aboutsummaryrefslogtreecommitdiff
path: root/lib/Minz
AgeCommit message (Collapse)Author
14 daysRewrite setcookie using new syntax (#8447)Gravatar Alexandre Alapetite
Follow-up of https://github.com/FreshRSS/FreshRSS/pull/2630 now that we have PHP 7.3+ (even PHP 8.1+). * The new syntax natively supports `samesite`, and also avoids the need of re-setting all parameters. * Use automatic path instead of own function `getCookieDir()`. Follow-up of https://github.com/FreshRSS/FreshRSS/pull/8446 * Sanitize lifetime of session cookies from PHP ini to avoid likely invalid/misunderstood values
2026-01-18Fix custom session.cookie-lifetime (#8446)Gravatar Alexandre Alapetite
fix https://github.com/FreshRSS/FreshRSS/issues/8430 Fix case when `session.cookie-lifetime` is not using the default value of 0 in PHP ini. Co-authored-by: rioky <rioky@users.noreply.github.com>
2025-12-21Improve configuration checks (#8334)Gravatar Alexandre Alapetite
Add a distinction between recommended and required extensions. Add check for recommended php-intl extension as follow-up of https://github.com/FreshRSS/FreshRSS/pull/8329#issuecomment-3677686581 Improve related checks such as ZIP. Reduce duplicated translations and tests.
2025-12-17Use native PHP #[Deprecated] (#8325)Gravatar Alexandre Alapetite
https://php.watch/versions/8.4/Deprecated And enfore it with PHPUnit + PHPStan. Especially useful for extensions.
2025-12-13New links in transitions and jump to next transition (#8294)Gravatar Alexandre Alapetite
Easier to explain graphically: <img width="408" height="266" alt="image" src="https://github.com/user-attachments/assets/0e3724a1-155b-4a87-89b3-cfe8a18cb100" /> The jump to next section ⏭ works when the sorting criterion is a date. Need https://github.com/FreshRSS/FreshRSS/pull/8293
2025-12-13Fix search encoding and quoting (#8311)Gravatar Alexandre Alapetite
Revised the encoding approach for searches: the HTML encoding is done just before its use for DB search. Fix also some cases with wrong quoting. Fix https://github.com/FreshRSS/FreshRSS/pull/8306#issuecomment-3643865439 Follow-up of https://github.com/FreshRSS/FreshRSS/pull/8293
2025-12-04Improve anonymous authentication logic (#8165)Gravatar Inverle
* Improve anonymous authentication logic * forgot to git add * Fix incorrect token check Because an empty parameter could be just passed if token for the user wasn't set: `&token=`
2025-11-16Rework saving of configuration files (#8220)Gravatar Inverle
* Attempt to restore user config if `file_put_contents()` fails * Second approach * Minor preference: `.tmp.php` Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr> * Change boolean compare syntax Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr> * fix?
2025-11-13Exclude local networks for domain-wide Retry-After (#8195)Gravatar Alexandre Alapetite
* Exclude local networks for domain-wide Retry-After Retry-After will be applied by URL and not by domain for local networks. fix https://github.com/FreshRSS/FreshRSS/issues/7880 * Improved logic for detection of local domains * Support ip6-localhost and a couple more variants * On more: .lan * Resolve IP address * Add .intranet
2025-11-11Housekeeping lib_rss.php (#8193)Gravatar Alexandre Alapetite
* Housekeeping lib_rss.php `lib_rss.php` had become much too large, especially after https://github.com/FreshRSS/FreshRSS/pull/7924 Moved most functions to other places. Mostly no change of code otherwise (see comments). * Extension: composer run-script phpstan-third-party
2025-10-21Add support for extension compatibility (#8081)Gravatar Alexis Degrugillier
The compatibility does support only a minimum version of FreshRSS. If we need something a bit more clever in the future, it is possible to handle a rule with a bit more complexity. See https://github.com/FreshRSS/FreshRSS/issues/5903 * Update app/Controllers/extensionController.php Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr> * Update app/i18n/pl/admin.php Co-authored-by: Inverle <inverle@proton.me> * Minor move phpstan-type --------- Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr> Co-authored-by: Inverle <inverle@proton.me>
2025-10-15Implement search form (#8103)Gravatar Alexandre Alapetite
* Add UI for advanced search To help users with the seach operators. Obviously not as powerful as a manually-written search query. Lack in particular negation and logical *and* for now, but I might try to do something about it. <img width="939" height="1438" alt="image" src="https://github.com/user-attachments/assets/0bcad39b-eff3-4f44-876b-a2552af2af00" /> * Consistency: allow multiple user queries like S:1,2 * Fix user query and add tests
2025-10-02Add a new hook in the UI (#8054)Gravatar Alexis Degrugillier
* Add a new hook in the UI The new hook allows extension to add their own tool bar to navigate between entries. For instance, if the user wants less or more buttons that what's available by default. See #7912 See #7913 * add link data to ease navigation
2025-10-01Add support for extension priority (#8038)Gravatar Alexis Degrugillier
Extension can now define their hook priority. This will allow to define the order in which hooks are triggered. See #7110 Closes #7110 Changes proposed in this pull request: - Add support for extension priority How to test the feature manually: 1. Create an extension with 2 hooks on the same hook type but different priority 2. The hooks must be prepending the title with different values 3. Validate that changing the hook priority changes the final title accordingly.
2025-10-01configurable notification timeout (#7942)Gravatar maTh
Ref #7931 Ref #5466 Ref #6409 added configuration in "Display" <img width="636" height="167" alt="grafik" src="https://github.com/user-attachments/assets/7bbc9f26-d91b-4dd2-b715-1d3f9b7a9ad3" /> * i18n: fr * Update app/i18n/pl/conf.php Co-authored-by: Inverle <inverle@proton.me> * make fix-all * max() * Minor whitespace (I am not a fan of excessive vertical indenting) --------- Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr> Co-authored-by: Inverle <inverle@proton.me>
2025-09-30Add hook enums (#8036)Gravatar Alexis Degrugillier
- add an enum to handle hook types (enum are available since PHP 8.1) - change hook calls from string value to enum value
2025-09-18Add `entry_before_update` and `entry_before_add` hooks (#7977)Gravatar KleinMann
Discussion: https://github.com/FreshRSS/FreshRSS/discussions/7973 Changes proposed in this pull request: - Add new extension hook "entry_before_add" - Add new extension hook "entry_before_update" How to test the feature manually: 1. Create extension that uses the hooks and confirm they are invoked correctly. Extension to use for testing https://github.com/rnkln/freshrss-xExtension-Discord/pull/2
2025-09-09Add a default language constant (#7933)Gravatar Alexis Degrugillier
This replace the use of `en` through out the code.
2025-09-05Change how files are included (#7916)Gravatar Alexis Degrugillier
1. `include`, `include_once`, `require` and `require_once` are expressions not functions, parentheses are not necessary. 2. to move up the directory tree, it's better to use the `dirname` function instead of relying on `/..`.
2025-08-31Fix log CRLF injection (#7883)Gravatar Inverle
* Fix log CRLF injection * empty -> space Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>
2025-08-30Regenerate session ID on login (#7829)Gravatar Inverle
Follow-up to #7762 * Regenerate session ID on login * Send only one cookie * Improvements * Delete old session file * Simplify * Make function consistent with others
2025-08-30Disallow setting non-existent language (#7878)Gravatar Inverle
The set language is used inside paths and can lead to issues by including PHP files from other locations
2025-08-09Show warning when unsafe CSP policy is in use (#7804)Gravatar Inverle
* Show warning when unsafe CSP policy is in use * Fix bare markdown URL * i18n: fr * Minor i18n: fr * Add target="_blank" to i18n strings --------- Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>
2025-08-07PHPStan: finalise strictArrayFilter (#7794)Gravatar Alexandre Alapetite
As well as reportPossiblyNonexistentConstantArrayOffset. And disable PHPStan-next from GitHub Action, since the work is completed for now.
2025-08-01composer update + corresponding PHPStan fixes (#7781)Gravatar Alexandre Alapetite
Replacing failing Dependabot PRs: * https://github.com/FreshRSS/FreshRSS/pull/7779 * https://github.com/FreshRSS/FreshRSS/pull/7780 * https://github.com/FreshRSS/FreshRSS/pull/7778
2025-07-31Fix regression Minz_Configuration (#7765)Gravatar Alexandre Alapetite
Follow-up of https://github.com/FreshRSS/FreshRSS/pull/7761 Partially avoid calls to deprecated functions. Avoid warnings: ``` [warning] --- old_entries does not exist in configuration [warning] --- keep_history_default does not exist in configuration ```
2025-07-30`before_login_btn` hook + system conf attributes (#7761)Gravatar Inverle
* `before_login_btn` hook + system conf attributes * phpstan fix * Refactoring --------- Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>
2025-06-30Implement custom feed favicons (#7646)Gravatar Inverle
Closes #3789, #6503 Icon setting when no custom icon is set yet: ![image](https://github.com/user-attachments/assets/28b07dd0-7dac-4c76-b1d7-77035f91a87a) - `Change...` button opens a file dialog, and after selecting a file shows the chosen icon in the preview on the left. `Submit` must be clicked after selecting the icon. - `Reset to default` changes the preview icon to the default one, and also requires `Submit` to be clicked to apply the changes. Full list of changes: - CSP now includes `blob:` in `img-src` for - `indexAction()` and `feedAction()` in `subscriptionController.php` - all of the view actions in `indexController.php` - Introduce new attribute `customFavicon (boolean)` for feeds that indicates if the feed has a custom favicon - `hashFavicon()` in `Feed.php` is dependent on this attribute - `hashFavicon()` has a new parameter called `skipCache (boolean)` that allows the reset of the favicon hash for the Feed object - `resetFaviconHash()` just calls `hashFavicon(skipCache: true)` - `f.php` URLs now have the format of `/f.php?h=XXXXX&t=cachebuster`, where the `t` parameter is only used for serving custom favicons - if `t` parameter is set, `f.php` returns a `Cache-Control: immutable` header - `stripos` and `strpos` were changed to `str_contains` in various places (refactor) - JS for handling the custom favicon configuration logic is in `extra.js` inside `init_update_feed()` which is called when feed configuration is opened from the aside or when the subscription management page with the feed is loaded - Server-side code for uploading the icon in `subscriptionController.php` under `feedAction()` - Errors that may occur during the setting of a custom favicon: - Unsupported image file type (handled only server-side with `isImgMime()`) - When the file is bigger than 1 MiB (default), handled both client-side and server-side - Standard feed error when `updateFeed()` fails - JS vars `javascript_vars.phtml` are no longer escaped with `htmlspecialchars()`, instead with json encoding, - CSS for disabled buttons was added - Max favicon file size is configurable with the `max_favicon_upload_size` option in `config.php` (not exposed via UI) - Custom favicons are currently deleted only when they are either reset to the default icon, or the feed gets deleted. They do not get deleted when the user deletes their account without removing their feeds first. - ` faviconPrepare()` and `faviconRebuild()` are not allowed to be called when the `customFavicon` attribute is `true` - New i18n strings: - `'sub.feed.icon' => 'Icon'` - `'sub.feed.change_favicon' => 'Change…'` - `'sub.feed.reset_favicon' => 'Reset to default'` - `'sub.feed.favicon_changed_by_ext' => 'The icon has been set by the <b>%s</b> extension.'` - `'feedback.sub.feed.favicon.too_large' => 'Uploaded icon is too large. The maximum file size is <em>%s</em>.'` - `'feedback.sub.feed.favicon.unsupported_format' => 'Unsupported image file format!'` - Extension hook `custom_favicon_hash` - `setCustomFavicon()` method - `resetCustomFavicon()` method - `customFaviconExt` and `customFaviconDisallowDel` attributes - example of usage: https://github.com/FreshRSS/Extensions/pull/337 - Extension hook `custom_favicon_btn_url` - Allows extensions to implement a button for setting a custom favicon for individual feeds by providing an URL. The URL will be sent a POST request with the `extAction` field set to either `query_icon_info` or `update_icon`, along with an `id` field which describes the feed's ID.
2025-06-22Exposed the reading modes for extensions through Minz (#7668)Gravatar Stefan
* + Exposed the reading modes for extensions through Minz. Now extensions can add a custom view mode. Graceful fallback to normal view in case the extension was disabled without resetting the view_mode through the uninstall method. In that case the user will be informed via Minz_Request::setBadNotification that the view has been reset to normal. + Added translation strings for de, en and en-us for the notification * + Added missing, generated translations * Simplify indexAction, performance * Minor settings htmlspecialchars * i18n: fr * Minor wording * Doc * Fix i18n --------- Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>
2025-06-18frame-ancestors CSP (#7677)Gravatar Inverle
2025-06-06Install: add test PDO typing (#7651)Gravatar Alexandre Alapetite
fix https://github.com/FreshRSS/FreshRSS/issues/7647
2025-06-03Add API endpoint for extensions (#7576)Gravatar Alexandre Alapetite
* Add API endpoint for extensions Useful for https://github.com/FreshRSS/FreshRSS/issues/7572 * Support PATH_INFO Now also support being invoked like `/api/misc.php/Extension%20Name/` * More documentation
2025-05-01Bump phpstan/phpstan from 2.1.11 to 2.1.13 (#7534)Gravatar dependabot[bot]
* Bump phpstan/phpstan from 2.1.11 to 2.1.13 Bumps [phpstan/phpstan](https://github.com/phpstan/phpstan) from 2.1.11 to 2.1.13. - [Release notes](https://github.com/phpstan/phpstan/releases) - [Changelog](https://github.com/phpstan/phpstan/blob/2.1.x/CHANGELOG.md) - [Commits](https://github.com/phpstan/phpstan/compare/2.1.11...2.1.13) --- updated-dependencies: - dependency-name: phpstan/phpstan dependency-version: 2.1.13 dependency-type: direct:development update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> * Bump phpstan/phpstan from 2.1.11 to 2.1.13 Bumps [phpstan/phpstan](https://github.com/phpstan/phpstan) from 2.1.11 to 2.1.13. - [Release notes](https://github.com/phpstan/phpstan/releases) - [Changelog](https://github.com/phpstan/phpstan/blob/2.1.x/CHANGELOG.md) - [Commits](https://github.com/phpstan/phpstan/compare/2.1.11...2.1.13) --- updated-dependencies: - dependency-name: phpstan/phpstan dependency-version: 2.1.13 dependency-type: direct:development update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> * Fix PHPStan --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>
2025-04-07Secure serving of user files from extensions (#7495)Gravatar Alexandre Alapetite
* Secure serving of user files from extensions fix https://github.com/FreshRSS/FreshRSS/issues/4930 * More fixes * Typo
2025-04-01Catch extension exceptions in override (#7475)Gravatar Alexandre Alapetite
* Catch extension exceptions in override https://github.com/FreshRSS/Extensions/pull/300#issuecomment-2768578464 * Fix error message
2025-03-15Update PHPStan 2.1.8 (#7431)Gravatar Alexandre Alapetite
Fixing minor breaking changes
2025-03-05Fix Minz_Request::paramArray (#7400)Gravatar Alexandre Alapetite
fix https://github.com/FreshRSS/FreshRSS/issues/7371 Regression from https://github.com/FreshRSS/FreshRSS/pull/7131
2025-02-21Update dev tools (#7347)Gravatar Alexandre Alapetite
In particular those not covered by Dependabot
2025-02-02Improve notifications: notificationName (#7287)Gravatar maTh
* notificationID * 3 first examples * fix * notificationID -> notificationName * Update lib/Minz/Request.php Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr> --------- Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>
2025-01-25Improve cURL proxy options (#7231)Gravatar Alexandre Alapetite
3 is now used for CURLPROXY_HTTPS2 https://github.com/curl/curl/blob/f07612cd9ae1ec50b9bedd749171ad75203c9e7e/include/curl/curl.h#L789 Related to https://github.com/FreshRSS/FreshRSS/issues/7209
2025-01-10Reduce undeeded use of elvis operator ?: (#7204)Gravatar Alexandre Alapetite
2025-01-08Add some missing PHP native types (#7191)Gravatar Alexandre Alapetite
* Add some missing PHP native types Replaces https://github.com/FreshRSS/FreshRSS/pull/7184 * Clean some types
2025-01-06Implement custom order-by (#7149)Gravatar Alexandre Alapetite
Add option to sort results by received date (existing, default), publication date, title, URL (link), random. fix https://github.com/FreshRSS/FreshRSS/issues/1771 fix https://github.com/FreshRSS/FreshRSS/issues/2083 fix https://github.com/FreshRSS/FreshRSS/issues/2119 fix https://github.com/FreshRSS/FreshRSS/issues/2596 fix https://github.com/FreshRSS/FreshRSS/issues/3204 fix https://github.com/FreshRSS/FreshRSS/issues/4405 fix https://github.com/FreshRSS/FreshRSS/issues/5529 fix https://github.com/FreshRSS/FreshRSS/issues/5864 fix https://github.com/FreshRSS/Extensions/issues/161 URL parameters: * `&sort=id` (current behaviour, sorting according to newest received articles) * `&sort=date` (publication date, which is not indicative of how new an article is) * `&sort=title` * `&sort=link` * `&sort=rand` (random order - which disables infinite scrolling, at least for now) combined with `&order=ASC` or `&order=DESC` ![image](https://github.com/user-attachments/assets/2de5aef1-604e-4a73-a147-569f6f42a1be) ## Implementation notes The sorting criteria by *received date* (id), which is the default, and which was the only one before this PR, is the one that has the best sorting characteristics: * *uniqueness*: no entries have the exact same received date * *monotonicity*: new entries always have a higher received date * *performance*: this field is efficiently indexed in database for fast usage, including for paging (indexing could also be done to other fields, but with lower effective performance) In contrary, sorting criteria such as by *publication date*, by *title*, or by *link* are neither unique nor monotonic. In particular, multiple articles may share the same *publication date*, and we may receive articles with a *publication date* far in the future, and then later some new articles with a *publication date* far in the past. To understand why sorting by *publication date* is problematic, it helps to think about sorting by *title* or by *link*, as sorting by *title* and by *publication date* share more or less the same characteristics. ### Problem 1: new articles New articles may be received in the background after what is shown on screen, and before the next user action such as *mark all as read*. Due to the lack of *monotonicity* when sorting by e.g. *publication date* or *title*, users risk marking as read a batch of articles containing some fresh articles without seeing them. Mitigation: A parameter `idMax` tracks the maximum ID related to a batch of actions such as *mark all as read* to exclude articles received after those that are displayed. ### Problem 2: paging / pagination When navigating articles, only a few articles are displayed, and a new "page" of articles needs to be received from the database when scrolling down or when clicking the button to show more articles. When sorting by e.g. *publication date* or *title*, it is not trivial to show the next page without re-showing some of the same articles, and without skipping any. Indeed, views are often with additional criteria such as showing only unread articles, and users may mark some articles as read while viewing them, hereby removing some articles from the previous pages. And like for *Problem 1*, new articles may have been received in the background. Consequently, it is not possible to use `OFFSET` to implement pagination (so the patches suggested by a few users were wrong due to that, in particular). Mitigation: `idMax` is also used (just like for *Problem 1*) and a *Keyset Pagination* approach is used, combining an unstable sorting criterion such as *publication date* or *title*, together with *id* to ensure stable sorting. (So, 2 sorting criteria + 1 filter criteria) See e.g. https://www.alwaysdeveloping.net/dailydrop/2022/07/01-keyset-pagination/ ### Problem 3: performance Sorting by anything else than *received date* (id) is doomed to be slow(er) due to the combination of 3 criteria (see *Problem 2*). An `OFFSET` approach (which is not possible anyway as explained) would be even slower. Furthermore, we have no SQL index at the moment, but they would not necessarily help much due to the multiple sorting criteria needed and involving some `OR` logic which is difficult to optimise for databases. The nicest syntax would be using tuples and corresponding indexes, but that is poorly supported by MySQL https://bugs.mysql.com/bug.php?id=104128 Mitigation: a compatibility SQL syntax is used to implement *Keyset Pagination* ### Problem 4: user confusion Several users have shown that they do not fully understand the difference between *received date* and *publication date*, and particularly not the pitfalls of *publication date*. Mitigation: the menus to mark-as-read *before 1 day* and *before 1 week* are disabled when sorting by anything else than *received date*. Likewise, the separation headers *Today* and *Yesterday* and *Before yesterday* are only shown when sorting by *received date*. Again here, to better understand why, it helps to think about sorting by *title* or by *link*, as sorting by *title* and by *publication date* share more or less the same characteristics. * [ ] We should write a Q&A and/or documentation about the problems associated to *sorting by publication date*: risks of not noticing new publication, of inadvertently marking them as read, of having some articles with a date in the future hanging at the top of the views (vice versa when sorting in ascending order), performance, etc. ### Problem 5: APIs Sorting by anything else than *received date* breaks the guarantees needed for a successful synchronisation via API. Mitigation: sorting by *received date* is ensured for all API calls.
2024-12-27PHPStan 2.0 (#7131)Gravatar Alexandre Alapetite
* PHPStan 2.0 fix https://github.com/FreshRSS/FreshRSS/issues/6989 https://github.com/phpstan/phpstan/releases/tag/2.0.0 https://github.com/phpstan/phpstan/blob/2.0.x/UPGRADING.md * More * More * Done * fix i18n CLI * Restore a PHPStan Next test For work towards PHPStan Level 10 * 4 more on Level 10 * fix getTagsForEntry * API at Level 10 * More Level 10 * Finish Minz at Level 10 * Finish CLI at Level 10 * Finish Controllers at Level 10 * More Level 10 * More * Pass bleedingEdge * Clean PHPStan options and add TODOs * Level 10 for main config * More * Consitency array vs. list * Sanitize themes get_infos * Simplify TagDAO->getTagsForEntries() * Finish reportAnyTypeWideningInVarTag * Prepare checkBenevolentUnionTypes and checkImplicitMixed * Fixes * Refix * Another fix * Casing of __METHOD__ constant
2024-11-28Upgrade code to php 8.1 (#6748)Gravatar Luc SANCHEZ
* revert Fix code indentation Fix code Upgrade code to php 8.1 * fix remarques * code review * code review * code review * Apply suggestions from code review * code review * Fixes * Many remainging updates of array syntax * Lost case 'reading-list' * Uneeded PHPDoc --------- Co-authored-by: Luc Sanchez <l.sanchez-prestataire@alptis.fr> Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>
2024-11-21Add extension hook simplepie_after_init (#7007)Gravatar Alexandre Alapetite
* Add extension hook simplepie_after_init fix https://github.com/FreshRSS/FreshRSS/issues/7006 * Add documentation note * fix doc get_headers * Syntax void * Forgotten code
2024-10-14Add hook entries_favorite (#6880)Gravatar Alexandre Alapetite
Called when entries are starred or unstarred
2024-09-22Fix HTML encodings in e.g. cURL options (#6821)Gravatar Alexandre Alapetite
* Fix HTML encodings in e.g. cURL options * Trim headers whitespace
2024-09-15Rename param specialchars to plaintext (#6809)Gravatar Alexandre Alapetite
https://github.com/FreshRSS/FreshRSS/pull/6800#discussion_r1756435762
2024-09-12Fix inversed encoding logic in paramArray (#6800)Gravatar Alexandre Alapetite
* Fix inversed encoding logic in paramArray https://github.com/FreshRSS/FreshRSS/pull/6797#discussion_r1754661634 Also fix the possibility to use `<'&">` in shortcuts, and some minor encoding bugs in user queries * Forgot paramArrayString
generated by cgit v1.2.3 (git 2.39.1) at 2026-02-11 05:30:54 +0000