FreshRSS (Customized)/p, branch 1.27.0 Customized version of FreshRSS, a self-hosted RSS feed aggregator https://git.rdnlsmith.com/fresh-rss-custom/atom?h=1.27.0 2025-08-11T19:23:50+00:00 Fix chart.js support for SeaMonkey (#7816) 2025-08-11T19:23:50+00:00 Inverle inverle@proton.me 2025-08-11T19:23:50+00:00 urn:sha1:18536409c02f38c6017ed5ca9a81aa84a0b5654b SeaMonkey support was broken by #7752 Reproduce JS file: ```bash git clone https://github.com/chartjs/Chart.js && \ cd Chart.js && \ git checkout tags/v4.5.0 && \ sed -i 's/es2022/es2021/g' rollup.config.js && \ pnpm install && \ pnpm run build && \ sha256sum dist/chart.umd.min.js # SHA256 of dist/chart.umd.min.js should be: 311a5a5e0db077a787b782977f359a72f8584f94d800e324dcc6aefe8a006dd7 ``` Put CSP everywhere (#7810) 2025-08-11T17:35:54+00:00 Inverle inverle@proton.me 2025-08-11T17:35:54+00:00 urn:sha1:7df6c201f2e6a6521d20718dfd8d9794c7437d1f * Puts CSP everywhere in `p/api` * including the HTML query page ❗ * Also in `p/ext.php` * Puts `X-Content-Type-Options: nosniff` everywhere * Fixes custom icon configuration not showing `blob:` icon in statsController (idle feeds) * Also removes `style-src 'unsafe-inline'` since it doesn't seem to be needed * Improves CSP of `p/f.php` * Add `sandbox` directive Show warning when unsafe CSP policy is in use (#7804) 2025-08-09T19:47:39+00:00 Inverle inverle@proton.me 2025-08-09T19:47:39+00:00 urn:sha1:2b85a50ed72982ab0c0f9ef98c7ed1e15f21bf5f * Show warning when unsafe CSP policy is in use * Fix bare markdown URL * i18n: fr * Minor i18n: fr * Add target="_blank" to i18n strings --------- Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr> New JS attribute: `data-auto-leave-validation` (#7785) 2025-08-08T15:39:38+00:00 Inverle inverle@proton.me 2025-08-08T15:39:38+00:00 urn:sha1:d9197d7e32a97f29829ffd4cf4371b1853e51fa2 Instead of a repeating pattern like: `<input type="text" value="something" data-leave-validation="something">`, you can now put a `data-auto-leave-validation="1"` attribute on a `<form>` for example, and it will automatically set the `data-leave-validation` attributes inside the form elements. `data_auto_leave_validation(parent)` from `extra.js` is called on slider open and page load. --------- Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr> Co-authored-by: Frans de Jonge <fransdejonge@gmail.com> Avoid styling `<code>` inside of `<pre>` (#7797) 2025-08-08T08:50:27+00:00 James Frost git@frost.cx 2025-08-08T08:50:27+00:00 urn:sha1:d1f2e0f6be3de13a36754bb735182e8aad1ebc5f * Remove background from <code> inside <pre> This caused an ugly effect where each line has a seperate background to the whole pre block. Fixes #7796 * Add James Frost to CREDITS.md Improve sharing via Print (#7728) 2025-08-06T19:49:13+00:00 Inverle inverle@proton.me 2025-08-06T19:49:13+00:00 urn:sha1:149136fbe252cca4cb8dcdb463df135094bc0f87 List of changes: * The temporary document for printing is now in an `<iframe>` instead of a new tab * The whole `<head>` element is copied to the temporary document, except for `<script>` tags to copy over the `<meta>` tags as well * URLs that contain the instance base URL are now removed from the printed PDF * The saved filename (PDF) will now default to the article title * `<details>` is auto expanded * Styling: * The main document's `<html>` class is copied over to preserve some styling that might use those classes * Instead of writing `content_el.innerHTML` to the temporary document, `content_el.outerHTML` is now written instead to apply the styles that select `.content` * `.dropdown-menu` is now hidden in the printed document, because it can't be expanded anyway * Headers and footers are hidden in the printed document * The printed document will now display correctly all the time, by waiting for it to load before calling `print()` * Before, the stylesheets might've not finished loading and the document was broken * Better browser support on mobile for this feature * Before, the document would fail to print on Chrome Mobile Tested on: * Firefox - both desktop and mobile, works ✅ * Chrome - both desktop and mobile, works ✅ * Opera - desktop, works (same as Chrome) ✅ * Brave - both desktop and mobile (same as Chrome), works ✅ * Safari - both desktop and mobile, works✅ * Microsoft Edge - both desktop and mobile, works ✅ * GNOME Web - desktop, works ✅ * SeaMonkey - desktop, works ✅ Known issues: * Images may not finish loading the first time the print dialog is opened TODO: * [x] Test on Safari * [x] Try to fix GNOME Web GReader API: fix incorrect favicon URL (#7792) 2025-08-06T10:32:16+00:00 hilariousperson 44742905+hilariousperson@users.noreply.github.com 2025-08-06T10:32:16+00:00 urn:sha1:9faf2c1fa3c8c3ed82ff4c95733a018d0f9977a7 * GReader API: fix incorrect favicon URL * Fix compatibility with custom favicons --------- Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr> Fix regression promote user (#7786) 2025-08-04T08:04:09+00:00 Alexandre Alapetite alexandre@alapetite.fr 2025-08-04T08:04:09+00:00 urn:sha1:eda66dda48c56cc4166bed12158817b7f66b4b07 Quick fix, while waiting for something better Regression from https://github.com/FreshRSS/FreshRSS/pull/7771 Rework fetch favicons (#7767) 2025-08-01T06:30:49+00:00 Alexandre Alapetite alexandre@alapetite.fr 2025-08-01T06:30:49+00:00 urn:sha1:e915ebe46ecc76bd00e19a9cc63764ff2e277315 * Use main function `httpGet()` instead of local one; * Use HTTP cache, also between users; * Do not default to feed URL when there is no website URL TODO for later: consider supporting Atom's `<icon>` and RSS 2.0's `<image>` https://github.com/FreshRSS/FreshRSS/issues/7774 Implement sudo mode / reauthentication (#7753) 2025-07-31T11:53:14+00:00 Inverle inverle@proton.me 2025-07-31T11:53:14+00:00 urn:sha1:3ce64d271b2b470bd6c9f7294946347dcdfed9b9 * Implement sudo mode / reauthentication * i18n: fr * generate flags * Improvements * Remove HMAC check * Don't require reauth to access logs when signed in as admin * Notify user of bad login via notification instead --------- Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>