diff --git a/CHANGELOG.md b/CHANGELOG.md index b96e280f4..0c8655bca 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,21 +1,31 @@ -# Changelog +# Changelog ## 2016-XX-XX FreshRSS 1.5.x-dev * Compatibility * Require at least MySQL 5.5.3+ [#1153](https://github.com/FreshRSS/FreshRSS/issues/1153) * Require at least PHP 5.3.3+ [#1183](https://github.com/FreshRSS/FreshRSS/pull/1183) + * Restore compatibility with PHP 5.3.3 [#1208](https://github.com/FreshRSS/FreshRSS/issues/1208) * Restore compatibility with Microsoft Internet Explorer 11 / Edge [#772](https://github.com/FreshRSS/FreshRSS/issues/772) * Features * Support for full Unicode such as emoji 💕 in MySQL with utf8mb4 [#1153](https://github.com/FreshRSS/FreshRSS/issues/1153) * FreshRSS will automatically migrate MySQL tables to utf8mb4 the first time it is needed. * Security * Remove Mozilla Persona login (the service closes on 2016-11-30) [#1052](https://github.com/FreshRSS/FreshRSS/issues/1052) + * Use Referrer Policy `` for anonymizing HTTP Referer [#955](https://github.com/FreshRSS/FreshRSS/issues/955) + * Implement CSRF tokens for POST security [#570](https://github.com/FreshRSS/FreshRSS/issues/570) * Bug fixing * Fixed scroll in log view [#1178](https://github.com/FreshRSS/FreshRSS/issues/1178) * Fixed JavaScript bug when articles were not always marked as read [#1123](https://github.com/FreshRSS/FreshRSS/issues/1123) + * Fixed Apache Etag issue that prevented caching [#1199](https://github.com/FreshRSS/FreshRSS/pull/1199) + * Fixed OPML import of categories [#1202](https://github.com/FreshRSS/FreshRSS/issues/1202) +* UI + * Updated to jQuery 3.1.0 and several JavaScript fixes (e.g. drag & drop) [#1197](https://github.com/FreshRSS/FreshRSS/pull/1197) * API * Add API link in FreshRSS profile settings to ease set-up [#1186](https://github.com/FreshRSS/FreshRSS/pull/1186) +* Mics. + * JSHint of JavaScript code and better initialisation [#1196](https://github.com/FreshRSS/FreshRSS/pull/1196) + * Updated credits, and images in README [#1201](https://github.com/FreshRSS/FreshRSS/issues/1201) ## 2016-07-23 FreshRSS 1.4.0 @@ -102,7 +112,7 @@ * Session cookie bug [#924](https://github.com/FreshRSS/FreshRSS/issues/924) * Better error handling for PubSubHubbub [#939](https://github.com/FreshRSS/FreshRSS/issues/939) * Fix tag search link from articles [#970](https://github.com/FreshRSS/FreshRSS/issues/970) - * Fix all quieries deleted when deleting a feed or category [#982](https://github.com/FreshRSS/FreshRSS/pull/982) + * Fix all queries deleted when deleting a feed or category [#982](https://github.com/FreshRSS/FreshRSS/pull/982) ## 2015-07-30 FreshRSS 1.1.2-beta diff --git a/README.fr.md b/README.fr.md index 91903305c..8324b9657 100644 --- a/README.fr.md +++ b/README.fr.md @@ -12,7 +12,7 @@ Il supporte [PubSubHubbub](https://code.google.com/p/pubsubhubbub/) pour des not * Démo : http://demo.freshrss.org/ * Licence : [GNU AGPL 3](http://www.gnu.org/licenses/agpl-3.0.html) -![Logo de FreshRSS](http://marienfressinaud.fr/data/images/freshrss/freshrss_title.png) +![Logo de FreshRSS](./doc/FreshRSS-logo.png) # Téléchargement Voir la [liste des versions](../../releases). @@ -41,7 +41,7 @@ Nous sommes une communauté amicale. * Fonctionne aussi sur mobile * L’entête HTTP `Referer` ne doit pas être désactivé pour pouvoir utiliser le formulaire de connexion -![Capture d’écran de FreshRSS](http://marienfressinaud.fr/data/images/freshrss/freshrss_default-design.png) +![Capture d’écran de FreshRSS](./doc/FreshRSS-screenshot.png) # Installation 1. Récupérez l’application FreshRSS via la commande git ou [en téléchargeant l’archive](../releases) @@ -124,6 +124,8 @@ mysqldump -u utilisateur -p --databases freshrss > freshrss.sql * [MINZ](https://github.com/marienfressinaud/MINZ) * [php-http-304](http://alexandre.alapetite.fr/doc-alex/php-http-304/) * [jQuery](http://jquery.com/) +* [ArthurHoaro/favicon](https://github.com/ArthurHoaro/favicon) +* [lib_opml](https://github.com/marienfressinaud/lib_opml) * [keyboard_shortcuts](http://www.openjs.com/scripts/events/keyboard_shortcuts/) * [flotr2](http://www.humblesoftware.com/flotr2) diff --git a/README.md b/README.md index f46359219..844967f4f 100644 --- a/README.md +++ b/README.md @@ -12,7 +12,7 @@ It supports [PubSubHubbub](https://code.google.com/p/pubsubhubbub/) for instant * Demo: http://demo.freshrss.org/ * License: [GNU AGPL 3](http://www.gnu.org/licenses/agpl-3.0.html) -![FreshRSS logo](http://marienfressinaud.fr/data/images/freshrss/freshrss_title.png) +![FreshRSS logo](./doc/FreshRSS-logo.png) # Releases See the [list of releases](../../releases). @@ -41,7 +41,7 @@ We are a friendly community. * Works on mobile * The browser HTTP `Referer` header must not be disabled when using the form login method -![FreshRSS screenshot](http://marienfressinaud.fr/data/images/freshrss/freshrss_default-design.png) +![FreshRSS screenshot](./doc/FreshRSS-screenshot.png) # Installation 1. Get FreshRSS with git or [by downloading the archive](https://github.com/FreshRSS/FreshRSS/archive/master.zip) @@ -124,6 +124,8 @@ mysqldump -u user -p --databases freshrss > freshrss.sql * [MINZ](https://github.com/marienfressinaud/MINZ) * [php-http-304](http://alexandre.alapetite.fr/doc-alex/php-http-304/) * [jQuery](http://jquery.com/) +* [ArthurHoaro/favicon](https://github.com/ArthurHoaro/favicon) +* [lib_opml](https://github.com/marienfressinaud/lib_opml) * [keyboard_shortcuts](http://www.openjs.com/scripts/events/keyboard_shortcuts/) * [flotr2](http://www.humblesoftware.com/flotr2) diff --git a/app/Controllers/configureController.php b/app/Controllers/configureController.php index d0f0bd68b..147a2fe06 100755 --- a/app/Controllers/configureController.php +++ b/app/Controllers/configureController.php @@ -139,7 +139,7 @@ class FreshRSS_configure_Controller extends Minz_ActionController { */ public function sharingAction() { if (Minz_Request::isPost()) { - $params = Minz_Request::params(); + $params = Minz_Request::fetchGET(); FreshRSS_Context::$user_conf->sharing = $params['share']; FreshRSS_Context::$user_conf->save(); invalidateHttpCache(); @@ -282,7 +282,7 @@ class FreshRSS_configure_Controller extends Minz_ActionController { foreach (FreshRSS_Context::$user_conf->queries as $key => $query) { $queries[$key] = new FreshRSS_UserQuery($query, $feed_dao, $category_dao); } - $params = Minz_Request::params(); + $params = Minz_Request::fetchGET(); $params['url'] = Minz_Url::display(array('params' => $params)); $params['name'] = _t('conf.query.number', count($queries) + 1); $queries[] = new FreshRSS_UserQuery($params, $feed_dao, $category_dao); diff --git a/app/Controllers/indexController.php b/app/Controllers/indexController.php index 7e626720e..2332d225d 100755 --- a/app/Controllers/indexController.php +++ b/app/Controllers/indexController.php @@ -32,9 +32,9 @@ class FreshRSS_index_Controller extends Minz_ActionController { Minz_Error::error(404); } - $this->view->callbackBeforeContent = function() { + $this->view->callbackBeforeContent = function($view) { try { - $entries = $this->listEntriesByContext(); + $entries = FreshRSS_index_Controller::listEntriesByContext(); $nb_entries = count($entries); if ($nb_entries > FreshRSS_Context::$number) { @@ -55,15 +55,15 @@ class FreshRSS_index_Controller extends Minz_ActionController { } } - $this->view->entries = $entries; + $view->entries = $entries; } catch (FreshRSS_EntriesGetter_Exception $e) { Minz_Log::notice($e->getMessage()); Minz_Error::error(404); } - $this->view->categories = FreshRSS_Context::$categories; + $view->categories = FreshRSS_Context::$categories; - $this->view->rss_title = FreshRSS_Context::$name . ' | ' . Minz_View::title(); + $view->rss_title = FreshRSS_Context::$name . ' | ' . Minz_View::title(); $title = FreshRSS_Context::$name; if (FreshRSS_Context::$get_unread > 0) { $title = '(' . FreshRSS_Context::$get_unread . ') ' . $title; @@ -132,7 +132,7 @@ class FreshRSS_index_Controller extends Minz_ActionController { } try { - $this->view->entries = $this->listEntriesByContext(); + $this->view->entries = FreshRSS_index_Controller::listEntriesByContext(); } catch (FreshRSS_EntriesGetter_Exception $e) { Minz_Log::notice($e->getMessage()); Minz_Error::error(404); @@ -189,7 +189,7 @@ class FreshRSS_index_Controller extends Minz_ActionController { /** * This method returns a list of entries based on the Context object. */ - private function listEntriesByContext() { + public static function listEntriesByContext() { $entryDAO = FreshRSS_Factory::createEntryDao(); $get = FreshRSS_Context::currentGet(true); diff --git a/app/FreshRSS.php b/app/FreshRSS.php index 20640266e..f9c371d27 100644 --- a/app/FreshRSS.php +++ b/app/FreshRSS.php @@ -57,7 +57,7 @@ class FreshRSS extends Minz_FrontController { private static function initAuth() { FreshRSS_Auth::init(); - if (Minz_Request::isPost() && !is_referer_from_same_domain()) { + if (Minz_Request::isPost() && !(is_referer_from_same_domain() && FreshRSS_Auth::isCsrfOk())) { // Basic protection against XSRF attacks FreshRSS_Auth::removeAccess(); $http_referer = empty($_SERVER['HTTP_REFERER']) ? '' : $_SERVER['HTTP_REFERER']; diff --git a/app/Models/Auth.php b/app/Models/Auth.php index d689f7cdb..b93942e19 100644 --- a/app/Models/Auth.php +++ b/app/Models/Auth.php @@ -124,6 +124,7 @@ class FreshRSS_Auth { self::$login_ok = false; $conf = Minz_Configuration::get('system'); Minz_Session::_param('currentUser', $conf->default_user); + Minz_Session::_param('csrf'); switch ($conf->auth_type) { case 'form': @@ -156,6 +157,26 @@ class FreshRSS_Auth { $auth_type = $conf->auth_type; return $auth_type === 'form'; } + + public static function csrfToken() { + $csrf = Minz_Session::param('csrf'); + if ($csrf == '') { + $salt = FreshRSS_Context::$system_conf->salt; + $csrf = sha1($salt . uniqid(mt_rand(), true)); + Minz_Session::_param('csrf', $csrf); + } + return $csrf; + } + public static function isCsrfOk($token = null) { + $csrf = Minz_Session::param('csrf'); + if ($csrf == '') { + return true; //Not logged in yet + } + if ($token === null) { + $token = Minz_Request::fetchPOST('_csrf'); + } + return $token === $csrf; + } } diff --git a/app/Models/EntryDAOSQLite.php b/app/Models/EntryDAOSQLite.php index ff049d813..19b97fd3a 100644 --- a/app/Models/EntryDAOSQLite.php +++ b/app/Models/EntryDAOSQLite.php @@ -2,11 +2,12 @@ class FreshRSS_EntryDAOSQLite extends FreshRSS_EntryDAO { - protected function autoAddColumn($errorInfo) { + protected function autoUpdateDb($errorInfo) { if (empty($errorInfo[0]) || $errorInfo[0] == '42S22') { //ER_BAD_FIELD_ERROR + //autoAddColumn if ($tableInfo = $this->bd->query("SELECT sql FROM sqlite_master where name='entry'")) { $showCreate = $tableInfo->fetchColumn(); - Minz_Log::debug('FreshRSS_EntryDAOSQLite::autoAddColumn: ' . $showCreate); + Minz_Log::debug('FreshRSS_EntryDAOSQLite::autoUpdateDb: ' . $showCreate); foreach (array('lastSeen', 'hash') as $column) { if (stripos($showCreate, $column) === false) { return $this->addColumn($column); diff --git a/app/i18n/cz/index.php b/app/i18n/cz/index.php index 5691d12af..cb0e5955d 100644 --- a/app/i18n/cz/index.php +++ b/app/i18n/cz/index.php @@ -6,7 +6,7 @@ return array( 'agpl3' => 'AGPL 3', 'bugs_reports' => 'Hlášení chyb', 'credits' => 'Poděkování', - 'credits_content' => 'Některé designové prvky pocházejí z Bootstrap, FreshRSS ale tuto platformu nevyužívá. Ikony pocházejí z GNOME projektu. Font Open Sans vytvořil Steve Matteson. Favicony jsou shromažďovány pomocí getFavicon API. FreshRSS je založen na PHP framework Minz.', + 'credits_content' => 'Některé designové prvky pocházejí z Bootstrap, FreshRSS ale tuto platformu nevyužívá. Ikony pocházejí z GNOME projektu. Font Open Sans vytvořil Steve Matteson. FreshRSS je založen na PHP framework Minz.', 'freshrss_description' => 'FreshRSS je čtečka RSS kanálů určená k provozu na vlastním serveru, podobná Kriss Feed nebo Leed. Je to nenáročný a jednoduchý, zároveň ale mocný a konfigurovatelný nástroj.', 'github' => 'na Github', 'license' => 'Licence', diff --git a/app/i18n/de/index.php b/app/i18n/de/index.php index 04798cdce..df92d8085 100644 --- a/app/i18n/de/index.php +++ b/app/i18n/de/index.php @@ -6,7 +6,7 @@ return array( 'agpl3' => 'AGPL 3', 'bugs_reports' => 'Fehlerberichte', 'credits' => 'Credits', - 'credits_content' => 'Einige Designelemente stammen von Bootstrap, obwohl FreshRSS dieses Framework nicht nutzt. Icons stammen vom GNOME project. Open Sans Font wurde von Steve Matteson erstellt. Favicons werden mit getFavicon API gesammelt. FreshRSS basiert auf Minz, einem PHP-Framework.', + 'credits_content' => 'Einige Designelemente stammen von Bootstrap, obwohl FreshRSS dieses Framework nicht nutzt. Icons stammen vom GNOME project. Open Sans Font wurde von Steve Matteson erstellt. FreshRSS basiert auf Minz, einem PHP-Framework.', 'freshrss_description' => 'FreshRSS ist ein RSS-Feedsaggregator zum selbst hosten wie zum Beispiel Kriss Feed oder Leed. Er ist leicht und einfach zu handhaben und gleichzeitig ein leistungsstarkes und konfigurierbares Werkzeug.', 'github' => 'on Github', 'license' => 'Lizenz', diff --git a/app/i18n/en/index.php b/app/i18n/en/index.php index 80fa3d950..eb6413e3c 100644 --- a/app/i18n/en/index.php +++ b/app/i18n/en/index.php @@ -6,7 +6,7 @@ return array( 'agpl3' => 'AGPL 3', 'bugs_reports' => 'Bugs reports', 'credits' => 'Credits', - 'credits_content' => 'Some design elements come from Bootstrap although FreshRSS doesn’t use this framework. Icons come from GNOME project. Open Sans font police has been created by Steve Matteson. Favicons are collected with getFavicon API. FreshRSS is based on Minz, a PHP framework.', + 'credits_content' => 'Some design elements come from Bootstrap although FreshRSS doesn’t use this framework. Icons come from GNOME project. Open Sans font police has been created by Steve Matteson. FreshRSS is based on Minz, a PHP framework.', 'freshrss_description' => 'FreshRSS is a RSS feeds aggregator to self-host like Kriss Feed or Leed. It is light and easy to take in hand while being powerful and configurable tool.', 'github' => 'on Github', 'license' => 'License', diff --git a/app/i18n/fr/index.php b/app/i18n/fr/index.php index 7e028ab92..62eedc280 100644 --- a/app/i18n/fr/index.php +++ b/app/i18n/fr/index.php @@ -6,7 +6,7 @@ return array( 'agpl3' => 'AGPL 3', 'bugs_reports' => 'Rapports de bugs', 'credits' => 'Crédits', - 'credits_content' => 'Des éléments de design sont issus du projet Bootstrap bien que FreshRSS n’utilise pas ce framework. Les icônes sont issues du projet GNOME. La police Open Sans utilisée a été créée par Steve Matteson. Les favicons sont récupérés grâce au site getFavicon. FreshRSS repose sur Minz, un framework PHP.', + 'credits_content' => 'Des éléments de design sont issus du projet Bootstrap bien que FreshRSS n’utilise pas ce framework. Les icônes sont issues du projet GNOME. La police Open Sans utilisée a été créée par Steve Matteson. FreshRSS repose sur Minz, un framework PHP.', 'freshrss_description' => 'FreshRSS est un agrégateur de flux RSS à auto-héberger à l’image de Kriss Feed ou Leed. Il se veut léger et facile à prendre en main tout en étant un outil puissant et paramétrable.', 'github' => 'sur Github', 'license' => 'Licence', diff --git a/app/i18n/it/index.php b/app/i18n/it/index.php index 584b044b1..d79502c79 100644 --- a/app/i18n/it/index.php +++ b/app/i18n/it/index.php @@ -6,7 +6,7 @@ return array( 'agpl3' => 'AGPL 3', 'bugs_reports' => 'Bugs', 'credits' => 'Crediti', - 'credits_content' => 'Alcuni elementi di design provengono da Bootstrap sebbene FreshRSS non usi questo framework. Le icone provengono dal progetto GNOME. Il carattere Open Sans è stato creato da Steve Matteson. Le Favicons vengono estratte con le API getFavicon. FreshRSS è basato su Minz, un framework PHP.', + 'credits_content' => 'Alcuni elementi di design provengono da Bootstrap sebbene FreshRSS non usi questo framework. Le icone provengono dal progetto GNOME. Il carattere Open Sans è stato creato da Steve Matteson. FreshRSS è basato su Minz, un framework PHP.', 'freshrss_description' => 'FreshRSS è un aggregatore di feeds RSS da installare sul proprio host come Kriss Feed o Leed. Leggero e facile da mantenere pur essendo molto configurabile e potente.', 'github' => 'su Github', 'license' => 'Licenza', diff --git a/app/i18n/nl/index.php b/app/i18n/nl/index.php index df6a064e4..751806bfa 100644 --- a/app/i18n/nl/index.php +++ b/app/i18n/nl/index.php @@ -6,7 +6,7 @@ return array( 'agpl3' => 'AGPL 3', 'bugs_reports' => 'Rapporteer fouten', 'credits' => 'Waarderingen', - 'credits_content' => 'Sommige ontwerp elementen komen van Bootstrap alhoewel FreshRSS dit raamwerk niet gebruikt. Pictogrammen komen van het GNOME project. De Open Sans font police is gemaakt door Steve Matteson. Favicons zijn verzameld met de getFavicon API. FreshRSS is gebaseerd op Minz, een PHP raamwerk. Nederlandse vertaling door Wanabo, NieuwsKop.be. Link naar de Nederlandse vertaling, FreshRSS-Dutch-translation.', + 'credits_content' => 'Sommige ontwerp elementen komen van Bootstrap alhoewel FreshRSS dit raamwerk niet gebruikt. Pictogrammen komen van het GNOME project. De Open Sans font police is gemaakt door Steve Matteson. FreshRSS is gebaseerd op Minz, een PHP raamwerk. Nederlandse vertaling door Wanabo, NieuwsKop.be. Link naar de Nederlandse vertaling, FreshRSS-Dutch-translation.', 'freshrss_description' => 'FreshRSS is een RSS feed aggregator om zelf te hosten zoals Kriss Feed of Leed. Het gebruikt weinig systeembronnen en is makkelijk te administreren terwijl het een krachtig en makkelijk te configureren programma is.', 'github' => 'op Github', 'license' => 'License', diff --git a/app/i18n/ru/index.php b/app/i18n/ru/index.php index 80fa3d950..eb6413e3c 100644 --- a/app/i18n/ru/index.php +++ b/app/i18n/ru/index.php @@ -6,7 +6,7 @@ return array( 'agpl3' => 'AGPL 3', 'bugs_reports' => 'Bugs reports', 'credits' => 'Credits', - 'credits_content' => 'Some design elements come from Bootstrap although FreshRSS doesn’t use this framework. Icons come from GNOME project. Open Sans font police has been created by Steve Matteson. Favicons are collected with getFavicon API. FreshRSS is based on Minz, a PHP framework.', + 'credits_content' => 'Some design elements come from Bootstrap although FreshRSS doesn’t use this framework. Icons come from GNOME project. Open Sans font police has been created by Steve Matteson. FreshRSS is based on Minz, a PHP framework.', 'freshrss_description' => 'FreshRSS is a RSS feeds aggregator to self-host like Kriss Feed or Leed. It is light and easy to take in hand while being powerful and configurable tool.', 'github' => 'on Github', 'license' => 'License', diff --git a/app/i18n/tr/index.php b/app/i18n/tr/index.php index 9912203c8..cb36d6717 100644 --- a/app/i18n/tr/index.php +++ b/app/i18n/tr/index.php @@ -6,7 +6,7 @@ return array( 'agpl3' => 'AGPL 3', 'bugs_reports' => 'Hata raporu', 'credits' => 'Tanıtım', - 'credits_content' => 'Bu frameworkü kullanmamasına rağmen FreshRSS bazı tasarım ögelerini Bootstrap dan almıştır. İkonlar GNOME projesinden alınmıştır. Open Sans yazı tipi Steve Matteson tarafından oluşturulmuştur. Site ikonları getFavicon API ile oluşturuldu. FreshRSS bir PHP framework olan Minz i temel alır.', + 'credits_content' => 'Bu frameworkü kullanmamasına rağmen FreshRSS bazı tasarım ögelerini Bootstrap dan almıştır. İkonlar GNOME projesinden alınmıştır. Open Sans yazı tipi Steve Matteson tarafından oluşturulmuştur. FreshRSS bir PHP framework olan Minz i temel alır.', 'freshrss_description' => 'FreshRSS Kriss Feed veya Leed gibi kendi hostunuzda çalışan bir RSS akış toplayıcısıdır. Güçlü ve yapılandırılabilir araçlarıyla basit ve kullanımı kolay bir uygulamadır.', 'github' => 'Github sayfası', 'license' => 'Lisans', diff --git a/app/layout/aside_feed.phtml b/app/layout/aside_feed.phtml index 67507b88d..e8fdbf842 100644 --- a/app/layout/aside_feed.phtml +++ b/app/layout/aside_feed.phtml @@ -20,6 +20,7 @@
+