FreshRSS

0 Fork 0

mirror of https://github.com/FreshRSS/FreshRSS.git synced 2026-09-13 14:09:18 -04:00

Files

T

Ali GündoğarandAlexandre Alapetite 970b135190 Ignore security-relevant OPML attributes for dynamic OPML sources (#9276 )

* Ignore security-relevant OPML attributes for dynamic OPML sources

OPML content can come from an untrusted source (a dynamic OPML category re-fetches its remote content on every refresh cycle). Such content must not be able to configure feed cURL parameters (CURLOPT_COOKIE, CURLOPT_PROXY, CURLOPT_POSTFIELDS, etc.) nor create further dynamic OPML categories. importOpml() therefore defaults to untrusted, and the local file import controller explicitly opts in.

* Review

---------

Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>

2026-09-09 16:11:38 +02:00

apiController.php

configurable notification timeout (#7942 )

2025-10-01 10:48:07 +02:00

authController.php

Fix auth CSRFs (login and register actions) (#9171 )

2026-09-08 09:19:01 +02:00

categoryController.php

New option to hide badges showing number of unread articles (#8844 )

2026-05-20 20:25:20 +02:00

configureController.php

Offer to add a prefix when resharing user labels (#9236 )