FreshRSS (Customized)/lib/lib_rss.php, branch 1.26.2

Fix file serving for symlinked extensions (#7545)

2025-05-02T07:47:57+00:00

* Fix file serving for symlinked extensions from ext.php * Don't resolve symlink when deleting extension * Minor syntax --------- Co-authored-by: Alexandre Alapetite

HTTP Auth disallow multiple headers (#7528)

2025-04-28T20:51:54+00:00

When using HTTP Auth methods (including OpenID Connect), exactly 1 HTTP header should be received, not more.

SimplePie forbit formaction attribute (#7506)

2025-04-12T22:01:09+00:00

Sanitize buttons with a form or formaction attribute.

Web scraping forbid security headers in cURL (#7496)

2025-04-07T06:33:13+00:00

Prevent using `Remote-User`, `X-WebAuth-User` during Web scraping.

Disallow iframe srcdoc for now (#7494)

2025-04-05T22:47:45+00:00

We do not sanitize this attribute well enough, so striped for now. It is rarely used: I have not seen any use of it in any of my many test feeds. Can be added back when we can handle its inherent security issues better.

Referrer-Policy: same-origin (#6303)

2025-04-01T10:23:56+00:00

* Referrer-Policy: same-origin * same-origin for our own images --------- Co-authored-by: Alexandre Alapetite

Doc force-https (#7259)

2025-01-26T22:19:44+00:00

* Doc force-https https://github.com/FreshRSS/FreshRSS/discussions/7252#discussioncomment-11951183 * Forgotten ^ * More proper support for comments

Improve cURL proxy options (#7231)

2025-01-25T08:14:08+00:00

3 is now used for CURLPROXY_HTTPS2 https://github.com/curl/curl/blob/f07612cd9ae1ec50b9bedd749171ad75203c9e7e/include/curl/curl.h#L789 Related to https://github.com/FreshRSS/FreshRSS/issues/7209

Add some missing PHP native types (#7191)

2025-01-08T12:26:09+00:00

* Add some missing PHP native types Replaces https://github.com/FreshRSS/FreshRSS/pull/7184 * Clean some types

PHPStan 2.0 (#7131)

2024-12-27T11:12:49+00:00

* PHPStan 2.0 fix https://github.com/FreshRSS/FreshRSS/issues/6989 https://github.com/phpstan/phpstan/releases/tag/2.0.0 https://github.com/phpstan/phpstan/blob/2.0.x/UPGRADING.md * More * More * Done * fix i18n CLI * Restore a PHPStan Next test For work towards PHPStan Level 10 * 4 more on Level 10 * fix getTagsForEntry * API at Level 10 * More Level 10 * Finish Minz at Level 10 * Finish CLI at Level 10 * Finish Controllers at Level 10 * More Level 10 * More * Pass bleedingEdge * Clean PHPStan options and add TODOs * Level 10 for main config * More * Consitency array vs. list * Sanitize themes get_infos * Simplify TagDAO->getTagsForEntries() * Finish reportAnyTypeWideningInVarTag * Prepare checkBenevolentUnionTypes and checkImplicitMixed * Fixes * Refix * Another fix * Casing of __METHOD__ constant