aboutsummaryrefslogtreecommitdiff
path: root/lib
AgeCommit message (Collapse)Author
9 daysUpdate phpmailer/phpmailer requirement from 7.0.1 to 7.0.2 in /lib (#8483)edgeGravatar dependabot[bot]
* Update phpmailer/phpmailer requirement from 7.0.1 to 7.0.2 in /lib Updates the requirements on [phpmailer/phpmailer](https://github.com/PHPMailer/PHPMailer) to permit the latest version. - [Release notes](https://github.com/PHPMailer/PHPMailer/releases) - [Changelog](https://github.com/PHPMailer/PHPMailer/blob/master/changelog.md) - [Commits](https://github.com/PHPMailer/PHPMailer/compare/v7.0.1...v7.0.2) --- updated-dependencies: - dependency-name: phpmailer/phpmailer dependency-version: 7.0.2 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com> * Update PHPMailer * Update changelog --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>
13 daysRewrite setcookie using new syntax (#8447)Gravatar Alexandre Alapetite
Follow-up of https://github.com/FreshRSS/FreshRSS/pull/2630 now that we have PHP 7.3+ (even PHP 8.1+). * The new syntax natively supports `samesite`, and also avoids the need of re-setting all parameters. * Use automatic path instead of own function `getCookieDir()`. Follow-up of https://github.com/FreshRSS/FreshRSS/pull/8446 * Sanitize lifetime of session cookies from PHP ini to avoid likely invalid/misunderstood values
2026-01-18Fix custom session.cookie-lifetime (#8446)Gravatar Alexandre Alapetite
fix https://github.com/FreshRSS/FreshRSS/issues/8430 Fix case when `session.cookie-lifetime` is not using the default value of 0 in PHP ini. Co-authored-by: rioky <rioky@users.noreply.github.com>
2026-01-18Bump SimplePie (#8445)Gravatar Alexandre Alapetite
https://github.com/simplepie/simplepie/pull/957
2026-01-17Bump SimplePie (#8443)Gravatar Alexandre Alapetite
* https://github.com/FreshRSS/simplepie/pull/68 * https://github.com/FreshRSS/simplepie/pull/69 fix https://github.com/FreshRSS/FreshRSS/issues/8441
2026-01-03Switch to using CURLOPT_ACCEPT_ENCODING instead of the deprecated ↵Gravatar Michael Meier
CURLOPT_ENCODING (#8376) * Replace deprecated CURLOPT_ENCODING The CURLOPT_ENCODING setting has been deprecated in favor of CURLOPT_ACCEPT_ENCODING. Signed-off-by: Michael Meier <mmeier1986@gmail.com> * Sync with our SimplePie fork PR https://github.com/FreshRSS/simplepie/pull/67 https://github.com/simplepie/simplepie/pull/960 https://github.com/simplepie/simplepie/pull/962 * Our SimplePie PR merged --------- Signed-off-by: Michael Meier <mmeier1986@gmail.com> Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>
2025-12-21Improve configuration checks (#8334)Gravatar Alexandre Alapetite
Add a distinction between recommended and required extensions. Add check for recommended php-intl extension as follow-up of https://github.com/FreshRSS/FreshRSS/pull/8329#issuecomment-3677686581 Improve related checks such as ZIP. Reduce duplicated translations and tests.
2025-12-17Use native PHP #[Deprecated] (#8325)Gravatar Alexandre Alapetite
https://php.watch/versions/8.4/Deprecated And enfore it with PHPUnit + PHPStan. Especially useful for extensions.
2025-12-16Safer handling of DB null content (#8319)Gravatar Alexandre Alapetite
https://github.com/FreshRSS/FreshRSS/discussions/8314#discussioncomment-15261119
2025-12-13New links in transitions and jump to next transition (#8294)Gravatar Alexandre Alapetite
Easier to explain graphically: <img width="408" height="266" alt="image" src="https://github.com/user-attachments/assets/0e3724a1-155b-4a87-89b3-cfe8a18cb100" /> The jump to next section ⏭ works when the sorting criterion is a date. Need https://github.com/FreshRSS/FreshRSS/pull/8293
2025-12-13Fix search encoding and quoting (#8311)Gravatar Alexandre Alapetite
Revised the encoding approach for searches: the HTML encoding is done just before its use for DB search. Fix also some cases with wrong quoting. Fix https://github.com/FreshRSS/FreshRSS/pull/8306#issuecomment-3643865439 Follow-up of https://github.com/FreshRSS/FreshRSS/pull/8293
2025-12-07Fix minor backslashes (#8292)Gravatar Alexandre Alapetite
2025-12-04Improve anonymous authentication logic (#8165)Gravatar Inverle
* Improve anonymous authentication logic * forgot to git add * Fix incorrect token check Because an empty parameter could be just passed if token for the user wasn't set: `&token=`
2025-12-02Update phpmailer/phpmailer requirement from 7.0.0 to 7.0.1 in /lib (#8272)Gravatar dependabot[bot]
* Update phpmailer/phpmailer requirement from 7.0.0 to 7.0.1 in /lib Updates the requirements on [phpmailer/phpmailer](https://github.com/PHPMailer/PHPMailer) to permit the latest version. - [Release notes](https://github.com/PHPMailer/PHPMailer/releases) - [Changelog](https://github.com/PHPMailer/PHPMailer/blob/master/changelog.md) - [Commits](https://github.com/PHPMailer/PHPMailer/compare/v7.0.0...v7.0.1) --- updated-dependencies: - dependency-name: phpmailer/phpmailer dependency-version: 7.0.1 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com> * composer update --no-autoloader --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>
2025-11-23Use native CSS instead of SCSS (#8241)Gravatar Alexandre Alapetite
I was tired of having to handle the SCSS themes differently. fix https://github.com/FreshRSS/FreshRSS/issues/7611 Follow-up of https://github.com/FreshRSS/FreshRSS/pull/8200 Convert Ansum and Mapco themes from SCSS to native CSS. The changes are actually quite limited (mostly changing the syntax of the variables and a few other things) Require support for: * https://developer.mozilla.org/en-US/docs/Web/CSS/Guides/Nesting * https://developer.mozilla.org/en-US/docs/Web/CSS/Reference/Selectors/Nesting_selector * https://developer.mozilla.org/en-US/docs/Web/CSS/color_value/color-mix SCSS and SAAS tools and references are also removed. Tests welcome. The styles are left as individual CSS files as designed originally in SCSS. I expect proper HTTP caching and HTTP/2 to be sufficient instead of aggregating back to a single CSS, but might be done in another PR if needed. At the same time, fixed the fact that we had various whitespace styles in our JSON files, in particular in those themes, sometimes with 2 spaces, or 4 spaces, or tabs. Use tabs everywhere as defined in editorconfig. I would like to merge this one first to complete https://github.com/FreshRSS/FreshRSS/pull/8230 * RTLCSS stringMap https://github.com/FreshRSS/FreshRSS/pull/8241#discussion_r2553175514 https://github.com/MohammadYounes/rtlcss/issues/108#issuecomment-347033134
2025-11-16Rework saving of configuration files (#8220)Gravatar Inverle
* Attempt to restore user config if `file_put_contents()` fails * Second approach * Minor preference: `.tmp.php` Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr> * Change boolean compare syntax Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr> * fix?
2025-11-13Exclude local networks for domain-wide Retry-After (#8195)Gravatar Alexandre Alapetite
* Exclude local networks for domain-wide Retry-After Retry-After will be applied by URL and not by domain for local networks. fix https://github.com/FreshRSS/FreshRSS/issues/7880 * Improved logic for detection of local domains * Support ip6-localhost and a couple more variants * On more: .lan * Resolve IP address * Add .intranet
2025-11-11Housekeeping lib_rss.php (#8193)Gravatar Alexandre Alapetite
* Housekeeping lib_rss.php `lib_rss.php` had become much too large, especially after https://github.com/FreshRSS/FreshRSS/pull/7924 Moved most functions to other places. Mostly no change of code otherwise (see comments). * Extension: composer run-script phpstan-third-party
2025-11-04Create separate `Retry-After` files for proxies (#8029)Gravatar Inverle
* Create separate `Retry-After` files for proxies Bad proxies are able to send a false `Retry-After` header and affect the availability of feeds (domain-wide) for other users. This PR starts including the address of the proxy if present in filenames for `Retry-After` to mitigate the issue. * Reduce code changes * Sync SimplePie fork https://github.com/FreshRSS/simplepie/pull/62 --------- Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>
2025-11-02Implement whitelist for SimplePie sanitizer (#7924)Gravatar Inverle
* Implement whitelist for SimplePie sanitizer ref: https://github.com/FreshRSS/FreshRSS/pull/7770#issuecomment-3140334326 https://github.com/FreshRSS/simplepie/pull/53 https://github.com/simplepie/simplepie/pull/947 * Remove `<plaintext>` from whitelist * Improve order * Remove some tags from whitelist * Revert partially * sync * Display contents of `<noscript>` and `<noembed>` * sync * Allow use of `<track>` * sync again * Sync to SimplePie fork https://github.com/FreshRSS/simplepie/pull/53 * Alphabetic order * Reduce list of stripped attributes * Temporarily strip some attributes --------- Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>
2025-11-01Update phpmailer/phpmailer requirement from 6.11.1 to 7.0.0 in /lib (#8180)Gravatar dependabot[bot]
* Update phpmailer/phpmailer requirement from 6.11.1 to 7.0.0 in /lib Updates the requirements on [phpmailer/phpmailer](https://github.com/PHPMailer/PHPMailer) to permit the latest version. - [Release notes](https://github.com/PHPMailer/PHPMailer/releases) - [Changelog](https://github.com/PHPMailer/PHPMailer/blob/master/changelog.md) - [Commits](https://github.com/PHPMailer/PHPMailer/compare/v6.11.1...v7.0.0) --- updated-dependencies: - dependency-name: phpmailer/phpmailer dependency-version: 7.0.0 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com> * composer update --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>
2025-11-01Fix/improve <textarea> (#8171)Gravatar maTh
## Feed configuration slider: ### Before: <img width="747" height="346" alt="grafik" src="https://github.com/user-attachments/assets/37056ef8-1163-48d1-a3dd-99e745418b2d" /> ### After: <img width="743" height="473" alt="grafik" src="https://github.com/user-attachments/assets/388a0ef6-633e-43ee-8ea5-5cbe7b40e6e4" /> ## CustomCSS, CustomJS extensions ### Before: <img width="762" height="504" alt="grafik" src="https://github.com/user-attachments/assets/279801fb-06a7-477a-81e7-c681087595a5" /> ### After: <img width="767" height="922" alt="grafik" src="https://github.com/user-attachments/assets/ca4cf304-03c7-4028-89d0-1c3094086176" /> And cleaning some CSS * UserCSS+JS: w100 h50 * clean textarea width height * feed config slider * Update base.rtl.css * fix class="valid-json" * padding + vertical-align * fix ansum mapco
2025-10-25CssXPath: Implement ~ subsequent-sibling (#8154)Gravatar Alexandre Alapetite
* CssXPath: Implement ~ Subsequent-sibling fix https://github.com/FreshRSS/FreshRSS/issues/8143 Upstream PR https://github.com/phpgt/CssXPath/pull/231 * Use CssXPath release v1.4.0 https://github.com/phpgt/CssXPath/releases/tag/v1.4.0
2025-10-25Bump phpstan/phpstan from 2.1.29 to 2.1.31 (#8156)Gravatar dependabot[bot]
* Bump phpstan/phpstan from 2.1.29 to 2.1.31 Bumps [phpstan/phpstan](https://github.com/phpstan/phpstan-phar-composer-source) from 2.1.29 to 2.1.31. - [Commits](https://github.com/phpstan/phpstan-phar-composer-source/commits) --- updated-dependencies: - dependency-name: phpstan/phpstan dependency-version: 2.1.31 dependency-type: direct:development update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> * Fixes --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>
2025-10-21Add support for extension compatibility (#8081)Gravatar Alexis Degrugillier
The compatibility does support only a minimum version of FreshRSS. If we need something a bit more clever in the future, it is possible to handle a rule with a bit more complexity. See https://github.com/FreshRSS/FreshRSS/issues/5903 * Update app/Controllers/extensionController.php Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr> * Update app/i18n/pl/admin.php Co-authored-by: Inverle <inverle@proton.me> * Minor move phpstan-type --------- Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr> Co-authored-by: Inverle <inverle@proton.me>
2025-10-15Filter on last user modified (#8093)Gravatar Alexandre Alapetite
Example: `userdate:PT1H` to select only articles modified by user during the last hour Fix https://github.com/FreshRSS/FreshRSS/issues/4280#issuecomment-3393078024 Useful for instance to bulk mark as unread recently marked articles by error: 1. Click on the toggle button to show the read articles (making sure the toggle for the unread articles is off) 2. Sort by *User modified 9→1* 3. Filter by *user modified date*, for instance to the last 3 hours by typing `userdate:PT3H` 4. Click in the drop-down menu *Mark selection as unread* P.S.: I have added at the same time a bunch of unit tests for date-related logic
2025-10-15Implement search form (#8103)Gravatar Alexandre Alapetite
* Add UI for advanced search To help users with the seach operators. Obviously not as powerful as a manually-written search query. Lack in particular negation and logical *and* for now, but I might try to do something about it. <img width="939" height="1438" alt="image" src="https://github.com/user-attachments/assets/0bcad39b-eff3-4f44-876b-a2552af2af00" /> * Consistency: allow multiple user queries like S:1,2 * Fix user query and add tests
2025-10-14Fix drag&drop of user query losing information (#8113)Gravatar Alexandre Alapetite
* Fix drag&drop of user query losing information Information about RSS sharing was lost after a drag&drop * Fix related type cast
2025-10-04Strengthen some crypto (#8061)Gravatar Alexandre Alapetite
For login, tokens, nonces
2025-10-02Add a new hook in the UI (#8054)Gravatar Alexis Degrugillier
* Add a new hook in the UI The new hook allows extension to add their own tool bar to navigate between entries. For instance, if the user wants less or more buttons that what's available by default. See #7912 See #7913 * add link data to ease navigation
2025-10-01SimplePie: apply HTTPS policy also on GUIDs and permalinks (#8037)Gravatar Alexandre Alapetite
* SimplePie: apply HTTPS policy also on GUIDs and permalinks Fix WordPress duplicates HTTP vs. HTTPS fix https://github.com/FreshRSS/FreshRSS/issues/5151 * Move code upstream * https://github.com/simplepie/simplepie/pull/951 * https://github.com/FreshRSS/simplepie/pull/59
2025-10-01Fix SimplePie support of HTTP trailer headers (#7983)Gravatar Alexandre Alapetite
* Fix SimplePie support of HTTP trailer headers fix https://github.com/FreshRSS/FreshRSS/discussions/7981 https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Trailer https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Server-Timing We need to use content-length to know where the body stops, but content-length is wrong is any compression was used. So let cURL perform the separation of HTTP headers and body instead of using the SimplePie parser. * Minor whitespace * Same change for lib_rss * Move changes to SimplePie repo https://github.com/FreshRSS/simplepie/pull/55 https://github.com/FreshRSS/simplepie/pull/57
2025-10-01Update phpmailer/phpmailer requirement from 6.10.0 to 6.11.1 in /lib (#8048)Gravatar dependabot[bot]
* Update phpmailer/phpmailer requirement from 6.10.0 to 6.11.1 in /lib Updates the requirements on [phpmailer/phpmailer](https://github.com/PHPMailer/PHPMailer) to permit the latest version. - [Release notes](https://github.com/PHPMailer/PHPMailer/releases) - [Changelog](https://github.com/PHPMailer/PHPMailer/blob/master/changelog.md) - [Commits](https://github.com/PHPMailer/PHPMailer/compare/v6.10.0...v6.11.1) --- updated-dependencies: - dependency-name: phpmailer/phpmailer dependency-version: 6.11.1 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com> * composer update --no-autoloader --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>
2025-10-01Add support for extension priority (#8038)Gravatar Alexis Degrugillier
Extension can now define their hook priority. This will allow to define the order in which hooks are triggered. See #7110 Closes #7110 Changes proposed in this pull request: - Add support for extension priority How to test the feature manually: 1. Create an extension with 2 hooks on the same hook type but different priority 2. The hooks must be prepending the title with different values 3. Validate that changing the hook priority changes the final title accordingly.
2025-10-01configurable notification timeout (#7942)Gravatar maTh
Ref #7931 Ref #5466 Ref #6409 added configuration in "Display" <img width="636" height="167" alt="grafik" src="https://github.com/user-attachments/assets/7bbc9f26-d91b-4dd2-b715-1d3f9b7a9ad3" /> * i18n: fr * Update app/i18n/pl/conf.php Co-authored-by: Inverle <inverle@proton.me> * make fix-all * max() * Minor whitespace (I am not a fan of excessive vertical indenting) --------- Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr> Co-authored-by: Inverle <inverle@proton.me>
2025-09-30Add hook enums (#8036)Gravatar Alexis Degrugillier
- add an enum to handle hook types (enum are available since PHP 8.1) - change hook calls from string value to enum value
2025-09-25Improve restriction of curl params (#8009)Gravatar Inverle
Rework #7979 Forgot to change `httpGet()`, which is used in multiple places
2025-09-23Lazy-load `<track src>` (#7997)Gravatar Inverle
Follow-up of #7636 I found it's the only missing element that needs to be lazy loaded by putting HTML of https://github.com/cure53/HTTPLeaks/blob/main/leak.html into a feed
2025-09-21Minor forgotten str_starts_with (#7991)Gravatar Alexandre Alapetite
A couple of places, which have been forgotten when we moved to using `str_starts_with()` instead of `strpos()`.
2025-09-21Add option for CSP frame-ancestors (#7857)Gravatar Alexandre Alapetite
* Add option for CSP frame-ancestors https://github.com/FreshRSS/FreshRSS/discussions/7856 * Revert contentSelectorPreviewAction * Same for f.php and api * Fix double init in f.php * No sandbox for API page
2025-09-18Add `entry_before_update` and `entry_before_add` hooks (#7977)Gravatar KleinMann
Discussion: https://github.com/FreshRSS/FreshRSS/discussions/7973 Changes proposed in this pull request: - Add new extension hook "entry_before_add" - Add new extension hook "entry_before_update" How to test the feature manually: 1. Create extension that uses the hooks and confirm they are invoked correctly. Extension to use for testing https://github.com/rnkln/freshrss-xExtension-Discord/pull/2
2025-09-18Restrict allowed curl parameters (#7979)Gravatar Inverle
For additional safety, also making sure in this PR that [`CURLOPT_COOKIEFILE`](https://curl.se/libcurl/c/CURLOPT_COOKIEFILE.html) is only allowed as an empty string during import.
2025-09-15SimplePie merge upstream (#7967)Gravatar Alexandre Alapetite
* https://github.com/simplepie/simplepie/pull/936 (Normalize encoding uppercase)
2025-09-13Bump SimplePie to 1.9.0 (#7955)Gravatar Alexandre Alapetite
Main change is https://github.com/simplepie/simplepie/pull/937 (PHP 8.5: Conditionally call deprecated functions) P.S. a sync with SimplePie upstream was already done recently, hence the limited changes: * https://github.com/FreshRSS/FreshRSS/pull/7775
2025-09-09Add a default language constant (#7933)Gravatar Alexis Degrugillier
This replace the use of `en` through out the code.
2025-09-05Change how files are included (#7916)Gravatar Alexis Degrugillier
1. `include`, `include_once`, `require` and `require_once` are expressions not functions, parentheses are not necessary. 2. to move up the directory tree, it's better to use the `dirname` function instead of relying on `/..`.
2025-08-31Fix log CRLF injection (#7883)Gravatar Inverle
* Fix log CRLF injection * empty -> space Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>
2025-08-30Regenerate session ID on login (#7829)Gravatar Inverle
Follow-up to #7762 * Regenerate session ID on login * Send only one cookie * Improvements * Delete old session file * Simplify * Make function consistent with others
2025-08-30Disallow setting non-existent language (#7878)Gravatar Inverle
The set language is used inside paths and can lead to issues by including PHP files from other locations
2025-08-30Fix curl response parsing (#7866)Gravatar Inverle
* Fix curl response parsing * Specify redirect count with `\SimplePie\HTTP\Parser::prepareHeaders()` instead Simply notify SimplePie of the redirect count before parsing * Better error check * Simplify
generated by cgit v1.2.3 (git 2.39.1) at 2026-02-10 08:30:11 +0000