FreshRSS (Customized)/p/api, branch 1.27.1

Add option for CSP frame-ancestors (#7857)

2025-09-21T11:29:58+00:00

* Add option for CSP frame-ancestors https://github.com/FreshRSS/FreshRSS/discussions/7856 * Revert contentSelectorPreviewAction * Same for f.php and api * Fix double init in f.php * No sandbox for API page

Translate the API information page (#7922)

2025-09-10T05:04:17+00:00

Closes #6222 Translate the `api/index.php` page * Update app/i18n/pl/api.php Co-authored-by: Inverle * Update app/i18n/de/api.php Co-authored-by: maTh <1645099+math-GH@users.noreply.github.com> * i18n: fr * Co-authored-by: Alexandre Alapetite --------- Co-authored-by: Inverle Co-authored-by: maTh <1645099+math-GH@users.noreply.github.com> Co-authored-by: Alexandre Alapetite

Change how files are included (#7916)

2025-09-05T13:56:46+00:00

1. `include`, `include_once`, `require` and `require_once` are expressions not functions, parentheses are not necessary. 2. to move up the directory tree, it's better to use the `dirname` function instead of relying on `/..`.

Fixes for no-cache.txt (#7907)

2025-09-05T06:16:52+00:00

* Closes and fixes error from #7885 * `no-cache.txt` is now respected in `f.php`, `ext.php` and `serve` action in `extensionController` * And in all other places that weren't checking for `no-cache.txt` (some extensions maybe)

Put CSP everywhere (#7810)

2025-08-11T17:35:54+00:00

* Puts CSP everywhere in `p/api` * including the HTML query page ❗ * Also in `p/ext.php` * Puts `X-Content-Type-Options: nosniff` everywhere * Fixes custom icon configuration not showing `blob:` icon in statsController (idle feeds) * Also removes `style-src 'unsafe-inline'` since it doesn't seem to be needed * Improves CSP of `p/f.php` * Add `sandbox` directive

GReader API: fix incorrect favicon URL (#7792)

2025-08-06T10:32:16+00:00

* GReader API: fix incorrect favicon URL * Fix compatibility with custom favicons --------- Co-authored-by: Alexandre Alapetite

WebSub: only perform a redirect when coming from WebSub (#7738)

2025-07-19T20:52:06+00:00

And add support for HTTP Link header for "self" URL Changing URL based on "self" URL will only be done when coming from a WebSub push fix https://github.com/FreshRSS/FreshRSS/issues/7737

Fix HTML queries with a single feed (#7730)

2025-07-14T07:53:37+00:00

* Fix HTML queries with single feed * Suggestion

API add support for states in `s` streamId (#7695)

2025-06-29T12:11:02+00:00

https://github.com/Ashinch/ReadYou/issues/1081#issuecomment-3009682580 Some other implementations allow `s` to target states: * https://www.inoreader.com/developers/stream-ids * https://github.com/theoldreader/api/blob/master/README.md#item-ids * https://feedhq.readthedocs.io/en/latest/api/reference.html#stream-items-ids I find this behaviour redundant with `it`, but for the sake of compatibility

Add API endpoint for extensions (#7576)

2025-06-02T22:16:17+00:00

* Add API endpoint for extensions Useful for https://github.com/FreshRSS/FreshRSS/issues/7572 * Support PATH_INFO Now also support being invoked like `/api/misc.php/Extension%20Name/` * More documentation