FreshRSS (Customized)/app/Models/Auth.php, branch 1.18.0

Avoid manual initialisations of system or user configuration (#3070)

2021-01-02T20:20:19+00:00

* Avoid manual intialisations of system or user configuration More consistent use of Context * Simplify FreshRSS_Context::initUser * Remove a few manual get_user_configuration * A bit of debugging * Fix context user init * Fix install * Fix concurrency Concurrent requests could lead to bad race condition * Fix actualize cron Fix case when system i initialised several times

Add a file for each Auth class (#3298)

2020-12-28T15:44:32+00:00

It's a follow-up of what was started in #3297.

Auto-renew cookie (#3287)

2020-12-28T12:09:57+00:00

#fix https://github.com/FreshRSS/FreshRSS/issues/3169#issuecomment-685983797 Supplement https://github.com/FreshRSS/FreshRSS/pull/3170 When we get the long-term login cookie (i.e. when starting a new session), renew it at the same time for the same duration

bump default logout from 30 days to 3 months (#3170)

2020-12-26T22:40:24+00:00

* bump default logout from 30 to 365 days * * Change cookie duration to constant * Change cookie duration to three months * use class * use 90 days (otherwise login form says 91.3 days) * change class * also this works now Co-authored-by: Martin Rys Co-authored-by: Frans de Jonge

Minz allow parallel sessions (#3096)

2020-10-06T21:19:45+00:00

* Minz allow parallel sessions #fix https://github.com/FreshRSS/FreshRSS/issues/3093 * Array optimisation * Array optimisation missing * Reduce direct access to $_SESSION except in install process * Fix session start headers warning * Use cookie only the first time the session is started: `PHP Warning: session_start(): Cannot start session when headers already sent in /var/www/FreshRSS/lib/Minz/Session.php on line 39` * New concept of volatile session for API calls Optimisation: do not use cookies or local storage at all for API calls without a Web session Fix warning: ``` PHP Warning: session_destroy(): Trying to destroy uninitialized session in Unknown on line 0 ``` * Only call Minz_Session::init once in our index It was called twice (once indirectly via FreshRSS->init()) * Whitespace * Mutex for notifications Implement mutex for notifications https://github.com/FreshRSS/FreshRSS/pull/3208#discussion_r499509809 * Typo * Install script is not ready for using Minz_Session

Add auto-registration when using http_auth (#3003)

2020-06-19T21:01:19+00:00

* Add auto-registration when using http_auth * Document HTTP auth auto-registration * Check email variable for HTTP auth auto-registration * Auto-create HTTP users by default * Fix Context init (I will provide in another PR a better fix requiring a bit of global refactoring) * Init language Co-authored-by: Alexandre Alapetite

A wrong login must return HTTP 403 (#2903)

2020-04-17T08:56:06+00:00

* A wrong login must produce HTTP 403 #fix https://github.com/FreshRSS/FreshRSS/issues/2901 https://github.com/FreshRSS/FreshRSS/pull/2794/files#r389319248 * Just for consistency

fix: Make sure to have user conf in hasAccess (#2769)

2020-01-16T13:25:51+00:00

The `FreshRSS_Auth::hasAccess` method is called during auth initialization (`app/FreshRSS.php:78`), only for `user#create` action. However, at this step, the `user` configuration namespace hasn't be initialized yet, and so users weren't able to register because of the exception... quite critical!

Add an admin flag on users (#2709)

2020-01-06T19:28:04+00:00

Now FRSS supports more than one admin. Admins have the same rights as the default user. Admins can promote or demote other users. The default user is considered as an admin even if it does not have the admin flag enabled. See #2096

Require PHP 5.5+ (#2495)

2019-08-20T12:55:43+00:00

* Require PHP 5.5+ https://github.com/FreshRSS/FreshRSS/issues/2469#issuecomment-522255093 I think it would be reasonable to require PHP 5.5+ for the core of FreshRSS after all. As Frenzie said, WordPress currently requires PHP 5.6.20+, and it is the most popular PHP application. We would loose about 20% of the PHP servers according to https://w3techs.com/technologies/details/pl-php/5/all but I expect this number to drop fast after the release of CentOS 8 (CentOS accounts for 17% of Linux servers https://w3techs.com/technologies/details/os-linux/all/all ). Distributions: * no impact on Ubuntu, Fedora, Alpine, OpenWRT, FreeBSD, OpenSuze, Mageia, as all active versions have PHP > 7 * no impact on OpenSuze, Synology, as all active versions have PHP > 5.5 * we drop Debian 8 Jessie (-2020) - we keep supporting Debian 9 Stretch (2017-06) - current is Debian 10 Buster * we drop Red Hat 7 (-2024) - we keep supporting RHEL 8 (2019-05) * we drop CentOS 7 (-2024) - we will support CentOS 8 (to be released soonish) When dropping older versions, I can better like when it is for a good reason, and there is actually one with PHP 5.5, namely generators (yield) https://php.net/language.generators.overview which I consider using. * Version note for JSON.php * hex2bin * Update .travis.yml Co-Authored-By: Frans de Jonge