd><?= Minz_Url::display('/api/greader.php', 'html', true) ?></dd>
|
|
<dt>Google Reader API configuration test:</dt>
|
|
<dd id="greaderOutput">?</dd>
|
|
</dl>
|
|
|
|
<h2>Fever compatible API</h2>
|
|
<dl>
|
|
<dt>Your API address:</dt>
|
|
<dd><?= Minz_Url::display('/api/fever.php', 'html', true) ?></dd>
|
|
<dt>Fever API configuration test:</dt>
|
|
<dd id="feverOutput">?</dd>
|
|
</dl>
|
|
|
|
<h2>API for extensions</h2>
|
|
<dl>
|
|
<dt>Your API address:</dt>
|
|
<dd><?= Minz_Url::display('/api/misc.php/Extension%20name/', 'html', true) ?></dd>
|
|
</dl>
|
|
|
|
</body>
|
|
</html>
|