aboutsummaryrefslogtreecommitdiff
path: root/p
AgeCommit message (Collapse)Author
2025-08-11Fix chart.js support for SeaMonkey (#7816)Gravatar Inverle
SeaMonkey support was broken by #7752 Reproduce JS file: ```bash git clone https://github.com/chartjs/Chart.js && \ cd Chart.js && \ git checkout tags/v4.5.0 && \ sed -i 's/es2022/es2021/g' rollup.config.js && \ pnpm install && \ pnpm run build && \ sha256sum dist/chart.umd.min.js # SHA256 of dist/chart.umd.min.js should be: 311a5a5e0db077a787b782977f359a72f8584f94d800e324dcc6aefe8a006dd7 ```
2025-08-11Put CSP everywhere (#7810)Gravatar Inverle
* Puts CSP everywhere in `p/api` * including the HTML query page ❗ * Also in `p/ext.php` * Puts `X-Content-Type-Options: nosniff` everywhere * Fixes custom icon configuration not showing `blob:` icon in statsController (idle feeds) * Also removes `style-src 'unsafe-inline'` since it doesn't seem to be needed * Improves CSP of `p/f.php` * Add `sandbox` directive
2025-08-09Show warning when unsafe CSP policy is in use (#7804)Gravatar Inverle
* Show warning when unsafe CSP policy is in use * Fix bare markdown URL * i18n: fr * Minor i18n: fr * Add target="_blank" to i18n strings --------- Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>
2025-08-08New JS attribute: `data-auto-leave-validation` (#7785)Gravatar Inverle
Instead of a repeating pattern like: `<input type="text" value="something" data-leave-validation="something">`, you can now put a `data-auto-leave-validation="1"` attribute on a `<form>` for example, and it will automatically set the `data-leave-validation` attributes inside the form elements. `data_auto_leave_validation(parent)` from `extra.js` is called on slider open and page load. --------- Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr> Co-authored-by: Frans de Jonge <fransdejonge@gmail.com>
2025-08-08Avoid styling `<code>` inside of `<pre>` (#7797)Gravatar James Frost
* Remove background from <code> inside <pre> This caused an ugly effect where each line has a seperate background to the whole pre block. Fixes #7796 * Add James Frost to CREDITS.md
2025-08-06Improve sharing via Print (#7728)Gravatar Inverle
List of changes: * The temporary document for printing is now in an `<iframe>` instead of a new tab * The whole `<head>` element is copied to the temporary document, except for `<script>` tags to copy over the `<meta>` tags as well * URLs that contain the instance base URL are now removed from the printed PDF * The saved filename (PDF) will now default to the article title * `<details>` is auto expanded * Styling: * The main document's `<html>` class is copied over to preserve some styling that might use those classes * Instead of writing `content_el.innerHTML` to the temporary document, `content_el.outerHTML` is now written instead to apply the styles that select `.content` * `.dropdown-menu` is now hidden in the printed document, because it can't be expanded anyway * Headers and footers are hidden in the printed document * The printed document will now display correctly all the time, by waiting for it to load before calling `print()` * Before, the stylesheets might've not finished loading and the document was broken * Better browser support on mobile for this feature * Before, the document would fail to print on Chrome Mobile Tested on: * Firefox - both desktop and mobile, works ✅ * Chrome - both desktop and mobile, works ✅ * Opera - desktop, works (same as Chrome) ✅ * Brave - both desktop and mobile (same as Chrome), works ✅ * Safari - both desktop and mobile, works✅ * Microsoft Edge - both desktop and mobile, works ✅ * GNOME Web - desktop, works ✅ * SeaMonkey - desktop, works ✅ Known issues: * Images may not finish loading the first time the print dialog is opened TODO: * [x] Test on Safari * [x] Try to fix GNOME Web
2025-08-06GReader API: fix incorrect favicon URL (#7792)Gravatar hilariousperson
* GReader API: fix incorrect favicon URL * Fix compatibility with custom favicons --------- Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>
2025-08-04Fix regression promote user (#7786)Gravatar Alexandre Alapetite
Quick fix, while waiting for something better Regression from https://github.com/FreshRSS/FreshRSS/pull/7771
2025-08-01Rework fetch favicons (#7767)Gravatar Alexandre Alapetite
* Use main function `httpGet()` instead of local one; * Use HTTP cache, also between users; * Do not default to feed URL when there is no website URL TODO for later: consider supporting Atom's `<icon>` and RSS 2.0's `<image>` https://github.com/FreshRSS/FreshRSS/issues/7774
2025-07-31Implement sudo mode / reauthentication (#7753)Gravatar Inverle
* Implement sudo mode / reauthentication * i18n: fr * generate flags * Improvements * Remove HMAC check * Don't require reauth to access logs when signed in as admin * Notify user of bad login via notification instead --------- Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>
2025-07-31Require current password when setting new password (#7763)Gravatar Inverle
* Require current password when setting new password * i18n: fr --------- Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>
2025-07-25Update chart.js from 3.5.1 to 4.5.0 (#7752)Gravatar Inverle
2025-07-19WebSub: only perform a redirect when coming from WebSub (#7738)Gravatar Alexandre Alapetite
And add support for HTTP Link header for "self" URL Changing URL based on "self" URL will only be done when coming from a WebSub push fix https://github.com/FreshRSS/FreshRSS/issues/7737
2025-07-16Fix mark as read request showing popup due to onbeforeunload (#7554)Gravatar Inverle
* Prevent onbeforeunload from showing a popup before leaving * Send mark as read request when leaving and revert interval * Use visibilitychange event instead of onbeforeunload, and refactor send_mark_read_queue to use fetch * Move removed code to the new `catch` block * Refactor with async fetch
2025-07-16Fixes for frss.css (#7616)Gravatar Inverle
* Fixes for frss.css and make more buttons accessible in anonymous view * Suggested changes and page overflow fix * Forgot rtlcss * Revert anonymous view changes
2025-07-14Fix HTML queries with a single feed (#7730)Gravatar Inverle
* Fix HTML queries with single feed * Suggestion
2025-07-05Fix custom icons not displaying (#7717)Gravatar Inverle
* Fix custom icons not displaying * Refactor
2025-06-30Fix cancellation of slider exit (#7705)Gravatar Inverle
Previously when you clicked the "Cancel" button inside of the confirm dialog, the slider would close anyway.
2025-06-30Rework #7646: `URLSearchParams` -> `JSON.stringify` (#7704)Gravatar Inverle
* Rework #7646: `URLSearchParams` -> `JSON.stringify` * Single quotes * Send `id` as int
2025-06-30Implement custom feed favicons (#7646)Gravatar Inverle
Closes #3789, #6503 Icon setting when no custom icon is set yet: ![image](https://github.com/user-attachments/assets/28b07dd0-7dac-4c76-b1d7-77035f91a87a) - `Change...` button opens a file dialog, and after selecting a file shows the chosen icon in the preview on the left. `Submit` must be clicked after selecting the icon. - `Reset to default` changes the preview icon to the default one, and also requires `Submit` to be clicked to apply the changes. Full list of changes: - CSP now includes `blob:` in `img-src` for - `indexAction()` and `feedAction()` in `subscriptionController.php` - all of the view actions in `indexController.php` - Introduce new attribute `customFavicon (boolean)` for feeds that indicates if the feed has a custom favicon - `hashFavicon()` in `Feed.php` is dependent on this attribute - `hashFavicon()` has a new parameter called `skipCache (boolean)` that allows the reset of the favicon hash for the Feed object - `resetFaviconHash()` just calls `hashFavicon(skipCache: true)` - `f.php` URLs now have the format of `/f.php?h=XXXXX&t=cachebuster`, where the `t` parameter is only used for serving custom favicons - if `t` parameter is set, `f.php` returns a `Cache-Control: immutable` header - `stripos` and `strpos` were changed to `str_contains` in various places (refactor) - JS for handling the custom favicon configuration logic is in `extra.js` inside `init_update_feed()` which is called when feed configuration is opened from the aside or when the subscription management page with the feed is loaded - Server-side code for uploading the icon in `subscriptionController.php` under `feedAction()` - Errors that may occur during the setting of a custom favicon: - Unsupported image file type (handled only server-side with `isImgMime()`) - When the file is bigger than 1 MiB (default), handled both client-side and server-side - Standard feed error when `updateFeed()` fails - JS vars `javascript_vars.phtml` are no longer escaped with `htmlspecialchars()`, instead with json encoding, - CSS for disabled buttons was added - Max favicon file size is configurable with the `max_favicon_upload_size` option in `config.php` (not exposed via UI) - Custom favicons are currently deleted only when they are either reset to the default icon, or the feed gets deleted. They do not get deleted when the user deletes their account without removing their feeds first. - ` faviconPrepare()` and `faviconRebuild()` are not allowed to be called when the `customFavicon` attribute is `true` - New i18n strings: - `'sub.feed.icon' => 'Icon'` - `'sub.feed.change_favicon' => 'Change…'` - `'sub.feed.reset_favicon' => 'Reset to default'` - `'sub.feed.favicon_changed_by_ext' => 'The icon has been set by the <b>%s</b> extension.'` - `'feedback.sub.feed.favicon.too_large' => 'Uploaded icon is too large. The maximum file size is <em>%s</em>.'` - `'feedback.sub.feed.favicon.unsupported_format' => 'Unsupported image file format!'` - Extension hook `custom_favicon_hash` - `setCustomFavicon()` method - `resetCustomFavicon()` method - `customFaviconExt` and `customFaviconDisallowDel` attributes - example of usage: https://github.com/FreshRSS/Extensions/pull/337 - Extension hook `custom_favicon_btn_url` - Allows extensions to implement a button for setting a custom favicon for individual feeds by providing an URL. The URL will be sent a POST request with the `extAction` field set to either `query_icon_info` or `update_icon`, along with an `id` field which describes the feed's ID.
2025-06-29API add support for states in `s` streamId (#7695)Gravatar Alexandre Alapetite
https://github.com/Ashinch/ReadYou/issues/1081#issuecomment-3009682580 Some other implementations allow `s` to target states: * https://www.inoreader.com/developers/stream-ids * https://github.com/theoldreader/api/blob/master/README.md#item-ids * https://feedhq.readthedocs.io/en/latest/api/reference.html#stream-items-ids I find this behaviour redundant with `it`, but for the sake of compatibility
2025-06-18frame-ancestors CSP (#7677)Gravatar Inverle
2025-06-03Add API endpoint for extensions (#7576)Gravatar Alexandre Alapetite
* Add API endpoint for extensions Useful for https://github.com/FreshRSS/FreshRSS/issues/7572 * Support PATH_INFO Now also support being invoked like `/api/misc.php/Extension%20Name/` * More documentation
2025-06-03Include remaining tags/attributes for lazy loading (#7636)Gravatar Inverle
* Include remaining tags/attributes for lazy loading * Suggested change
2025-05-31Fix user self-deletion (#7626)Gravatar Inverle
* Fix user self-deletion * Minor code cleanup
2025-05-31API fix default category (#7610)Gravatar Alexandre Alapetite
fix https://github.com/FreshRSS/FreshRSS/issues/7368
2025-05-10Implement loading spinner for marking as favorite/read, read/unread (#7564)Gravatar Inverle
* Implement loading spinner for marking as favorite * Ensure that the correct previous icon gets set * Remove delay * Improve compatibility with various parsers Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr> * Support multiple icons (top, bottom) * Remove preload for now * Fix CSS, remove !important * Implement read/unread and alt * Ensure correct bookmark icon gets set after error --------- Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>
2025-05-09Fix favicon hashing in GReader API (#7573)Gravatar CarelessCaution
* Fix favicon hashing in GReader API (#7570) This allows the correct iconUrl to be returned from the GReader API for a given feed. * Fix method signature * Fix Fever API --------- Co-authored-by: CarelessCaution <189675655+CarelessCaution@users.noreply.github.com> Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>
2025-05-07Remove Apache 2.2 (only support Apache 2.4+) (#7561)Gravatar Alexandre Alapetite
Follow-up of https://github.com/FreshRSS/FreshRSS/pull/7552 I cannot find any distribution still supporting Apache 2.2
2025-05-07HTTP Cache-Control immutable (#7552)Gravatar Alexandre Alapetite
Start using `Cache-Control: immutable` for some resources served with a timestamp. https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Cache-Control#immutable The `<If>` directive requires Apache 2.4+
2025-05-02Fix file serving for symlinked extensions (#7545)Gravatar Inverle
* Fix file serving for symlinked extensions from ext.php * Don't resolve symlink when deleting extension * Minor syntax --------- Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>
2025-04-27Themes fix CSS .as-link (#7526)Gravatar Alexandre Alapetite
* Themes fix CSS .as-link Add missing rules. fix https://github.com/FreshRSS/FreshRSS/pull/7489#issuecomment-2781146577 * More fixes
2025-04-08Fix regression ext.php (#7499)Gravatar Alexandre Alapetite
fix https://github.com/FreshRSS/FreshRSS/issues/7498 Regression from https://github.com/FreshRSS/FreshRSS/pull/7495
2025-04-07Secure serving of user files from extensions (#7495)Gravatar Alexandre Alapetite
* Secure serving of user files from extensions fix https://github.com/FreshRSS/FreshRSS/issues/4930 * More fixes * Typo
2025-04-05Use HTTP POST for logout (#7489)Gravatar Alexandre Alapetite
* Use HTTP POST for logout To avoid potential CSRF risks * Fixed button font issue * Minor whitespace
2025-04-05Add :focus style to .dropdown-menu .item (#7491)Gravatar Frans de Jonge
So you can see keyboard focus. In reply to <https://github.com/FreshRSS/FreshRSS/pull/7489#issuecomment-2774759046>.
2025-04-03fix regression mapco/ansum theme (#7490)Gravatar maTh
fix of https://github.com/FreshRSS/FreshRSS/pull/7489#discussion_r2023760515 Regression #7314
2025-04-01Fix ext.php: Restrict valid paths in ext.php for extensions (#7479)Gravatar Alexandre Alapetite
* Fix ext.php: Restrict valid paths in ext.php for extensions Rework https://github.com/FreshRSS/FreshRSS/pull/7474 * Fix wrong variable
2025-04-01Restrict valid paths in ext.php for extensions (#7474)Gravatar Alexandre Alapetite
* Restrict valid paths in ext.php for extensions * Disallow absolute paths as well
2025-04-01Partial revert Referrer-Policy (#7478)Gravatar Alexandre Alapetite
https://github.com/FreshRSS/FreshRSS/pull/6303#issuecomment-2768907702 Was already implemented conditionally https://github.com/FreshRSS/FreshRSS/pull/1198
2025-04-01Referrer-Policy: same-origin (#6303)Gravatar maTh
* Referrer-Policy: same-origin * same-origin for our own images --------- Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>
2025-04-01Add CSP to favicons (#7471)Gravatar Alexandre Alapetite
E.g. for the case of SVGs
2025-03-25Update bcrypt.js from 2.4.4 to 3.0.2 (#7449)Gravatar Alexandre Alapetite
https://github.com/dcodeIO/bcrypt.js/releases/tag/v3.0.0 Can be updated to the latest version with: `curl -L https://unpkg.com/bcryptjs/umd/index.js > p/scripts/vendor/bcrypt.js`
2025-03-25JavaScript: new event to detect context loaded (#7452)Gravatar hkcomori
* Add JavaScript event: freshrss:globalContextLoaded * Update docs * Update docs: fix typo
2025-03-22Themes: .btn padding + small adjustments (#7168)Gravatar maTh
Closes https://github.com/FreshRSS/FreshRSS/issues/6262 Changes proposed in this pull request: - CSS: the search button was too big/not flexible enough for the height because of the padding How to test the feature manually: 1. browser configuration: change the default font size from (`16`pt mostly) to `15` or `14` 2. go to subscription management -> `Subscription tools` 3. there should be no scroll bar (because the left hand side navigation is short and the content right hand side is short too) Side effect: All buttons will be a bit smaller as before (because `px` -> `rem`) It should not be an issue at all
2025-03-22Fix API for labels with slash (#7437)Gravatar Alexandre Alapetite
fix https://github.com/FreshRSS/FreshRSS/issues/7435
2025-03-13Mark as read button: config for the size (#7314)Gravatar maTh
* settings * i18n: mark_read_button * big, small, none * fix * Fixes * make fix-all --------- Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>
2025-03-13Add check for Apache mod_filter to ensure "AddOutputFilterByType" works. (#7419)Gravatar Dezponia
* Update .htaccess Add check for Apache mod_filter to ensure "AddOutputFilterByType" works. * Explicit enabling mod_filter in our Docker images --------- Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>
2025-03-07improve origine theme (#7413)Gravatar maTh
* improve origine theme * .nav_menu .btn
2025-02-03Shortcuts for adding labels (#7274)Gravatar maTh
* add shortcut in config * open my labels menu with shortcut * the first 9 items are selectable + input field * i18n * Update app/i18n/nl/conf.php Co-authored-by: Frans de Jonge <fransdejonge@gmail.com> * index.menu.mylabels * order fixed --------- Co-authored-by: Frans de Jonge <fransdejonge@gmail.com>
generated by cgit v1.2.3 (git 2.39.1) at 2026-05-19 10:50:56 +0000