0 Fork 0

mirror of https://github.com/FreshRSS/FreshRSS.git synced 2026-10-28 14:08:45 -04:00

Files

T

GigiandAlexandre Alapetite 6780afe846 Reject token access (RSS/OPML export, feed refresh) for disabled accounts (CWE-613) (#9336 )

* auth: reject token access for disabled accounts (CWE-613)

Minz_Request::tokenIsOk() validated the per-user token but never checked that
the account is enabled, so a disabled user's token still authorised RSS/OPML
export and feed refresh (c=feed&a=actualize). Session-based access already
enforces `enabled` in FreshRSS_Auth::giveAccess(); apply the same check to
token validation. Re-enabling the account restores token access as expected,
so no token rotation is needed.

* Reduce comments

---------

Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>

2026-09-19 22:44:42 +02:00

core-extensions

Redirect after saving user CSS/JS so changes apply immediately (#9006 )

2026-07-09 16:37:49 +02:00

marienfressinaud/lib_opml

Fix LibOPML warnings (#8652 )

2026-05-15 12:12:28 +02:00

Minz

Reject token access (RSS/OPML export, feed refresh) for disabled accounts (CWE-613) (#9336 )

2026-09-19 22:44:42 +02:00

phpgt/cssxpath

CSSXPath 1.5.0 (#8642 )

2026-03-29 11:39:52 +02:00

phpmailer/phpmailer

chore(deps): update phpmailer/phpmailer requirement from 7.0.2 to 7.1.1 in /lib (#8907 )

2026-06-03 13:06:28 +02:00

simplepie/simplepie

SimplePie: Harden cache deserialization calls (#9273 )

2026-09-08 23:36:59 +02:00

.gitignore

Fix LibOPML warnings (#8652 )

2026-05-15 12:12:28 +02:00

.htaccess

Apache protect more non-public folders and files (#6881 )

2024-10-11 09:25:43 +02:00

composer.json

SimplePie: Harden cache deserialization calls (#9273 )

2026-09-08 23:36:59 +02:00

favicons.php

Add checkUrl() to favicon functions (#8714 )

2026-04-23 15:01:07 +02:00

http-conditional.php

Fix minor backslashes (#8292 )

2025-12-07 20:27:06 +01:00

index.html

Apache protect more non-public folders and files (#6881 )

2024-10-11 09:25:43 +02:00

lib_date.php

Fix all broken links in the entire repository (#9207 )

2026-08-19 16:19:21 +02:00

lib_install.php

Check GMP during 32-bit installation (#9046 )

2026-07-18 21:54:36 +02:00

lib_rss.php

Fix all broken links in the entire repository (#9207 )

2026-08-19 16:19:21 +02:00

README.md

Allow SimplePie updates with composer (#4374 )

2024-09-14 23:11:10 +02:00

README.md

Libraries

SimplePie

FreshRSS uses a forked version of SimplePie, with a number of patches.

See the read-me of our fork.

Updating libraries

Some of the libraries in this folder can be updated semi-automatically by invoking:

cd ./FreshRSS/lib/
composer update --no-autoloader

Remember to read the change-logs, proof-read the changes, preserve possible local patches, add irrelevant files to .gitignore (minimal installation), and test before committing.