[pull] edge from FreshRSS:edge - #88
Open
pull[bot] wants to merge 2481 commits into
Open
Conversation
The `transition: width 200ms linear` rule on `.aside` in the narrow `@media` block stopped firing after #8201 added inline `display: none` toggling. Browsers don't interpolate width when an element flips to or from `display: none`, so width snaps on open and the close transition gets cut off before any frame renders. Replace the inline `display` toggle with an `is-hidden` class, applied only at wide viewports. At narrow viewports the existing `width: 0; position: fixed; overflow: hidden` already hides the element, so `display: none` is redundant there and was the only thing blocking the transition. Co-authored-by: Bjørn A. Andersen <polybjorn@users.noreply.github.com>
…8761) ## Summary `--width-aside` already existed in `base-theme/frss.css` but only as a fallback inside the narrow-viewport rule from #8749. Desktop `.aside`, `#nav_entries`, `.reader .aside.visible`, and `.header > .item.title` hardcoded `300px` independently. This PR makes `--width-aside` the canonical token for the navigation drawer / left column width, so theme overrides apply everywhere consistently. ## Changes `p/themes/base-theme/frss.css`: - Define `--width-aside: 300px` in `:root`. - `.aside`, `#nav_entries`, `.reader .aside.visible`, `.header > .item.title`: replace hardcoded `300px` with `var(--width-aside)`. - Narrow-viewport `.aside.visible`: drop the now-redundant `320px` fallback in `min(...)`. `p/themes/Swage/swage.css`: - Remove the now-redundant `width: var(--width-aside)` overrides on `.aside`, `#nav_entries`, and `.header > .item.title` (inherited from base now). Swage's `--width-aside: 231px` declaration stays in place, so `#nav_entries`, the header `.title` block, and the reader-view sidebar now resolve to 231 via the token (previously stuck at 300 from base hardcodes), aligning them with Swage's other column elements. RTL mirrors regenerated via `npm run rtlcss`. ## Why 300px 300px is the existing FreshRSS desktop sidebar value, so default themes see no visible change. The narrow-viewport cap previously used 320 as a fallback, but on actual phones the `calc(100vw - 56px)` cap dominates, so the change has near-zero practical effect on phone UX. Tablet and narrow-desktop sidebars become slightly narrower, more in line with typical desktop conventions. ## Tested - Origine, Flat, Swage at desktop widths - Origine and Swage at narrow viewports: sidebar slide, open, close - Reader view in Origine and Swage - Header title block: Swage 231, default themes 300 Co-authored-by: Bjørn A. Andersen <polybjorn@users.noreply.github.com>
* docs: mention db-backup.php and simplify git update steps Two follow-ups from Alkarex's review of #8741. Backup: add ./cli/db-backup.php to the "What to back up" list as a database-agnostic alternative to mysqldump/pg_dump. It was already documented further down the page; the top bullet just didn't point to it. Updating: replace the 6-step prose list in "Using git" with a command block matching the sequence in 07_LinuxUpdate.md. Drop the top-level "move your backup outside the directory" warning; git reset --hard doesn't need it, the real hazard is git clean -f -d removing untracked files, so the warning sits inline on that line. Link to the Linux page for the sudo and permissions-helper variant. * docs: restore backup warning, clarify git clean note Per @Alkarex review on #8763. Reword the inline `git clean` note to cover untracked files generally (themes, extensions, local edits) since backups are now called out separately above. --------- Co-authored-by: Bjørn A. Andersen <polybjorn@users.noreply.github.com>
Fix #8729 Follow-up of #7983 Related simplepie/simplepie#942
Apply sentence case to all H1s in docs/en/ and remove redundant "FreshRSS" from titles where the docs site context already implies it. Align the three section index titles to "Administrator/Developer/User manual", matching the existing root H1 "FreshRSS manual (English)". Add missing H1s to two pages that were silently dropped from the sidebar: the user FAQ and the Caddy reverse proxy page. The sidebar template uses page.title (derived from H1 by jekyll-titles-from-headings), so pages without an H1 had title=nil and were skipped. Update sidebar parent labels in docs_nav.html and the chapter list in en/index.md to use the new "* manual" naming. Update link text in section indexes that referenced the old H1s. Bundle two grammar fixes encountered along the way: "an User Interface" -> "a user interface", and drop the awkward "the" in "Configuring the email address validation". EN only. No filenames, URLs, or anchor targets changed (anchors come from H2 and below, which are untouched). FR is generated from EN via po4a and will be regenerated separately. Co-authored-by: Bjørn A. Andersen <polybjorn@users.noreply.github.com>
…8767) Detect when an `app/i18n/<lang>/` directory has no matching `gen.lang.<lang>` key in the reference language (or vice versa), and refuse to regenerate the README from that invalid state. This catches a class of silent corruption where the README translation table renders literal i18n keys instead of localised language names. The trigger is most often a case-folded directory on macOS APFS - git tracks `zh-TW`, the local FS reads back `zh-tw`, the script's `_t('gen.lang.zh-tw')` lookup misses, and the README ends up with `gen.lang.zh-tw (zh-tw)` instead of `正體中文 (zh-TW)`. The same check also flags orphan directories (no display-name key) and orphan keys (no directory). The new validateLanguageNames() method on I18nData performs a bidirectional set comparison and returns human-readable issues. cli/check.translation.php prints them to STDERR and gates --generate-readme on the result, leaving routine completeness validation behaviour unchanged. Adds four PHPUnit tests covering: clean state, case mismatch, orphan directory, orphan key. Co-authored-by: Bjørn A. Andersen <polybjorn@users.noreply.github.com>
After #8747 the sidebar would re-open on its own when navigating (e.g. clicking the logo) on sessions where sessionStorage said the sidebar should be closed. init_nav_menu() ran toggle_aside_click() to honour the stored state, then gated a follow-up `.visible` re-add on `getComputedStyle(aside).display !== 'none'`. Before #8747 that gate worked because the close path set `aside.style.display = 'none'` inline; #8747 replaced that with an `is-hidden` class applied only at wide viewports, so at narrow viewports the computed display stays `table-cell` after closing and the gate wrongly re-adds `.visible`, sliding the drawer open. Gate on the toggle button's `.active` state instead. It's the real source of truth for "should the sidebar be open" and is already used elsewhere in the same function. Fixes #8771 Co-authored-by: Bjørn A. Andersen <polybjorn@users.noreply.github.com>
Jekyll 3 is unmaintained and its safe_yaml dependency breaks on Ruby 3.4+ where base64 left the default stdlib. The docs workflow already runs `bundle exec jekyll build` directly, so GitHub Pages' Jekyll 3 lock does not apply here. Changes: * Pin `jekyll ~> 4.3`. Replace `jekyll-commonmark-ghpages` (pinned to Jekyll 3) with upstream `jekyll-commonmark`. Drop unused `jekyll-paginate`. Add `gem 'base64'` so the lockfile stays valid on Ruby 3.4+ where it became a bundled gem. * Move CommonMark options into `_config.yml` to match what the `-ghpages` variant enabled by default: SMART, FOOTNOTES, UNSAFE (so inline HTML like `<br>` in tables still renders), plus the strikethrough, autolink, table, and tagfilter extensions. Set Rouge as the highlighter. * Strip the leading slash from `defaults.scope.path` (`/en/*` to `en`). Jekyll 4 requires no leading slash, otherwise `page.lang` silently fails to propagate and `jekyll-i18n_tags` crashes the build. * Pass `generateId=true` to the existing `anchor_headings.html` include so headings get slugified IDs. The `-ghpages` variant produced these by default. * Bump CI Ruby to 3.4.9 and `cache-version` to invalidate the old Jekyll 3 gem cache on the first run. Build is about 9x faster (1.0s vs 9.2s). Compared the rendered output page by page against the Jekyll 3 baseline; remaining differences are whitespace, footnote class names (no CSS depends on either set), and one HTML entity (`↩`) becoming the literal `↩`. Visually and functionally the same. Co-authored-by: Bjørn A. Andersen <polybjorn@users.noreply.github.com>
) Closes #8765 Changes proposed in this pull request: - Add disabled-user CSS class to user rows in the management table when the account is disabled - Add .disabled-user { opacity: 0.5; } style to base theme to visually dim disabled accounts - Add entry to CREDITS.md How to test the feature manually: 1. Go to Administration → User Management 2. Have at least one disabled user account in the list 3. Verify that disabled user rows appear dimmed (50% opacity) compared to active users, without any change in functionality
* fix(layout): reserve logo image box via intrinsic dimensions Add the SVG's intrinsic 1280x256 dimensions to the default <img class="logo"> in header.phtml and simple.phtml. The browser uses these to allocate a correctly-proportioned box from HTML parse time, before CSS is applied; without them, a cached image can render at native size for a frame on fast back-to-back navigation. CSS still controls the rendered height (2rem wide, 24px narrow); width auto-derives from the intrinsic ratio. * fix(layout): use rendered logo size for img dimensions 1280 × 256 (the SVG's intrinsic size) replicates the unstyled-frame flash this PR aims to prevent. 160 × 32 has the same 5:1 ratio and matches the CSS-rendered size, so the reserved box is correct both before and after CSS applies. --------- Co-authored-by: Bjørn A. Andersen <polybjorn@users.noreply.github.com>
Nord was the only shipped theme applying a backdrop-filter to .dropdown-close outside the narrow-viewport @media block, dimming the page behind any open dropdown (Settings, mark-read menu, etc.) in wide view. Other themes leave the click-catcher transparent in wide view and only apply a scrim in narrow view, where it doubles as the visual backdrop for the slide-out aside. The wide-view darken in Nord read as inconsistent against its own narrow-view treatment (grayscale + blur) and against every other theme. Click-outside-to-close still works; only the visual backdrop is removed. Co-authored-by: Bjørn A. Andersen <polybjorn@users.noreply.github.com>
Mapco and Ansum apply `transition: all 0.2s ease-in-out` to `.aside` in their narrow `@media`. When the viewport crosses 840px with the sidebar open, the resulting `.aside` position change (`static` to `fixed`) gets animated alongside width, producing a visible artefact where the X button slides down then scrolls back up before settling. Limit the transition to the property that should actually animate (`width`), matching base-theme's existing `transition: width 200ms linear`. The artefact only manifests when the drawer stays open across the 840px boundary, which is the behaviour introduced by #8775. On current edge, `init_nav_menu`'s `media.onchange` toggles the aside off when crossing the breakpoint, hiding the bug. Co-authored-by: Bjørn A. Andersen <polybjorn@users.noreply.github.com>
Alt-Dark, Dark, Origine, and Pafat use `border-bottom: 1px solid` on `.header > .item`, making their wide-view header 57px tall (56px content + 1px border). Other shipped themes have no such border and render at 56px. Replace `border-bottom` with `box-shadow: inset 0 -1px 0`. Visually identical (same colour, same position at the bottom of each header cell), but the shadow doesn't add to the box height. Wide-view header outerHeight becomes 56px across themes, which lets the shared `--height-header: 56px` token introduced in #8783 produce pixel-perfect alignment between the wide header and the narrow drawer X button. Without this PR, those four themes carry a 1px residual offset under #8783's alignment fix. Co-authored-by: Bjørn A. Andersen <polybjorn@users.noreply.github.com>
* i18n(de): improve German translations - Fix orthography and grammar (e.g. Authentifizierung→Authentifizierung, Kategory→Kategorie) - Replace anglicisms with German terms (Hashtags→Tags, Icon→Symbol, Layout→Theme where appropriate) - Improve clarity and naturalness (e.g. Archivierungsausnahmen→Bereinigungsausnahme, Trägheit→Lazy Load) - Complete TODO translations (send_referrer_allowlist, when_same_guid_in_category, keep_adding_feed) - Fix typos (Artikle→Artikel, EAls→Als, Aals→Als) - Use consistent terminology (Account→Konto, Nutzername→Benutzername, Webseite→Website) * i18n(de): revert Account→Konto, Nutzername→Benutzername, Icon→Symbol Keep 'Account' (Konto too bank-like), 'Nutzername' (Nutzer preferred over Benutzer), and 'Icon' (Symbol sounds dated). --------- Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>
* Extension to JSON imports: interpret
"origin": {
"category": "..."
},
as category for FreshRSS. When importing a new feed configure the feed
into this category. Creates missiong categories on the fly.
* Fix syntax
* fix(import): tighten JSON category import follow-ups
- Use strict comparison `!== false` after `addCategory()` so a (theoretical)
zero return from auto-increment is not silently treated as failure
(matches review feedback on #5638).
- Modernise property declaration to typed property syntax, matching the
surrounding `$entryDAO`/`$feedDAO` style.
- Pass `$username` to `createCategoryDao()` in `importFile()` so CLI
imports for a non-current user create categories on the right account,
matching the adjacent entry/feed DAO instantiations.
- Trim the requested category name and skip if it is empty after trim,
so a whitespace-only `"category"` value falls back to the default
category instead of creating a junk row with an empty name. Also
normalises trailing/leading whitespace so `" Tech News "` reuses an
existing `"Tech News"` category.
* Update app/Controllers/importExportController.php
Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>
---------
Co-authored-by: Robert Dahlem <robert.dahlem@gmx.net>
Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>
Co-authored-by: Bjørn A. Andersen <polybjorn@users.noreply.github.com>
We were not vulnerable to it, but here is an additional layer of security against search ingestions, in particular in public user queries, where someone could try to ingest a search like `) OR (interesting`
The internal search was shown in the UI as the user search. This was due to the lazy nature of the Generator. Improve the try/catch behaviour at the same time. How to test: * Make a user query with a search parameter * Share the user query as HTML * Observe the search field (should be empty with this PR, while it contained the internal search before)
Bumps [fast-uri](https://github.com/fastify/fast-uri) from 3.1.0 to 3.1.2. - [Release notes](https://github.com/fastify/fast-uri/releases) - [Commits](fastify/fast-uri@v3.1.0...v3.1.2) --- updated-dependencies: - dependency-name: fast-uri dependency-version: 3.1.2 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* More feed info: last received date, publication date Follow-up of #8670 * Fix <br /> * Change i18n English
…er collision (#8800) When topline_website is "icon", the <li> renders class="item website icon". Bare .icon rules in Nord and Dark apply a filter that cascades onto the favicon <img> inside, so article-list favicons render tinted in icon-only mode. No theme CSS targets the unprefixed value; layout modes are driven from the parent <ul> (.websiteicon, .websitename). Co-authored-by: Bjørn A. Andersen <polybjorn@users.noreply.github.com>
Two narrow @media rules in base-theme/frss.css predate the configurable topline_website modes from #4969 and force icon-only behavior regardless of the user's Website setting; #8631 partially papered over this for grid-layout entries. Drop the unconditional span-hide and its grid-layout exception, and scope the 40px width cap to .websiteicon (with a comment explaining why it stays at narrow). Co-authored-by: Bjørn A. Andersen <polybjorn@users.noreply.github.com>
* Fix “mark as read older than…” widening the active search Sibling searches of a `FreshRSS_BooleanSearch` are combined by OR, so `prepend()` added the maximum publication date used by the “mark as read → articles older than one day / one week” action as one more OR term instead of an extra restriction. With an active search and the stream sorted by publication date, that action therefore marked as read every article older than the cut-off (ignoring the search) plus every article matching the search at any date. `prepend()` now wraps the existing expression first, reusing the logic that `enforce()` already used for the same purpose. Co-Authored-By: Claude <noreply@anthropic.com> * Fix SQL space * Slight reduction of comments --------- Co-authored-by: Claude <noreply@anthropic.com> Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>
Bumps [fast-uri](https://github.com/fastify/fast-uri) from 3.1.2 to 3.1.5. - [Release notes](https://github.com/fastify/fast-uri/releases) - [Commits](fastify/fast-uri@v3.1.2...v3.1.5) --- updated-dependencies: - dependency-name: fast-uri dependency-version: 3.1.5 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* feat(api): Add detection of JSON feed when subscribing via the Google Reader API. * Added self to CREDITS.md * Rather than making a network request, use heuristics based on the URL string to determine if the feed URL likely points to a JSON feed. * Minor syntax preference and comment reduction * Minor syntax --------- Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>
* Sanitize all fields during JSON import fix [GHSA-hx52-rwx7-wg87](https://github.com/FreshRSS/FreshRSS/security/advisories/GHSA-hx52-rwx7-wg87) * Remove URL crendentials from logs --------- Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>
…rm (#9169) HTML injections outside of a form with a `_csrf` field set, could instead refer to the CSRF token form with a payload such as: ```html <button form="post-csrf" formaction="./i/?c=auth&a=logout" formmethod="post">Continue reading</button> ``` While the `post-csrf` form is useful for reducing the amount of code needed (no need to repeat the `_csrf` field in forms), I don't think it's worth the added security risk.
Follow-up of #9178
Bumps the composer group with 1 update in the / directory: [squizlabs/php_codesniffer](https://github.com/PHPCSStandards/PHP_CodeSniffer). Updates `squizlabs/php_codesniffer` from 4.0.1 to 4.0.2 - [Release notes](https://github.com/PHPCSStandards/PHP_CodeSniffer/releases) - [Changelog](https://github.com/PHPCSStandards/PHP_CodeSniffer/blob/4.x/CHANGELOG-4.x.md) - [Commits](PHPCSStandards/PHP_CodeSniffer@4.0.1...4.0.2) --- updated-dependencies: - dependency-name: squizlabs/php_codesniffer dependency-version: 4.0.2 dependency-type: direct:development dependency-group: composer ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
GReaderAPI::authorizationToUser() compared the long-lived GReader bearer token with the non-constant-time === operator instead of hash_equals(), unlike every other token/secret comparison in the codebase (Auth::checkCsrfProtection(), FeverAPI, the OPML/RSS feed token check, and the short-lived GReader token check a few lines below in the same file), all of which already use hash_equals(). This brings the long-lived token check in line with the existing hash_equals(sha1(...), $token) pattern already used for the short-lived token a few lines below. Co-authored-by: senti-man <sentiman49@gmail.com>
Minimal changes borrowed from #8990 Allows usage of <kbd>Ctrl/Shift</kbd> keys with the open website shortcut, so that you can open an article either in a new background tab or a new window. Doesn't work in Chromium browsers, the website opens normally in a new tab there instead. (Firefox only)
As requested in GHSA-p83h-r2jw-9whg / #9193 -- adding myself to CREDITS.md
* Block CGNAT (RFC6598) and NAT64 (RFC6052) ranges in SSRF guard
getCurlResolveInfo() relies on PHP FILTER_FLAG_NO_PRIV_RANGE plus an explicit
PRIVATE_SUBNETS list. PHP's filter does not cover CGNAT 100.64.0.0/10
(RFC6598, used by Tailscale and some corporate/ISP networks) nor NAT64
64:ff9b::/96 (RFC6052, which maps IPv4 addresses incl. 169.254.169.254),
and neither range was in PRIVATE_SUBNETS, so an authenticated user could
still SSRF to those ranges (e.g. Tailscale peers, or NAT64-mapped cloud
metadata). Add both ranges to PRIVATE_SUBNETS.
Repro: filter_var('100.64.0.1', FILTER_VALIDATE_IP, FILTER_FLAG_NO_PRIV_RANGE
| FILTER_FLAG_NO_RES_RANGE) returns the IP (allowed); same for
'64:ff9b::a9fe:a9fe'.
Ref: GHSA-hcv2-vrhw-mjq8
* Minor change comments
---------
Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>
* i18n: add Lithuanian translation This PR adds a new **Lithuanian (lietuvių, `lt`)** translation for FreshRSS. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * Re-apply my fixes lost due to forced push --------- Co-authored-by: georatas <191203408+georatas@users.noreply.github.com> Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com> Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>
I mentioned it here before: https://github.com/FreshRSS/FreshRSS/security/advisories/GHSA-6c8h-w3j5-j293#advisory-comment-138339 (though it was maybe not needed) There is no reason to print the full path of the FreshRSS directory to the user or the logged in admin. (file_put_contents will probably output a more useful message anyway in PHP error log) Introduced in #4220
* Order feeds during OPML import/export according to position Fixes #4086 (partially, only for categories) I exported an OPML, and after importing it on a different instance I noticed the categories weren't in order. This was both due to the position being ignored during the export, and the import. * Better number ordering * Default to -1 instead if no higher positions were found
* Add Docker access log toggle
Allow container operators to disable Apache access logging with DISABLE_ACCESS_LOG=1 while preserving the existing default.
* Use positive access log toggle
* Include dev container
* Better POSIX compatibility
```
-E, -r, --regexp-extended
use extended regular expressions in the script
(for portability use POSIX -E).
```
Note: we should probably replace the other `sed -r` by `sed -E` elsewhere
---------
Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>
* Remove stale dynamic favicon links - remove every previous dynamic favicon link before appending the updated unread-count icon - prevent stale duplicate favicon links from being preferred by browsers Fixes #8237. * Replace dynamic favicon in place --------- Co-authored-by: Gerard Alvear <gerard.alvear@logiqd.me> Co-authored-by: Inverle <inverle@proton.me>
Follow-up to #9201 (merged): a manual review pass over the Lithuanian translation. Main change: switched the "sharing" terminology from *dalintis/dalijimasis* to *bendrinti/bendrinimas* (more standard in Lithuanian software UI), plus wording/consistency fixes across `admin`, `conf`, `gen`, `index` and `sub`. No keys added or removed; the "Divide by 2" string was intentionally kept as *dalinti* (arithmetic, not sharing). Translations reviewed manually. Co-authored-by: georatas <191203408+georatas@users.noreply.github.com> Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
* Pin the docker and pages actions to full commits The docker-publish workflow logs into Docker Hub and pushes the official images, and its actions were referenced by version tags. A tag is a movable pointer, whoever controls an action repository can point it at different code after review, which is how the tj-actions/changed-files incident (CVE-2025-30066) leaked CI secrets at scale. A full commit cannot be retargeted. setup-ruby and dockerhub-description were already pinned this way here, this extends the same practice to the rest. Each pin keeps the version as a trailing comment for review against the action's releases page, versions stay exactly where they were, and dependabot bumps commit pins the same way it bumps tags. * Declare token permissions on the tests and description workflows Both ran with the repository's default token grants and neither writes through the GitHub token, the Docker Hub description update authenticates with its own credentials. They drop to a read only token, matching what docker-publish and the pages workflow already declare.
* Refactor user query translation keys What changed: - replace dynamic user-query translation keys with explicit state, order, and type lookups - retain the existing translations and query behaviour without adding dependencies Why: The translation checker cannot identify keys assembled at runtime. Explicit lookups make all user-query strings visible to validation and easier to maintain. Fixes #6315 * Use semantic user query translation keys * Show all effective user query states * Display every effective user query state * Preserve current Japanese translations * Merge i18n: lt * Update i18n: fr --------- Co-authored-by: Gerard Alvear <gerard.alvear@logiqd.me> Co-authored-by: Inverle <inverle@proton.me> Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>
* Allow jumping from category to feed with keyboard shortcuts * It's now possible to jump from categories to feeds (press shift+j when focused on a category) * Similarly, it's possible to jump from a feed to the current category by using alt+k * If the very first feed is focused and the user presses shift+k, there is no jump to the last unread feed in that category anymore, instead nothing happens. * Same if the very last is focused and the user presses shift+j (no jump to the first unread feed in that category) * Alt+home/end (first/last category) now jumps regardless if the first/last category is read or unread * In addition, shift+home/end does not jump between unread feeds anymore, now it jumps between the first visible feed in the category and the last visible feed in the category * Alt+h (jump to next unread category) now fall backs to the same behavior as alt+j (jump to next category) if there are no more unread categories after * Remove dead `jump_to_unread` code in `prev_feed` * Jump to first/last categories even if they're not unread * Ensure jump is only to visible items * Focus current category if jumping from feed * `delayedClick(null)` will now throw an error
* Dev updates: composer, hadolint, typos... Composer compatibility PHP 8.6. Manual updates not supported by Dependabot * Fix hadolint * Update lib/Minz/Url.php Co-authored-by: Frans de Jonge <fransdejonge@gmail.com> * Add sha256sum for composer --------- Co-authored-by: Frans de Jonge <fransdejonge@gmail.com>
* Disallow redirection to non-remote URLs Fix https://github.com/FreshRSS/FreshRSS/security/advisories/GHSA-fgq3-88jp-7rj9 * Disable unnecessary stream wrappers * Add `is_remote_uri()` check at beginning of `httpGet()` * SimplePie syntax * Sync SimplePie * FreshRSS/simplepie#88 --------- Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>
* i18n(id): complete Indonesian translation Translate the 130 remaining `// TODO` entries in app/i18n/id/ and refresh the 5 `// DIRTY` ones, bringing Indonesian from 88% to 100%. Terminology follows the strings already shipped (umpan, kategori, artikel, belum dibaca, tandai, pintasan). Placeholders, inline markup and documentation links are preserved unchanged. Entries with no natural Indonesian form are marked `// IGNORE` rather than left silently as English: the `lt` language endonym, `gen.search.url`, and the API error marker. Replace `peladen` with `server` throughout, including in strings that predate this change, as `peladen` is unfamle doing so, fix a mistranslation where the "Browser" field of the system information panel read `Peladen`, i.e. ser All edits were made through cli/manipulateME progress tables were regenerated with `composer run-script translations`. Refs #6349. * i18n(id): Fix Indonesian translations for update messages and sorting options
* Fix all broken links in the entire repository * Update docs/CHANGELOG-old2.md Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr> * Update config.default.php Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr> * Update README.md Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr> * Update docs/i18n/freshrss.fr.po Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr> * Update docs/i18n/templates/freshrss.pot Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr> * Update README.md Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr> * Update docs/fr/users/01_Installation.md Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr> * Update docs/fr/users/01_Installation.md Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr> * Update docs/en/internationalization.md Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr> * Manual fixes, preferences * Prefer canonical when known, prefer shorter, prefer roots, prefer URLs with content negotation (e.g. language preference) * Keep 302, 307 unchanged * Use only `.example`, `example.net` or similarly reserved domains for URL examples * Fix language negotiation for developer.mozilla.org * Restore a Stackoverflow 302 * Fix some example.com --------- Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>
- Change the time format to use leading zeros - Refine wording - Add some new translations
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
20 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
See Commits and Changes for more details.
Created by
pull[bot]
Can you help keep this open source service alive? 💖 Please sponsor : )