aboutsummaryrefslogtreecommitdiff
path: root/app/Controllers/userController.php
AgeCommit message (Collapse)Author
2025-12-04Scaling of user statistics (#8277)Gravatar Alexandre Alapetite
Fix https://github.com/FreshRSS/FreshRSS/issues/8268 To better support user management on FreshRSS instance with many users. SQL speed improved. On a reduced test with 5 users, including some large accounts (PostgreSQL on a very tiny and slow server), improving from ~2.3s to ~1.8s, which gives ~20% speed improvement. Then tested with 1000 users, with only the default feed (on my old desktop computer): ```sh for i in {1..1000}; do ./cli/create-user.php --user=freshrss$i --password=freshrss; done app/actualize_script.php cli/access-permissions.sh ``` SQLite: ```console $ time cli/user-info.php | wc -l 1001 real 0m1.366s user 0m0.908s sys 0m0.475s ``` PostgreSQL: ```console $ time cli/user-info.php | wc -l 1001 real 0m28.498s user 0m12.137s sys 0m2.217s ``` MariaDB: ```console # time ./cli/user-info.php | wc -l 1001 real 0m49.485s user 0m1.276s sys 0m2.258s ``` Yes, SQLite is much faster - not a surprise for such use-cases, where the TCP connection is not re-used. I have added some CLI options to disable some statistics: ```sh cli/user-info.php --no-db-size --no-db-counts ``` For the Web UI, I have disabled detailed user statistics if it takes too long, and retrieve missing user statistics asynchronously via JavaScript. Lazy loading of the user details based on IntersectionObserver, with maximum 10 requests in parallel. Web UI tested on 1000 users as well. Checked with SeaMonkey.
2025-12-03Fix CLI user creation warning when language is not given (#8283)Gravatar Alexandre Alapetite
Discovered during https://github.com/FreshRSS/FreshRSS/pull/8277
2025-11-11Housekeeping lib_rss.php (#8193)Gravatar Alexandre Alapetite
* Housekeeping lib_rss.php `lib_rss.php` had become much too large, especially after https://github.com/FreshRSS/FreshRSS/pull/7924 Moved most functions to other places. Mostly no change of code otherwise (see comments). * Extension: composer run-script phpstan-third-party
2025-10-04Strengthen some crypto (#8061)Gravatar Alexandre Alapetite
For login, tokens, nonces
2025-10-01configurable notification timeout (#7942)Gravatar maTh
Ref #7931 Ref #5466 Ref #6409 added configuration in "Display" <img width="636" height="167" alt="grafik" src="https://github.com/user-attachments/assets/7bbc9f26-d91b-4dd2-b715-1d3f9b7a9ad3" /> * i18n: fr * Update app/i18n/pl/conf.php Co-authored-by: Inverle <inverle@proton.me> * make fix-all * max() * Minor whitespace (I am not a fan of excessive vertical indenting) --------- Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr> Co-authored-by: Inverle <inverle@proton.me>
2025-09-30Fix autocomplete issues in change password form (#7812)Gravatar Inverle
## Screenshots <details> <summary>Before</summary> <img width="773" height="652" alt="image" src="https://github.com/user-attachments/assets/89a0e58c-8c4a-41ff-b5d6-3e916079d563" /> </details> <details> <summary>After</summary> <img width="1006" height="646" alt="image" src="https://github.com/user-attachments/assets/f4575103-7365-4870-a170-2742bf10eb27" /> </details> This is an example on Firefox, where the `Master authentication token` field was incorrectly being autofilled. Red borders are indicating that the fields are required. ## List of changes * `required="required"` is now being added to the password fields if the section is open * The `challenge` field is being added if section is open instead of when at least one of the password fields isn't empty due to autocomplete * Added `autocomplete="new-password"` on fields that shouldn't be autocompleted * Unfortunately Chrome requires a workaround with CSS * Not tested on Safari yet * User will be redirected to profile page after successfully changing their password instead of index page ## How to test Autocomplete related changes should be tested on a HTTPS page with saved credentials for FreshRSS
2025-09-15Fix another user self-delete regression (#7877)Gravatar Inverle
Regression from #7763 Earlier regression which was fixed before #7626 In addition: * get rid of `data-toggle` (refactor) * show invalid login message if deleting account and entered incorrect password instead of redirect to 403 * remove unused reference to `r` parameter * `forgetOpenCategories()` on login not on any crypto form
2025-09-09Use `Minz_Translate::exists()` for language check in `createUser()` (#7934)Gravatar Inverle
(consistency) Related / follow-up: #7878
2025-09-09Add a default language constant (#7933)Gravatar Alexis Degrugillier
This replace the use of `en` through out the code.
2025-09-05Change how files are included (#7916)Gravatar Alexis Degrugillier
1. `include`, `include_once`, `require` and `require_once` are expressions not functions, parentheses are not necessary. 2. to move up the directory tree, it's better to use the `dirname` function instead of relying on `/..`.
2025-08-30Regenerate session ID on login (#7829)Gravatar Inverle
Follow-up to #7762 * Regenerate session ID on login * Send only one cookie * Improvements * Delete old session file * Simplify * Make function consistent with others
2025-08-03Fix create user bugs (#7783)Gravatar Inverle
* Fix registration regression due to #7753 * Add missing access check
2025-07-31Implement sudo mode / reauthentication (#7753)Gravatar Inverle
* Implement sudo mode / reauthentication * i18n: fr * generate flags * Improvements * Remove HMAC check * Don't require reauth to access logs when signed in as admin * Notify user of bad login via notification instead --------- Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>
2025-07-31Require current password when setting new password (#7763)Gravatar Inverle
* Require current password when setting new password * i18n: fr --------- Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>
2025-07-30`before_login_btn` hook + system conf attributes (#7761)Gravatar Inverle
* `before_login_btn` hook + system conf attributes * phpstan fix * Refactoring --------- Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>
2025-06-22Restore user config from backup when it doesn't exist (#7682)Gravatar Inverle
* Restore user config from backup when it doesn't exist * Supress warnings * Remove copied config if copy() fails * `return false` after `unlink()` * Performance --------- Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>
2025-03-25Update bcrypt.js from 2.4.4 to 3.0.2 (#7449)Gravatar Alexandre Alapetite
https://github.com/dcodeIO/bcrypt.js/releases/tag/v3.0.0 Can be updated to the latest version with: `curl -L https://unpkg.com/bcryptjs/umd/index.js > p/scripts/vendor/bcrypt.js`
2024-11-18Avoid race condition in users' homedir creation (#7000)Gravatar Andriy Utkin
2024-11-14Fix redirect create user (#6995)Gravatar Alexandre Alapetite
fix https://github.com/FreshRSS/FreshRSS/issues/6994
2024-04-21Windows: release SQLite (#6285)Gravatar Alexandre Alapetite
* Windows: release SQLite fix https://github.com/FreshRSS/FreshRSS/issues/6275 * Do not use sharedPdo for deleting user * Case of same user * Help PHPStan
2024-04-08Allow admins to create user even when there are TOS (#6269)Gravatar Alexandre Alapetite
fix https://github.com/FreshRSS/FreshRSS/issues/5409
2024-03-12Fix empty token bug (#6185)Gravatar Alexandre Alapetite
fix https://github.com/FreshRSS/FreshRSS/issues/6184
2024-01-15PHPStan prepare exceptions (#6037)Gravatar Alexandre Alapetite
Take advantage of https://phpstan.org/blog/bring-your-exceptions-under-control Minimum changes to pass `tooWideThrowType` and `implicitThrows`. Revert some mistakes from: https://github.com/FreshRSS/FreshRSS/pull/5504 Preparation needed before new PRs of the same type: https://github.com/FreshRSS/FreshRSS/pull/5962 Fix several wrong PHPDocs and catches: > Method ... has ...Exception in PHPDoc @throws tag but it's not thrown. > Dead catch - ...Exception is never thrown in the try block.
2023-12-20Fix login (#5955)Gravatar Alexandre Alapetite
fix https://github.com/FreshRSS/FreshRSS/issues/5953 Regression due to https://github.com/FreshRSS/FreshRSS/pull/5946
2023-12-18Pass PHPStan level 8 (#5946)Gravatar Alexandre Alapetite
* Pass PHPStan level 8 And prepare for PHPStan level 9 https://phpstan.org/user-guide/rule-levels * Revert wrong replace in comment * Fix PHPStan level 8 * Update PHPStan and other dev dependencies * Remove obsolete comment * noVariableVariables and towards bleedingEdge https://github.com/phpstan/phpstan-strict-rules https://phpstan.org/blog/what-is-bleeding-edge * More bleedingEdge * A bit more PHPStan level 9 * More PHPStan level 9 * Prepare for booleansInConditions Ignore int and null * Revert wrong line * More fixes * Fix keep_max_n_unread * Stricter attribute functions * Stricter callHooks and more PHPStan level 9 * More typing * A tiny more
2023-11-16Use strict_types (#5830)Gravatar Luc SANCHEZ
* Little's optimisations and booleans in conditions * Apply strict type * Apply strict type * Apply strict type * Fix multiple bugs with PHP 8.2 and 8.3 * Many declares missing, more errors fixed * Apply strict type * Another approach * Stronger typing for Minz_Session * Fix case of SQLite --------- Co-authored-by: Luc <sanchezluc+freshrss@gmail.com> Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>
2023-07-07Chore/processing of depreciations and updating code to php72 minimum (#5504)Gravatar Luc SANCHEZ
* processing of depreciations and updating of code to php7.2 minimum * Autoformat many strange array indenting And revert a few unwanted changes --------- Co-authored-by: Luc <sanchezluc+freshrss@gmail.com> Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>
2023-06-15Fix slider views (#5469)Gravatar Alexandre Alapetite
* Fix slider titles And fix full-page view of category configuration. FIx https://github.com/FreshRSS/FreshRSS/pull/5449#issuecomment-1590021947 * Fix user queries and user management Implement https://github.com/FreshRSS/FreshRSS/pull/5469#issuecomment-1591957935
2023-05-15PHPStan Level 7 for Minz_Request, FreshRSS_Feed, Minz_Error (#5400)Gravatar Alexandre Alapetite
* PHPStan Level 7 for Minz_Request * PHPStan Level 7 for FreshRSS_Feed * PHPStan Level 7 for Minz_Error
2023-05-13PHPStan Level 7 for Share userController logs_pagination (#5393)Gravatar Alexandre Alapetite
2023-05-11A few additional PHPStan rules (#5388)Gravatar Alexandre Alapetite
A subset of https://github.com/phpstan/phpstan-strict-rules
2023-05-03Automatic trusted_sources during install (#5358)Gravatar Alexandre Alapetite
* Automatic trusted_sources during install Fix https://github.com/FreshRSS/FreshRSS/issues/5357 * Fix install for http_auth * Update lib/lib_rss.php Co-authored-by: Luc SANCHEZ <4697568+ColonelMoutarde@users.noreply.github.com> * Fill null exception e-mail * Revert some syntax * Minor parentheses
2023-04-10PHPStan 6 for remaining controllers (#5279)Gravatar Alexandre Alapetite
Contributes to https://github.com/FreshRSS/FreshRSS/issues/4112
2023-04-07Phpstan Level6 for View.php (#5269)Gravatar Luc SANCHEZ
* Remarque's from Alkarex * indentation * indentation * Apply suggestions from code review Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr> * Remarque's from Alkarex * A few improvements * Remarque's from Alkarex * Remarque's from Alkarex * Remarque's from Alkarex * Remarque's from Alkarex * Fixes and improvments * Fix getTagsForEntry --------- Co-authored-by: Luc <sanchezluc+freshrss@gmail.com> Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>
2023-04-07Use typed access to request parameters (#5267)Gravatar Alexandre Alapetite
* Use typed access to request parameters This was a big source of mixed datatypes in many places * Fix notifications * Fix bookmarkAction
2023-03-31PHPStan level 6 for all PDO and Exception classes (#5239)Gravatar Alexandre Alapetite
* PHPStan level 6 for all PDO and Exception classes Contributes to https://github.com/FreshRSS/FreshRSS/issues/4112 * Fix type * Now also our remaining own librairies * Motivation for a few more files * A few more DAO classes * Last interface
2023-03-26Modernize Constants and use new constant for string 'currentUser' (#5089)Gravatar Luc SANCHEZ
* Modernize Constants and use new constant 'currentUser' * Add FreshRSS_Context::currentUser() function and use * Add FreshRSS_Context::currentUser() function and use * Add FreshRSS_Context::currentUser() function and use * Add FreshRSS_Context::currentUser() function and use * Add FreshRSS_Context::currentUser() function and use * Update app/Controllers/userController.php * Update app/Controllers/userController.php * Update app/Controllers/userController.php * Update app/Models/Auth.php * Update p/api/greader.php * Update p/api/greader.php * Update p/api/greader.php * Update app/Models/Context.php * Update app/Models/LogDAO.php * Update lib/Minz/Log.php * Update p/api/greader.php * Update app/layout/header.phtml * Update app/views/helpers/export/articles.phtml * Update cli/do-install.php * Remarque's from Alkarex * Remarque's from Alkarex * Refactor using new Minz_User class * Consistent naming of public constants --------- Co-authored-by: Luc <sanchezluc+freshrss@gmail.com> Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>
2023-03-21Improved: show Terms of Service in config menu (#5215)Gravatar maTh
* Use constants for path to TOS * improve comments * TOS title moved to template * TOS available via config menu * CSS: improve handling of content of TOS/about * give info about set/unset TOS in system config * fix target * i18n FR * i18n DE
2023-02-06More robust application of access permissions (#5062)Gravatar Alexandre Alapetite
* More robust application of access permissions We were in particular missing directory traversal `+X` in our current recommendations. Extracted to own shell script so it can easily be invoked. Update access permissions in Docker to account to be more robust. #fix https://github.com/FreshRSS/FreshRSS/discussions/5037 * Minor simplification * Restrict mkdir permissions Default mkdir permissions are 0777, which is not good for security, so downgrade to 0770.
2022-11-29User-defined time zone (#4906)Gravatar Alexandre Alapetite
* User-defined time zone #fix https://github.com/FreshRSS/FreshRSS/issues/2754 * Update app/i18n/nl/conf.php Co-authored-by: Frans de Jonge <fransdejonge@gmail.com> * Timezone when creating a new user Co-authored-by: Frans de Jonge <fransdejonge@gmail.com>
2022-01-30Fix ctype_alnum (#4182)Gravatar Alexandre Alapetite
* Fix ctype_alnum #fix https://github.com/FreshRSS/FreshRSS/issues/4180 Ensure `ctype_alnum()` gets a string * Changelog
2022-01-08Use typographic quotes (#4133)Gravatar Alexandre Alapetite
* Use typographic quotes * A few fixes * Fix * Fix not saved * Implement feedback * Detail * Revert spoken English fixes Left for a future dedicated discussion * More reverts * Final reverts * Final minor
2022-01-04PHPStan level 5 (#4110)Gravatar Alexandre Alapetite
* Fix most PHPDocs errors Contributes to https://github.com/FreshRSS/FreshRSS/issues/4103 https://phpstan.org/writing-php-code/phpdoc-types * Avoid func_get_args Use variadic syntax instead https://php.net/manual/functions.arguments#functions.variable-arg-list And avoid dynamic functions names when possible to more easily identify calls and unused functions. Contributes to https://github.com/FreshRSS/FreshRSS/issues/4103 * PHPStan level 3 * PHPStand level 4 * Update default to PHPStan level 4 * Towards level 5 * Fix level 4 regression * Towards level 5 * Pass PHPStan level 5 * Towards level 6 * Remove erronenous regression from changelog https://github.com/FreshRSS/FreshRSS/pull/4116
2021-12-31Add PHPStan (#4021)Gravatar Alexandre Alapetite
* Add PHPStan #fix https://github.com/FreshRSS/FreshRSS/issues/4016 https://phpstan.org/ ```sh composer run-script phpstan ``` * More fixes * Fix global variables * Add .phtml * Fix merge https://github.com/FreshRSS/FreshRSS/pull/4090 * Fix more warnings * Fix view errors and enable in CI * ReturnTypeWillChange * Dynamic view type * Fix Minz static/self bug
2021-08-14Better catch when a user does not exists (#3751)Gravatar Alexandre Alapetite
#fix https://github.com/FreshRSS/FreshRSS/issues/3735 Before, we were relying on an exception during the first stages of user initalisation. Now the check is explicit and cleaner, producing a more appropriate HTTP response for the API.
2021-06-01Fix user creation form redirection (#3656)Gravatar Alexis Degrugillier
Before, when there was an error during the user creation process, the user was always redirected to the same page no matter where the creation process was initiated (registration or creation by an admin). Thus, there were no error messages displayed when something went bad during the creation process by an admin. Now, the origin of the user creation has been added to the form to be able to redirect the user to the proper page.
2021-02-28Travis: Enforce phpcs line length + whitespace (#3488)Gravatar Alexandre Alapetite
* Update Travis line length * Also check whitespace in CSS files * Fix line length ext.php * More syntax, string templates * Fix exclude-pattern * Test JS files as well
2020-10-06Minz allow parallel sessions (#3096)Gravatar Alexandre Alapetite
* Minz allow parallel sessions #fix https://github.com/FreshRSS/FreshRSS/issues/3093 * Array optimisation * Array optimisation missing * Reduce direct access to $_SESSION except in install process * Fix session start headers warning * Use cookie only the first time the session is started: `PHP Warning: session_start(): Cannot start session when headers already sent in /var/www/FreshRSS/lib/Minz/Session.php on line 39` * New concept of volatile session for API calls Optimisation: do not use cookies or local storage at all for API calls without a Web session Fix warning: ``` PHP Warning: session_destroy(): Trying to destroy uninitialized session in Unknown on line 0 ``` * Only call Minz_Session::init once in our index It was called twice (once indirectly via FreshRSS->init()) * Whitespace * Mutex for notifications Implement mutex for notifications https://github.com/FreshRSS/FreshRSS/pull/3208#discussion_r499509809 * Typo * Install script is not ready for using Minz_Session
2020-10-05Minz: Attach a notification to a request (#3208)Gravatar Alexandre Alapetite
* Minz: Attach a notification to a request Notifications should be attached to a request, not to a global session. Fix https://github.com/FreshRSS/FreshRSS/pull/3096#issuecomment-654891906 Prepare https://github.com/FreshRSS/FreshRSS/pull/3096 * Rename array * Avoid string constants Implement https://github.com/FreshRSS/FreshRSS/pull/3208#issuecomment-703243863 * Improved logic * Simplify storage https://github.com/FreshRSS/FreshRSS/pull/3208#discussion_r499511213 * Fix notification bug in configuration/system
2020-06-14Add a way to disable/enable users (#3056)Gravatar Alexis Degrugillier
If you want to block users without deleting their account, you can now disable them from the interface.
generated by cgit v1.2.3 (git 2.39.1) at 2026-02-11 09:13:43 +0000