aboutsummaryrefslogtreecommitdiff
path: root/p/f.php
AgeCommit message (Collapse)Author
2025-10-04Strengthen some crypto (#8061)Gravatar Alexandre Alapetite
For login, tokens, nonces
2025-09-21Add option for CSP frame-ancestors (#7857)Gravatar Alexandre Alapetite
* Add option for CSP frame-ancestors https://github.com/FreshRSS/FreshRSS/discussions/7856 * Revert contentSelectorPreviewAction * Same for f.php and api * Fix double init in f.php * No sandbox for API page
2025-09-05Change how files are included (#7916)Gravatar Alexis Degrugillier
1. `include`, `include_once`, `require` and `require_once` are expressions not functions, parentheses are not necessary. 2. to move up the directory tree, it's better to use the `dirname` function instead of relying on `/..`.
2025-09-05Fixes for no-cache.txt (#7907)Gravatar Inverle
* Closes and fixes error from #7885 * `no-cache.txt` is now respected in `f.php`, `ext.php` and `serve` action in `extensionController` * And in all other places that weren't checking for `no-cache.txt` (some extensions maybe)
2025-08-11Put CSP everywhere (#7810)Gravatar Inverle
* Puts CSP everywhere in `p/api` * including the HTML query page ❗ * Also in `p/ext.php` * Puts `X-Content-Type-Options: nosniff` everywhere * Fixes custom icon configuration not showing `blob:` icon in statsController (idle feeds) * Also removes `style-src 'unsafe-inline'` since it doesn't seem to be needed * Improves CSP of `p/f.php` * Add `sandbox` directive
2025-08-01Rework fetch favicons (#7767)Gravatar Alexandre Alapetite
* Use main function `httpGet()` instead of local one; * Use HTTP cache, also between users; * Do not default to feed URL when there is no website URL TODO for later: consider supporting Atom's `<icon>` and RSS 2.0's `<image>` https://github.com/FreshRSS/FreshRSS/issues/7774
2025-07-05Fix custom icons not displaying (#7717)Gravatar Inverle
* Fix custom icons not displaying * Refactor
2025-06-30Implement custom feed favicons (#7646)Gravatar Inverle
Closes #3789, #6503 Icon setting when no custom icon is set yet: ![image](https://github.com/user-attachments/assets/28b07dd0-7dac-4c76-b1d7-77035f91a87a) - `Change...` button opens a file dialog, and after selecting a file shows the chosen icon in the preview on the left. `Submit` must be clicked after selecting the icon. - `Reset to default` changes the preview icon to the default one, and also requires `Submit` to be clicked to apply the changes. Full list of changes: - CSP now includes `blob:` in `img-src` for - `indexAction()` and `feedAction()` in `subscriptionController.php` - all of the view actions in `indexController.php` - Introduce new attribute `customFavicon (boolean)` for feeds that indicates if the feed has a custom favicon - `hashFavicon()` in `Feed.php` is dependent on this attribute - `hashFavicon()` has a new parameter called `skipCache (boolean)` that allows the reset of the favicon hash for the Feed object - `resetFaviconHash()` just calls `hashFavicon(skipCache: true)` - `f.php` URLs now have the format of `/f.php?h=XXXXX&t=cachebuster`, where the `t` parameter is only used for serving custom favicons - if `t` parameter is set, `f.php` returns a `Cache-Control: immutable` header - `stripos` and `strpos` were changed to `str_contains` in various places (refactor) - JS for handling the custom favicon configuration logic is in `extra.js` inside `init_update_feed()` which is called when feed configuration is opened from the aside or when the subscription management page with the feed is loaded - Server-side code for uploading the icon in `subscriptionController.php` under `feedAction()` - Errors that may occur during the setting of a custom favicon: - Unsupported image file type (handled only server-side with `isImgMime()`) - When the file is bigger than 1 MiB (default), handled both client-side and server-side - Standard feed error when `updateFeed()` fails - JS vars `javascript_vars.phtml` are no longer escaped with `htmlspecialchars()`, instead with json encoding, - CSS for disabled buttons was added - Max favicon file size is configurable with the `max_favicon_upload_size` option in `config.php` (not exposed via UI) - Custom favicons are currently deleted only when they are either reset to the default icon, or the feed gets deleted. They do not get deleted when the user deletes their account without removing their feeds first. - ` faviconPrepare()` and `faviconRebuild()` are not allowed to be called when the `customFavicon` attribute is `true` - New i18n strings: - `'sub.feed.icon' => 'Icon'` - `'sub.feed.change_favicon' => 'Change…'` - `'sub.feed.reset_favicon' => 'Reset to default'` - `'sub.feed.favicon_changed_by_ext' => 'The icon has been set by the <b>%s</b> extension.'` - `'feedback.sub.feed.favicon.too_large' => 'Uploaded icon is too large. The maximum file size is <em>%s</em>.'` - `'feedback.sub.feed.favicon.unsupported_format' => 'Unsupported image file format!'` - Extension hook `custom_favicon_hash` - `setCustomFavicon()` method - `resetCustomFavicon()` method - `customFaviconExt` and `customFaviconDisallowDel` attributes - example of usage: https://github.com/FreshRSS/Extensions/pull/337 - Extension hook `custom_favicon_btn_url` - Allows extensions to implement a button for setting a custom favicon for individual feeds by providing an URL. The URL will be sent a POST request with the `extAction` field set to either `query_icon_info` or `update_icon`, along with an `id` field which describes the feed's ID.
2025-06-18frame-ancestors CSP (#7677)Gravatar Inverle
2025-04-01Add CSP to favicons (#7471)Gravatar Alexandre Alapetite
E.g. for the case of SVGs
2024-12-27PHPStan 2.0 (#7131)Gravatar Alexandre Alapetite
* PHPStan 2.0 fix https://github.com/FreshRSS/FreshRSS/issues/6989 https://github.com/phpstan/phpstan/releases/tag/2.0.0 https://github.com/phpstan/phpstan/blob/2.0.x/UPGRADING.md * More * More * Done * fix i18n CLI * Restore a PHPStan Next test For work towards PHPStan Level 10 * 4 more on Level 10 * fix getTagsForEntry * API at Level 10 * More Level 10 * Finish Minz at Level 10 * Finish CLI at Level 10 * Finish Controllers at Level 10 * More Level 10 * More * Pass bleedingEdge * Clean PHPStan options and add TODOs * Level 10 for main config * More * Consitency array vs. list * Sanitize themes get_infos * Simplify TagDAO->getTagsForEntries() * Finish reportAnyTypeWideningInVarTag * Prepare checkBenevolentUnionTypes and checkImplicitMixed * Fixes * Refix * Another fix * Casing of __METHOD__ constant
2024-11-28Upgrade code to php 8.1 (#6748)Gravatar Luc SANCHEZ
* revert Fix code indentation Fix code Upgrade code to php 8.1 * fix remarques * code review * code review * code review * Apply suggestions from code review * code review * Fixes * Many remainging updates of array syntax * Lost case 'reading-list' * Uneeded PHPDoc --------- Co-authored-by: Luc Sanchez <l.sanchez-prestataire@alptis.fr> Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>
2024-07-17Remove dependency to exif extension (#6624)Gravatar Alexandre Alapetite
* Remove dependency to exit extension fix https://github.com/FreshRSS/FreshRSS/issues/6573 * Fix return
2024-06-05Modernize code to php7.4 (#6043)Gravatar Luc SANCHEZ
* Modernize code to php7.4 * Modernize code to php7.4 * Modernize code to php7.4 * Modernize code to php7.4 * Modernize code to php7.4 * Modernize code to php7.4 * Modernize code to php7.4 * Modernize code to php7.4 * Modernize code to php7.4 * Modernize code to php7.4 * Modernize code to php7.4 * Modernize code to php7.4 * Modernize code to php7.4 * Consistency --------- Co-authored-by: Luc <sanchezluc+freshrss@gmail.com> Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>
2023-11-16Use strict_types (#5830)Gravatar Luc SANCHEZ
* Little's optimisations and booleans in conditions * Apply strict type * Apply strict type * Apply strict type * Fix multiple bugs with PHP 8.2 and 8.3 * Many declares missing, more errors fixed * Apply strict type * Another approach * Stronger typing for Minz_Session * Fix case of SQLite --------- Co-authored-by: Luc <sanchezluc+freshrss@gmail.com> Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>
2023-04-17Complete PHPStan Level 6 (#5305)Gravatar Alexandre Alapetite
* Complete PHPStan Level 6 Fix https://github.com/FreshRSS/FreshRSS/issues/4112 And initiate PHPStan Level 7 * PHPStan Level 6 for tests * Use phpstan/phpstan-phpunit * Update to PHPStan version 1.10 * Fix mixed bug * Fix mixed return bug * Fix paginator bug * Fix FreshRSS_UserConfiguration * A couple more Minz_Configuration bug fixes * A few trivial PHPStan Level 7 fixes * A few more simple PHPStan Level 7 * More files passing PHPStan Level 7 Add interface to replace removed class from https://github.com/FreshRSS/FreshRSS/pull/5251 * A few more PHPStan Level 7 preparations * A few last details
2023-04-05Fix phpstan level 9 error for f.php and lib/favicons.php (#5263)Gravatar Luc SANCHEZ
* Fix phpstan level 9 error * Fix phpstan level 9 error * Remarque's from Alkarex --------- Co-authored-by: Luc <sanchezluc+freshrss@gmail.com>
2023-01-29PHPStan level 9 for ./p/ and lib_rss.php (#5049)Gravatar Alexandre Alapetite
And app/FreshRSS.php Contributes to https://github.com/FreshRSS/FreshRSS/issues/4112
2020-06-06Return the correct Content-Type for SVG favicons (#3032)Gravatar Pablo Caro
* Return the correct Content-Type for SVG favicons * Use mime_content_type to check file type * Use tab instead of spaces * Remove extra blank lines Co-authored-by: Frans de Jonge <fransdejonge@gmail.com> * Update f.php * Better obey HTTP/1.1 304 Not Modified rules about headers https://tools.ietf.org/html/rfc2616#section-10.3.5 * Do not fail if the optional `fileinfo` is not available * Handle more cases such as PNG, GIF, BMP... * Add Content-Type for default favicon * Do not repeat HTTP headers in HTTP 304 response According to https://tools.ietf.org/html/rfc2616#section-10.3.5 it is better not to repeat HTTP headers in a HTTP 304 Not Modified response Co-authored-by: Frans de Jonge <fransdejonge@gmail.com> Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>
2019-09-29PDO refactoring for code simplification (#2522)Gravatar Alexandre Alapetite
* PDO refactor * Automatic prefix when using the syntax `_tableName` * Uniformity: MySQL is now PDO::ATTR_EMULATE_PREPARES = false just like SQLite and PostgreSQL, with consequences such as only one statement per query * Use PDO methods exec(), query(), prepare() + execute() in a more efficient way * Remove auto-update SQL code for versions older than FreshRSS 1.5 (3 years old) * The name of the default category is set in PHP instead of in the DB (simplies SQL and allows changing the name according to the FreshRSS language) * Rename `->bd` to `->pdo` (less of a frenshism, and more informative) * Fix some requests, which were not compatible with MySQL prepared statements * Whitespace * Fix syntax for PostgreSQL sequences + MySQL install * Minor formatting * Fix lastInsertId for PostgreSQL * Use PHP 5.6+ const Take advantage of https://github.com/FreshRSS/FreshRSS/pull/2527 https://www.php.net/manual/en/migration56.new-features.php * A bit of forgotten PHP 5.6 simplification for cURL * Forgotten $s * Mini fix custom user config https://github.com/FreshRSS/FreshRSS/pull/2490/files#r326290346 * More work on install.php but not finished * install.php working * More cleaning of PDO in install * Even more simplification Take advantage of PDO->exec() to run multiple statements * Disallow changing the name of the default category https://github.com/FreshRSS/FreshRSS/pull/2522#discussion_r326967724
2018-08-23Better rand() (#1977)Gravatar ColonelMoutarde
http://php.net/manual/en/function.mt-rand.php from php Doc "Many random number generators of older libcs have dubious or unknown characteristics and are slow. The mt_rand() function is a drop-in replacement for the older rand(). It uses a random number generator with known characteristics using the » Mersenne Twister, which will produce random numbers four times faster than what the average libc rand() provides. "
2017-12-11Use __DIR__ for relative include and requireGravatar Alexandre Alapetite
For uniformity, and to avoid having PHP searching in include_path. http://php.net/manual/function.include.php https://github.com/FreshRSS/FreshRSS/pull/1715 https://github.com/FreshRSS/FreshRSS/pull/1711#issuecomment-350581350
2017-04-23Rewriten Favicon library using cURLGravatar Alexandre Alapetite
Reduce the number of requests, more robust, many more cases working, reduced code
2016-10-12Cron refresh faviconsGravatar Alexandre Alapetite
Related to https://github.com/FreshRSS/FreshRSS/issues/1181 https://github.com/FreshRSS/FreshRSS/issues/1298
2016-10-12Randomize favicon refreshGravatar Alexandre Alapetite
https://github.com/FreshRSS/FreshRSS/issues/1298
2016-10-07Auto-refresh faviconsGravatar Alexandre Alapetite
Every 15 days. https://github.com/FreshRSS/FreshRSS/issues/1181
2016-04-23Adjust caching for favicon with errorsGravatar Alexandre Alapetite
2015-01-26Serve HTTP cache for default favicon + better headersGravatar Marien Fressinaud
See https://github.com/FreshRSS/FreshRSS/commit/da7d34d2ef45e4cfcf1410a279998f680a6338ea#commitcomment-9439610
2015-01-26Default favicon served with HTTP code 200Gravatar Marien Fressinaud
Fix https://github.com/FreshRSS/FreshRSS/issues/760
2014-12-29Fix behaviour when favicon url is not foundGravatar Marien Fressinaud
If url is not find, we copy default favicon into favicon dir so at the next try, we don't search the url again. See https://github.com/FreshRSS/FreshRSS/issues/290 See https://github.com/FreshRSS/FreshRSS/issues/727
2014-12-29Fix typo coding styleGravatar Marien Fressinaud
See https://github.com/FreshRSS/FreshRSS/issues/290
2014-12-29Change favicon getter behaviourGravatar Marien Fressinaud
- Use Favicon library - Fix coding style - Change default favicon Fix https://github.com/FreshRSS/FreshRSS/issues/290
2014-01-12Corrige problème favicons sous NginxGravatar Alexandre Alapetite
https://github.com/marienfressinaud/FreshRSS/issues/364
2013-12-26Favicons : test pour améliorer le cache HTTPGravatar Alexandre Alapetite
Test d'utilisation de PATH_INFO plutôt que QUERY_STRING pour améliorer la mise en cache. À tester sur différents serveurs
2013-12-26Favicons compatibles multi-utilisateursGravatar Alexandre Alapetite
Contribue à https://github.com/marienfressinaud/FreshRSS/issues/126
2013-12-26Cookie : sous-répertoire pour index (changements de répertoires !)Gravatar Alexandre Alapetite
Implémente https://github.com/marienfressinaud/FreshRSS/issues/333 /public/ est renommé /p/ /public/index.php est déplacé dans /p/i/index.php Le cookie de session est limité à /p/i/
generated by cgit v1.2.3 (git 2.39.1) at 2026-02-10 21:59:54 +0000