aboutsummaryrefslogtreecommitdiff
path: root/app/Controllers/authController.php
AgeCommit message (Collapse)Author
2021-12-24Fix invalid user (#4081)Gravatar Alexandre Alapetite
#fix https://github.com/FreshRSS/FreshRSS/issues/4080 Initialise the default user to be able to display the error page
2021-02-28Travis: Enforce phpcs line length + whitespace (#3488)Gravatar Alexandre Alapetite
* Update Travis line length * Also check whitespace in CSS files * Fix line length ext.php * More syntax, string templates * Fix exclude-pattern * Test JS files as well
2021-01-17Fix form login if user does not exist (#3377)Gravatar Alexandre Alapetite
Small bug from https://github.com/FreshRSS/FreshRSS/pull/3070 , leading to an exception due to not being able to log the error. Minor: Also add some very primitive mitigation of timing attacks (to find out whether a user exists or not, although I have not checked whether this might be guessed through other means) - before, if the user did not exist, the response was always measurably faster; now it is harder to tell due to the noise
2021-01-02Avoid manual initialisations of system or user configuration (#3070)Gravatar Alexandre Alapetite
* Avoid manual intialisations of system or user configuration More consistent use of Context * Simplify FreshRSS_Context::initUser * Remove a few manual get_user_configuration * A bit of debugging * Fix context user init * Fix install * Fix concurrency Concurrent requests could lead to bad race condition * Fix actualize cron Fix case when system i initialised several times
2020-10-06Minz allow parallel sessions (#3096)Gravatar Alexandre Alapetite
* Minz allow parallel sessions #fix https://github.com/FreshRSS/FreshRSS/issues/3093 * Array optimisation * Array optimisation missing * Reduce direct access to $_SESSION except in install process * Fix session start headers warning * Use cookie only the first time the session is started: `PHP Warning: session_start(): Cannot start session when headers already sent in /var/www/FreshRSS/lib/Minz/Session.php on line 39` * New concept of volatile session for API calls Optimisation: do not use cookies or local storage at all for API calls without a Web session Fix warning: ``` PHP Warning: session_destroy(): Trying to destroy uninitialized session in Unknown on line 0 ``` * Only call Minz_Session::init once in our index It was called twice (once indirectly via FreshRSS->init()) * Whitespace * Mutex for notifications Implement mutex for notifications https://github.com/FreshRSS/FreshRSS/pull/3208#discussion_r499509809 * Typo * Install script is not ready for using Minz_Session
2020-10-05Minz: Attach a notification to a request (#3208)Gravatar Alexandre Alapetite
* Minz: Attach a notification to a request Notifications should be attached to a request, not to a global session. Fix https://github.com/FreshRSS/FreshRSS/pull/3096#issuecomment-654891906 Prepare https://github.com/FreshRSS/FreshRSS/pull/3096 * Rename array * Avoid string constants Implement https://github.com/FreshRSS/FreshRSS/pull/3208#issuecomment-703243863 * Improved logic * Simplify storage https://github.com/FreshRSS/FreshRSS/pull/3208#discussion_r499511213 * Fix notification bug in configuration/system
2020-06-14Add a way to disable/enable users (#3056)Gravatar Alexis Degrugillier
If you want to block users without deleting their account, you can now disable them from the interface.
2020-06-05Add language detection when the user is not logged in (#3022)Gravatar Alexis Degrugillier
Before, when the user was not logged in, pages where translated with the '_' user language. Now, they are translated with the user preferred language if there is one supported by FreshRSS or with the system default language.
2020-04-17A wrong login must return HTTP 403 (#2903)Gravatar Alexandre Alapetite
* A wrong login must produce HTTP 403 #fix https://github.com/FreshRSS/FreshRSS/issues/2901 https://github.com/FreshRSS/FreshRSS/pull/2794/files#r389319248 * Just for consistency
2020-03-08Improve login and registration pages (#2794)Gravatar Marien Fressinaud
* Keep the user on login page on failure * Show an error if username already exists * Check the password format in the backend * Return a better message if username is invalid * Add a title to the login page * wip: Improve look of login and register pages * Set a capital M in username help message On the registration page, username tip started with a minuscule, while the password tip started with a capital. * Change message if username is taken
2019-09-18Redirect connected users accessing registration page (#2530)Gravatar Marien Fressinaud
2019-09-17Add support for terms of serviceGravatar Marien Fressinaud
This feature is optional. It is based on the presence of a `data/tos.html` file that an administrator can create. If this file exists, FreshRSS will automatically add a "ToS" checkbox on the registration page that users must check to be able to create their account.
2019-08-29Provide email address verification feature (#2481)Gravatar Marien Fressinaud
* Add an email field to the profile page I reuse the `mail_login` from the configuration. I'm not sure if it's useful today (I would say it was used when Persona login was available). A good improvement would be to rename `mail_login` into `email` so it would be more intuitive to use. * Add boolean to the conf to force email validation This commit only adds a configuration item. * Add email during registration if email must be validated * Set email token to validate when email changes * Block access to FreshRSS if email is not validated * Send email when address is changed * Allow to resend the validation email * Allow the user to change its email while blocked * Document the email validation feature * fixup! Allow the user to change its email while blocked * tec: Autoload PHPMailer lib * Validate email address format * Add feedback on validation email resend action * Allow to logout when user is blocked * fix: Change default email "from" * Reorganize i18n keys * Complete all the locales with default english * Hide sidebar (profile page) if email is not validated * Check email requirements on registration * Allow admin to specify email when creating users * Don't check email format if value is empty * Remove trailing comma in userController Co-Authored-By: Alexandre Alapetite <alexandre@alapetite.fr> * Set PHPMailer validator to html5 before sending email * fixup! Remove trailing comma in userController
2019-08-20Require PHP 5.5+ (#2495)Gravatar Alexandre Alapetite
* Require PHP 5.5+ https://github.com/FreshRSS/FreshRSS/issues/2469#issuecomment-522255093 I think it would be reasonable to require PHP 5.5+ for the core of FreshRSS after all. As Frenzie said, WordPress currently requires PHP 5.6.20+, and it is the most popular PHP application. We would loose about 20% of the PHP servers according to https://w3techs.com/technologies/details/pl-php/5/all but I expect this number to drop fast after the release of CentOS 8 (CentOS accounts for 17% of Linux servers https://w3techs.com/technologies/details/os-linux/all/all ). Distributions: * no impact on Ubuntu, Fedora, Alpine, OpenWRT, FreeBSD, OpenSuze, Mageia, as all active versions have PHP > 7 * no impact on OpenSuze, Synology, as all active versions have PHP > 5.5 * we drop Debian 8 Jessie (-2020) - we keep supporting Debian 9 Stretch (2017-06) - current is Debian 10 Buster * we drop Red Hat 7 (-2024) - we keep supporting RHEL 8 (2019-05) * we drop CentOS 7 (-2024) - we will support CentOS 8 (to be released soonish) When dropping older versions, I can better like when it is for a good reason, and there is actually one with PHP 5.5, namely generators (yield) https://php.net/language.generators.overview which I consider using. * Version note for JSON.php * hex2bin * Update .travis.yml Co-Authored-By: Frans de Jonge <fransdejonge@gmail.com>
2019-03-22Rework CSRF interaction with sessions (#2290)Gravatar Alexandre Alapetite
* Rework CSRF interaction with sessions Fix https://github.com/FreshRSS/FreshRSS/issues/2288 Improve security in some edge cases Maybe relevant for https://github.com/FreshRSS/FreshRSS/issues/2125#issuecomment-474992671 * Forgotten mime type
2019-02-13Less jQuery (#2234)Gravatar Alexandre Alapetite
* Less jQuery Follow-up of https://github.com/FreshRSS/FreshRSS/pull/2199 * Even less jQuery + global view unread title fix * Even less jQuery * Yet even less jQuery * Even less jQuery * Reduce some events * Even less jQuery * jQuery gone from main view +Fixed English i18n * Fix feed folded view * Remove Firefox 64 workaround Remove workaround for Gecko bug 1514498 in Firefox 64, fixed in Firefox 65 * Split to extra.js Avoid loading unneeded JavaScript code for the main view. + several adjustements * Improve CSS transition fold category * Rewrite shortcuts Remove library. Much faster, shorter, one listener instead of many. Control of the shortcut context. Fix https://github.com/FreshRSS/FreshRSS/issues/2215 * Remove debug * Minor syntax * Filter out unwanted shortcut modifiers * Menu overflow fix * Typo * Fix unfolding in mobile view * Remove jQuery from category.js * Remove jQuery from Global view
2019-01-02HTTP authenfication fixes (#2204)Gravatar Alexandre Alapetite
* Security fixes when HTTP user does not exist in FreshRSS * Accept HTTP header X-WebAuth-User for delegated HTTP Authentication (e.g. Træfik) * Document delegated HTTP authentication from https://github.com/FreshRSS/FreshRSS/pull/2202
2017-04-09Multi-user tokenGravatar Alexandre Alapetite
https://github.com/FreshRSS/FreshRSS/issues/1390 https://github.com/FreshRSS/FreshRSS/issues/366
2016-12-24Option for cookie durationGravatar Alexandre Alapetite
https://github.com/FreshRSS/FreshRSS/issues/1384
2016-07-31Remove Mozilla Persona loginGravatar Alexandre Alapetite
https://github.com/FreshRSS/FreshRSS/issues/1052
2015-10-25Return after 403Gravatar Alexandre Alapetite
https://github.com/FreshRSS/FreshRSS/pull/1016 https://github.com/FreshRSS/FreshRSS/issues/1015
2015-10-25HTTP 403 for invalid loginGravatar Alexandre Alapetite
https://github.com/FreshRSS/FreshRSS/issues/1015 And does not leak if user exists or not
2015-07-22Add title to the account creation pageGravatar Marien Fressinaud
See https://github.com/FreshRSS/FreshRSS/issues/679
2015-07-22Hide registration form if max registration reachedGravatar Marien Fressinaud
See https://github.com/FreshRSS/FreshRSS/issues/679
2015-07-21First draft for registration formGravatar Marien Fressinaud
See https://github.com/FreshRSS/FreshRSS/issues/679
2015-07-03Updated log visibilityGravatar Alexandre Alapetite
In particular, ensure that ERROR is only used for errors that may affect FreshRSS integrity, and ensure that feed errors are visible also in production, i.e. visibility of WARNING https://github.com/FreshRSS/FreshRSS/issues/885 https://github.com/FreshRSS/FreshRSS/issues/884
2015-01-06Fix a call to $system_confGravatar Marien Fressinaud
See https://github.com/FreshRSS/FreshRSS/issues/730
2015-01-06Fix setters on $user_confGravatar Marien Fressinaud
Old setters does not exist anymore, remove them. See https://github.com/FreshRSS/FreshRSS/issues/730
2015-01-06Fix calls to FreshRSS_ConfigurationGravatar Marien Fressinaud
Replaced by a get_user_configuration() function in lib_rss. This function register a new configuration based on the given username and return the corresponding configuration. See https://github.com/FreshRSS/FreshRSS/issues/730
2015-01-06Fix last calls to Minz_Configuration methodsGravatar Marien Fressinaud
- We have still to fix actualize_script and greader api (refactoring?) - We have to fix the FreshRSS_Configuration calls - We have to fix availableLanguages calls See https://github.com/FreshRSS/FreshRSS/issues/730
2015-01-06BREAKING FEATURE: Remove general in configGravatar Marien Fressinaud
General attribute has been removed from system config. Now subattributes (e.g. environment, salt, title, etc.) are directly accessible. YOU HAVE TO FIX YOUR ./data/config.php file! - Remove the general array - Values inside this array must be kept - To see what it must look like, please have a look to ./data/config.default.php (but keep your values!!). See https://github.com/FreshRSS/FreshRSS/issues/730
2015-01-05Change name of user configuration var in ContextGravatar Marien Fressinaud
- FreshRSS_Context::$conf is replaced by FreshRSS_Context::$user_conf - Introduce FreshRSS_Context::$system_conf - Remove FreshRSS_Configuration object See https://github.com/FreshRSS/FreshRSS/issues/730
2015-01-05New configuration system (not working yet)Gravatar Marien Fressinaud
- Use only Minz_Configuration - register() method to load a new configuration file - get() to get a configuration - new exceptions related to configuration - fix a list configuration calls to have FRSS working Current problems to resolve: - How to handle configuration param verifications (i.e. check auth_type is a value from none, http_auth, persona or form) - We must use $conf = Minz_Configuration::get('system'); $general_conf = $conf->general; to access global system configuration which is quite annoying. How to change that? See https://github.com/FreshRSS/FreshRSS/issues/730
2014-12-11Fix i18n for conf, entry, error, feed ControllersGravatar Marien Fressinaud
2014-12-11Fix i18n for auth and category controllersGravatar Marien Fressinaud
2014-10-30Fix Minz_Error::error() -> use default valuesGravatar Marien Fressinaud
2014-10-26Fix i18n stringGravatar Marien Fressinaud
Order has been changed due to a little bug in sort order function.
2014-10-26Update i18nGravatar Marien Fressinaud
- Fix i18n strings - Fix typo profil -> profile See https://github.com/marienfressinaud/FreshRSS/issues/678
2014-10-20Use FreshRSS_Context::$conf onlyGravatar Marien Fressinaud
- Replace $this->view->conf in controllers - Replace $this->conf in views
2014-10-20Unsafe autologin comes backGravatar Marien Fressinaud
Should be moved in an extension later! See https://github.com/marienfressinaud/FreshRSS/issues/655
2014-10-17Reorganize user pagesGravatar Marien Fressinaud
Three pages: - User profil - User management - Authentication
2014-10-07Reset auth system comes back!Gravatar Marien Fressinaud
It has moved to authController.
2014-10-07Authentication system moved + Persona comes back!Gravatar Marien Fressinaud
AuthController is dedicated to auhentication. Persona is back, greater than ever! See https://github.com/marienfressinaud/FreshRSS/issues/655
generated by cgit v1.2.3 (git 2.39.1) at 2026-02-11 13:24:09 +0000