FreshRSS (Customized)/app/Controllers/configureController.php, branch 1.27.1

Fix some CSRFs (#8000)

2025-09-24T10:13:40+00:00

In two bookmark actions and one in `entryController` Completes one TODO from #7923: https://github.com/FreshRSS/FreshRSS/blob/de624dc8ce63ec819c61216d9d44f828841c293e/app/Controllers/entryController.php#L257 (a POST request is already sent in the frontend)

Add a default language constant (#7933)

2025-09-09T20:01:04+00:00

This replace the use of `en` through out the code.

Disallow setting non-existent language (#7878)

2025-08-30T14:26:24+00:00

The set language is used inside paths and can lead to issues by including PHP files from other locations

PHPStan: finalise strictArrayFilter (#7794)

2025-08-07T20:19:45+00:00

As well as reportPossiblyNonexistentConstantArrayOffset. And disable PHPStan-next from GitHub Action, since the work is completed for now.

Fix no registration limit setting (#7751)

2025-07-24T05:59:00+00:00

Disallow setting non-existent theme (#7722)

2025-07-07T21:32:35+00:00

Related: https://github.com/FreshRSS/xExtension-Demo/pull/2, https://github.com/FreshRSS/FreshRSS/pull/7559#issuecomment-2858083635 Mostly to make sure that no one is able to break the demo instance But the issues below could possibly be exploited in other scenarios too: * Setting a theme like `../../lib/core-extensions/UserJS`: this directory contains `metadata.json` like themes do, so FreshRSS treats it as a theme after setting it and doesn't load any CSS * Setting a theme like `x dropdown-menu`: the `dropdown-menu` class was able to get injected into the `` element since https://github.com/FreshRSS/FreshRSS/pull/7559 and turn every page blank

Exposed the reading modes for extensions through Minz (#7668)

2025-06-21T22:36:32+00:00

* + Exposed the reading modes for extensions through Minz. Now extensions can add a custom view mode. Graceful fallback to normal view in case the extension was disabled without resetting the view_mode through the uninstall method. In that case the user will be informed via Minz_Request::setBadNotification that the view has been reset to normal. + Added translation strings for de, en and en-us for the notification * + Added missing, generated translations * Simplify indexAction, performance * Minor settings htmlspecialchars * i18n: fr * Minor wording * Doc * Fix i18n --------- Co-authored-by: Alexandre Alapetite

Fix remove last share (#7613)

2025-05-25T11:05:23+00:00

fix https://github.com/FreshRSS/FreshRSS/issues/7612

Make update URL readonly (#7477)

2025-04-01T15:54:52+00:00

The security risks look higher than the minor convinience Modify https://github.com/FreshRSS/FreshRSS/pull/1024

Mark as read button: config for the size (#7314)

2025-03-13T22:10:48+00:00

* settings * i18n: mark_read_button * big, small, none * fix * Fixes * make fix-all --------- Co-authored-by: Alexandre Alapetite