aboutsummaryrefslogtreecommitdiff
path: root/app/FreshRSS.php
AgeCommit message (Collapse)Author
2025-09-30Add hook enums (#8036)Gravatar Alexis Degrugillier
- add an enum to handle hook types (enum are available since PHP 8.1) - change hook calls from string value to enum value
2025-09-21Add option for CSP frame-ancestors (#7857)Gravatar Alexandre Alapetite
* Add option for CSP frame-ancestors https://github.com/FreshRSS/FreshRSS/discussions/7856 * Revert contentSelectorPreviewAction * Same for f.php and api * Fix double init in f.php * No sandbox for API page
2025-08-11Put CSP everywhere (#7810)Gravatar Inverle
* Puts CSP everywhere in `p/api` * including the HTML query page ❗ * Also in `p/ext.php` * Puts `X-Content-Type-Options: nosniff` everywhere * Fixes custom icon configuration not showing `blob:` icon in statsController (idle feeds) * Also removes `style-src 'unsafe-inline'` since it doesn't seem to be needed * Improves CSP of `p/f.php` * Add `sandbox` directive
2025-08-09Show warning when unsafe CSP policy is in use (#7804)Gravatar Inverle
* Show warning when unsafe CSP policy is in use * Fix bare markdown URL * i18n: fr * Minor i18n: fr * Add target="_blank" to i18n strings --------- Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>
2024-09-11PHPStan booleansInConditions (#6793)Gravatar Alexandre Alapetite
* PHPStan booleansInConditions * Uniformisation
2024-08-01Minor update whitespace PHPCS rules (#6666)Gravatar Alexandre Alapetite
* Minor update whitespace PHPCS rules To simplify our configuration, apply more rules, and be clearer about what is added or removed compared with PSR12. Does not change our current conventions, but just a bit more consistent. * Forgotten *.phtml * Sort exclusion patterns + add a few for Extensions repo * Relaxed some rules
2024-03-01Minz remove use of deprecated variable (#6132)Gravatar Alexandre Alapetite
and related improvements to clarify inheritance Follow-up of https://github.com/FreshRSS/FreshRSS/pull/6130
2024-02-26New feature: shareable user query (#6052)Gravatar Alexandre Alapetite
* New feature: shareable user query Share the output of a user query by RSS / HTML / OPML with other people through unique URLs. Replaces the global admin token, which was the only option (but unsafe) to share RSS outputs with other people. Also add a new HTML output for people without an RSS reader. fix https://github.com/FreshRSS/FreshRSS/issues/3066#issuecomment-648977890 fix https://github.com/FreshRSS/FreshRSS/issues/3178#issuecomment-769435504 * Remove unused method * Fix token saving * Implement HTML view * Update i18n for master token * Revert i18n get_favorite * Fix missing i18n for user queries from before this PR * Remove irrelevant tests * Add link to RSS version * Fix getGet * Fix getState * Fix getSearch * Alternative getSearch * Default getOrder * Explicit default state * Fix test * Add OPML sharing * Remove many redundant SQL queries from original implementation of user queries * Fix article tags * Use default user settings * Prepare public search * Fixes * Allow user search on article tags * Implement user search * Revert filter bug * Revert wrong SQL left outer join change * Implement checkboxes * Safe check of OPML * Fix label * Remove RSS button to favour new sharing method That sharing button was using a global admin token * First version of HTTP 304 * Disallow some recusrivity fix https://github.com/FreshRSS/FreshRSS/issues/6086 * Draft of nav * Minor httpConditional * Add support for offset for pagination * Fix offset pagination * Fix explicit order ASC * Add documentation * Help links i18n * Note about deprecated master token * Typo * Doc about format
2023-12-22Fix notifications (#5959)Gravatar Alexandre Alapetite
The notification about wrong login was not working. Noticed while working on https://github.com/FreshRSS/FreshRSS/pull/5955 This was due to timing of when the notification is retrieved. Simplified code to make the logic easier and more robust.
2023-12-18Pass PHPStan level 8 (#5946)Gravatar Alexandre Alapetite
* Pass PHPStan level 8 And prepare for PHPStan level 9 https://phpstan.org/user-guide/rule-levels * Revert wrong replace in comment * Fix PHPStan level 8 * Update PHPStan and other dev dependencies * Remove obsolete comment * noVariableVariables and towards bleedingEdge https://github.com/phpstan/phpstan-strict-rules https://phpstan.org/blog/what-is-bleeding-edge * More bleedingEdge * A bit more PHPStan level 9 * More PHPStan level 9 * Prepare for booleansInConditions Ignore int and null * Revert wrong line * More fixes * Fix keep_max_n_unread * Stricter attribute functions * Stricter callHooks and more PHPStan level 9 * More typing * A tiny more
2023-11-16Use strict_types (#5830)Gravatar Luc SANCHEZ
* Little's optimisations and booleans in conditions * Apply strict type * Apply strict type * Apply strict type * Fix multiple bugs with PHP 8.2 and 8.3 * Many declares missing, more errors fixed * Apply strict type * Another approach * Stronger typing for Minz_Session * Fix case of SQLite --------- Co-authored-by: Luc <sanchezluc+freshrss@gmail.com> Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>
2023-07-07Chore/processing of depreciations and updating code to php72 minimum (#5504)Gravatar Luc SANCHEZ
* processing of depreciations and updating of code to php7.2 minimum * Autoformat many strange array indenting And revert a few unwanted changes --------- Co-authored-by: Luc <sanchezluc+freshrss@gmail.com> Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>
2023-05-15PHPStan Level 7 for Minz_Request, FreshRSS_Feed, Minz_Error (#5400)Gravatar Alexandre Alapetite
* PHPStan Level 7 for Minz_Request * PHPStan Level 7 for FreshRSS_Feed * PHPStan Level 7 for Minz_Error
2023-05-11Typed view model classes (#5380)Gravatar Alexandre Alapetite
* Typed view model classes * Add ability to provide a typed view model class to a controller * Use `::class` instead of string for referring to classes * Examplified with `stats` and `javascript` controllers / views (more to do) * Also useful for extensions (my usecase today), which did not have the ability to define own view model attributes before. * Typo
2023-04-07Use typed access to request parameters (#5267)Gravatar Alexandre Alapetite
* Use typed access to request parameters This was a big source of mixed datatypes in many places * Fix notifications * Fix bookmarkAction
2023-04-04Fix extensions in actualize_script (#5243)Gravatar Alexandre Alapetite
* Fix extension freshrss_user_maintenance in actualize_script Follow-up of https://github.com/FreshRSS/FreshRSS/pull/3440 The hook was called before registering all the extensions for the current user * PHPStan Level 6 for extensions And remove 5-year old legacy format of enabled extensions < FreshRSS 1.11.1 * Fix multiple bugs in extensions * Minor typing * Don't change signature of methods supposed to be overridden * PHPStan Level 9 and compatibility Intelliphense * Set as final the methods not supposed to be overriden
2023-03-04Add: <meta name="theme-color"> (#5105)Gravatar maTh
* implemented * themes' metadata.json * fix * fix * retrigger tests * Update lib/Minz/View.php Co-authored-by: Luc SANCHEZ <4697568+ColonelMoutarde@users.noreply.github.com> * Update lib/Minz/View.php Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr> * Update lib/Minz/View.php Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr> * Update lib/Minz/View.php Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr> * fix --------- Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr> Co-authored-by: Luc SANCHEZ <4697568+ColonelMoutarde@users.noreply.github.com>
2023-01-29PHPStan level 9 for ./p/ and lib_rss.php (#5049)Gravatar Alexandre Alapetite
And app/FreshRSS.php Contributes to https://github.com/FreshRSS/FreshRSS/issues/4112
2023-01-19Safer timezone set (#5021)Gravatar Alexandre Alapetite
* Safer timezone set Add missing tzdata in Docker :newest Fallback to UTC if no timezone is defined at all #fix https://github.com/FreshRSS/FreshRSS/pull/4906#issuecomment-1386747169 * Better refactoring Show fallback timezone everywhere
2022-11-29User-defined time zone (#4906)Gravatar Alexandre Alapetite
* User-defined time zone #fix https://github.com/FreshRSS/FreshRSS/issues/2754 * Update app/i18n/nl/conf.php Co-authored-by: Frans de Jonge <fransdejonge@gmail.com> * Timezone when creating a new user Co-authored-by: Frans de Jonge <fransdejonge@gmail.com>
2022-05-23Custom logo HTML (#4369)Gravatar Alexandre Alapetite
* Custom logo HTML Add option for custom HTML logo/title in the main Web UI view. Can potentially be different per user. #fix https://github.com/FreshRSS/FreshRSS/pull/3830/files#r850472247 * logo_html in main config With new `./data/config.custom.php` to provide custom values before install * Docker documentation * whitespace * Auto relax CSP to allow images for HTML logo * Documentation
2022-01-08Use typographic quotes (#4133)Gravatar Alexandre Alapetite
* Use typographic quotes * A few fixes * Fix * Fix not saved * Implement feedback * Detail * Revert spoken English fixes Left for a future dedicated discussion * More reverts * Final reverts * Final minor
2021-12-31Add PHPStan (#4021)Gravatar Alexandre Alapetite
* Add PHPStan #fix https://github.com/FreshRSS/FreshRSS/issues/4016 https://phpstan.org/ ```sh composer run-script phpstan ``` * More fixes * Fix global variables * Add .phtml * Fix merge https://github.com/FreshRSS/FreshRSS/pull/4090 * Fix more warnings * Fix view errors and enable in CI * ReturnTypeWillChange * Dynamic view type * Fix Minz static/self bug
2021-08-04Themes incl javascript files (#3739)Gravatar maTh
* it works * optimized
2021-02-28Travis: Enforce phpcs line length + whitespace (#3488)Gravatar Alexandre Alapetite
* Update Travis line length * Also check whitespace in CSS files * Fix line length ext.php * More syntax, string templates * Fix exclude-pattern * Test JS files as well
2021-02-11refactor: remove referer checks, as they are no longer needed (replaced by ↵Gravatar hesch
csrf tokens) (#3432)
2021-01-02Avoid manual initialisations of system or user configuration (#3070)Gravatar Alexandre Alapetite
* Avoid manual intialisations of system or user configuration More consistent use of Context * Simplify FreshRSS_Context::initUser * Remove a few manual get_user_configuration * A bit of debugging * Fix context user init * Fix install * Fix concurrency Concurrent requests could lead to bad race condition * Fix actualize cron Fix case when system i initialised several times
2020-12-31Fix bugs in anomymous mode (#3305)Gravatar Alexandre Alapetite
* Fix bugs in anomymous mode Login bug (submit button not working) and refresh bug (JS null exception, and then 403). * Take advantage of existing variable
2020-11-11Fix initI18n (#3249)Gravatar Alexandre Alapetite
* Fix initI18n #fix https://github.com/FreshRSS/FreshRSS/issues/3246#issuecomment-725463337 #fix https://github.com/FreshRSS/FreshRSS/issues/3136 It was due to calling `initI18n()` before `FreshRSS_Context` is intialised in some situations Introduced by https://github.com/FreshRSS/FreshRSS/pull/3022 Will be better fixed when https://github.com/FreshRSS/FreshRSS/pull/3070 lands * Fallback condition
2020-10-05Minz: Attach a notification to a request (#3208)Gravatar Alexandre Alapetite
* Minz: Attach a notification to a request Notifications should be attached to a request, not to a global session. Fix https://github.com/FreshRSS/FreshRSS/pull/3096#issuecomment-654891906 Prepare https://github.com/FreshRSS/FreshRSS/pull/3096 * Rename array * Avoid string constants Implement https://github.com/FreshRSS/FreshRSS/pull/3208#issuecomment-703243863 * Improved logic * Simplify storage https://github.com/FreshRSS/FreshRSS/pull/3208#discussion_r499511213 * Fix notification bug in configuration/system
2020-06-05Add language detection when the user is not logged in (#3022)Gravatar Alexis Degrugillier
Before, when the user was not logged in, pages where translated with the '_' user language. Now, they are translated with the user preferred language if there is one supported by FreshRSS or with the system default language.
2020-04-20Don't check email if feature disabled or for admin (#2917)Gravatar Marien Fressinaud
2020-03-01[UI] Add RTL support with RTLCSS (#2776)Gravatar Frans de Jonge
* Add dir info to gen.php & install.php! * Add `make rtl` command Using rtlcss because it has actually has a command-line application!
2019-12-22tec: Allow to change CSP header from controllersGravatar Marien Fressinaud
For an extension, I needed to call a script from an external domain. Unfortunately, the CSP headers didn't allow this domain and I had to patch manually the FreshRSS FrontController for my extension. It's obviously not a long-term solution since it has nothing to do in the core of FRSS, and I don't want to apply this patch manually at each update. With this patch, I allow changing the CSP header from inside the controller actions. It allows extensions to modify headers. It's also an opportunity to remove a bit of code from the FrontController. I wasn't happy with the previous implementation anyhow. Reference: https://github.com/flusio/xExtension-Flus/commit/ed12d56#diff-ff12e33ed31b23bda327499fa6e84eccR143
2019-12-03fix: Allow to refresh feeds if user isn't verified (#2694)Gravatar Marien Fressinaud
While I was looking at the number of articles of my users, I discovered some of them had none, while having a bunch of feeds though. I took a look at the logs generated by `app/actualize_script.php` and discovered that the script stopped strangely (in this example, "OK" for denise is expected, and more users too): ``` FreshRSS[1681]: FreshRSS Start feeds actualization... Starting feed actualization at 2019-11-29T16:37:19+00:00 Actualize alice... Actualize denise... Results: alice OK denise ``` After digging a bit, I quickly realized the script stopped always on users who didn't validate their emails. And indeed, we trigger a `Minz_Request::forward(..., true)` for these users, in the `FreshRSS` class. This function calls the `exit` function, which stops the script. This patch only allows the feed#actualize action to be executed for unverified users in order to avoid an early-`exit`. This is a quick-win solution, but I don't think it's a good one on the long term. I'll propose an alternative in another patch, later.
2019-08-29fix: Fix "validate email"-related issues (#2512)Gravatar Marien Fressinaud
* fix: Make sure $disable_aside is initialized There was a warning for an uninitialized variable, hidden in production but visible in development mode. * fix: Allow to delete account when email isn't validated
2019-08-29Provide email address verification feature (#2481)Gravatar Marien Fressinaud
* Add an email field to the profile page I reuse the `mail_login` from the configuration. I'm not sure if it's useful today (I would say it was used when Persona login was available). A good improvement would be to rename `mail_login` into `email` so it would be more intuitive to use. * Add boolean to the conf to force email validation This commit only adds a configuration item. * Add email during registration if email must be validated * Set email token to validate when email changes * Block access to FreshRSS if email is not validated * Send email when address is changed * Allow to resend the validation email * Allow the user to change its email while blocked * Document the email validation feature * fixup! Allow the user to change its email while blocked * tec: Autoload PHPMailer lib * Validate email address format * Add feedback on validation email resend action * Allow to logout when user is blocked * fix: Change default email "from" * Reorganize i18n keys * Complete all the locales with default english * Hide sidebar (profile page) if email is not validated * Check email requirements on registration * Allow admin to specify email when creating users * Don't check email format if value is empty * Remove trailing comma in userController Co-Authored-By: Alexandre Alapetite <alexandre@alapetite.fr> * Set PHPMailer validator to html5 before sending email * fixup! Remove trailing comma in userController
2019-08-14Add hooks to ExtensionManager (#2482)Gravatar Marien Fressinaud
Hooks allow to: - add items in menus - perform new actions at the end of FreshRSS initialization
2019-07-21Fix user self registration (#2442)Gravatar Alexandre Alapetite
* Fix user self registration Fix https://github.com/FreshRSS/FreshRSS/issues/2381 * CSRF for admin
2019-03-22Rework CSRF interaction with sessions (#2290)Gravatar Alexandre Alapetite
* Rework CSRF interaction with sessions Fix https://github.com/FreshRSS/FreshRSS/issues/2288 Improve security in some edge cases Maybe relevant for https://github.com/FreshRSS/FreshRSS/issues/2125#issuecomment-474992671 * Forgotten mime type
2019-02-13Remove deprecated CSP child-srcGravatar Alexandre Alapetite
It's been probably long enough since https://github.com/FreshRSS/FreshRSS/pull/1099
2019-02-13Less jQuery (#2234)Gravatar Alexandre Alapetite
* Less jQuery Follow-up of https://github.com/FreshRSS/FreshRSS/pull/2199 * Even less jQuery + global view unread title fix * Even less jQuery * Yet even less jQuery * Even less jQuery * Reduce some events * Even less jQuery * jQuery gone from main view +Fixed English i18n * Fix feed folded view * Remove Firefox 64 workaround Remove workaround for Gecko bug 1514498 in Firefox 64, fixed in Firefox 65 * Split to extra.js Avoid loading unneeded JavaScript code for the main view. + several adjustements * Improve CSS transition fold category * Rewrite shortcuts Remove library. Much faster, shorter, one listener instead of many. Control of the shortcut context. Fix https://github.com/FreshRSS/FreshRSS/issues/2215 * Remove debug * Minor syntax * Filter out unwanted shortcut modifiers * Menu overflow fix * Typo * Fix unfolding in mobile view * Remove jQuery from category.js * Remove jQuery from Global view
2018-10-14Remove some preload / prefetch (#2040)Gravatar Alexandre Alapetite
* Remove next prefetch This approach was only efficient in the specific case when no change was made (no mark-as-read, favourites, tags), and useless in the other situations. Removed to reduce server load. * Remove next prefetch from JavaScript too * Remove some preload / prefetch While useful for the first request, those preload / prefetch hints are slightly negative for the following requets, especially server-side, e.g. generating one log entry in Apache, and a bit more network traffic. * Revert mistake * Remove comment https://github.com/FreshRSS/FreshRSS/pull/2040#discussion_r223214915
2018-06-22Explicit quotes decoding (#1947)Gravatar Alexandre Alapetite
* Explicit quotes decoding * Explicit htmlspecialchars_decode and htmlspecialchars
2018-03-03Move shares (#1812)Gravatar Alexandre Alapetite
From ./data/ to ./app/ Fix manual updates like https://github.com/FreshRSS/FreshRSS/issues/1803#issuecomment-369371907 Left for later: support a ./data/shares.local.php for user-defined shares.
2017-11-04Small fix Mastodon shareGravatar Alexandre Alapetite
$a['method'] can be undefined. https://github.com/FreshRSS/FreshRSS/pull/1674 https://github.com/FreshRSS/FreshRSS/issues/1521
2017-11-04Add a Mastodon share (#1674)Gravatar Alexis Degrugillier
See #1521
2017-05-26Change CSS load order to help CustomCSS extensionGravatar Alexandre Alapetite
https://github.com/FreshRSS/Extensions/issues/13
2017-05-12Move default configuration filesGravatar Alexandre Alapetite
https://github.com/FreshRSS/FreshRSS/issues/1531
2016-10-06Allow extensions for default accout in anonymous modeGravatar Alexandre Alapetite
https://github.com/FreshRSS/FreshRSS/issues/1257#issuecomment-248111169
generated by cgit v1.2.3 (git 2.39.1) at 2026-02-10 08:30:14 +0000