Merge remote-tracking branch 'upstream/edge' into edge

.github/workflows/tests.yml

@@ -49,9 +49,6 @@ jobs:
     - name: PHPStan
       run: composer run-script phpstan
 
-    - name: PHPStan Next Level
-      run: composer run-script phpstan-next
-
     # NPM tests
 
     - name: Uses Node.js

.markdownlintignore

@@ -3,6 +3,7 @@ extensions/
 lib/marienfressinaud/
 lib/phpgt/
 lib/phpmailer/
+lib/simplepie/
 node_modules/
 p/scripts/vendor/
 vendor/

.typos.toml

@@ -44,7 +44,7 @@ extend-exclude = [
 	"lib/marienfressinaud/",
 	"lib/phpgt/",
 	"lib/phpmailer/",
-	"lib/SimplePie/",
+	"lib/simplepie/",
 	"node_modules/",
 	"p/scripts/vendor/",
 	"package-lock.json",

CHANGELOG.md

@@ -8,22 +8,33 @@ See also [the FreshRSS releases](https://github.com/FreshRSS/FreshRSS/releases).
 	* Add support for [regex search (regular expressions)](https://freshrss.github.io/FreshRSS/en/users/10_filter.html#regex) [#6706](https://github.com/FreshRSS/FreshRSS/pull/6706)
 		* ⚠️ Advanced regex syntax for searches depends on the database used (SQLite, PostgreSQL, MariaDB, MySQL),
 		but FreshRSS filter actions such as auto-mark-as-read and auto-favourite always use [PHP PCRE2 syntax](https://php.net/regexp.introduction).
+	* Add ability to remove content from articles with CSS selectors, also when not using full content [#6786](https://github.com/FreshRSS/FreshRSS/pull/6786), [#6807](https://github.com/FreshRSS/FreshRSS/pull/6807)
 	* Update `phpgt/cssxpath` library with improved CSS selectors with support for `last-child`, `first-of-type`, `last-of-type`, `^=`, `|=` [#6618](https://github.com/FreshRSS/FreshRSS/pull/6618)
+	* Better import of Inoreader user labels [#6791](https://github.com/FreshRSS/FreshRSS/pull/6791)
 * Bug fixing
+	* Fix auto-read tags [#6790](https://github.com/FreshRSS/FreshRSS/pull/6790)
 	* Use curl to fetch extensions list (allows e.g. IPv6) [#6767](https://github.com/FreshRSS/FreshRSS/pull/6767)
 * Compatibility
 	* Require PHP 8.1+ (drop PHP 7.4) [#6711](https://github.com/FreshRSS/FreshRSS/pull/6711)
 	* Improved support of PHP 8.4+ [#6618](https://github.com/FreshRSS/FreshRSS/pull/6618), [PhpGt/CssXPath#227](https://github.com/PhpGt/CssXPath/pull/227),
-		[#6781](https://github.com/FreshRSS/FreshRSS/pull/6781)
+		[#6781](https://github.com/FreshRSS/FreshRSS/pull/6781), [#4374](https://github.com/FreshRSS/FreshRSS/pull/4374)
 	* Require PostgreSQL 10+ (drop PostgreSQL 9.5) [#6705](https://github.com/FreshRSS/FreshRSS/pull/6705)
 	* Require MariaDB 10.0.5+ (drop MariaDB 5.5) [#6706](https://github.com/FreshRSS/FreshRSS/pull/6706)
 	* Requiring MySQL 8+ (drop MySQL 5.5.3) [#6706](https://github.com/FreshRSS/FreshRSS/pull/6706)
 * Deployment
 	* Docker: dev image `freshrss/freshrss:oldest` updated to Alpine 3.16 with PHP 8.1.22 and Apache 2.4.59 [#6711](https://github.com/FreshRSS/FreshRSS/pull/6711)
+* SimplePie
+	* Refactor [our embedding](lib/README.md) of SimplePie [#4374](https://github.com/FreshRSS/FreshRSS/pull/4374)
+		* Our fork is maintained in its [own repository](https://github.com/FreshRSS/simplepie/tree/freshrss).
+* Security
+	* Fix login in unsafe mode when using a password with special XML characters [#6797](https://github.com/FreshRSS/FreshRSS/pull/6797)
 * UI
 	* Default styles for `<pre>` and `<code>` [#6770](https://github.com/FreshRSS/FreshRSS/pull/6770)
+	* Refactor the sharing menu to use a `<template>` instead of duplicated HTML code [#6751](https://github.com/FreshRSS/FreshRSS/pull/6751)
 * Misc.
 	* Better cache name for JSON feeds [#6768](https://github.com/FreshRSS/FreshRSS/pull/6768)
+	* Fix inversed encoding logic in `Minz_Request::paramArray()` [#6800](https://github.com/FreshRSS/FreshRSS/pull/6800)
+	* Pass PHPStan `booleansInConditions` [#6793](https://github.com/FreshRSS/FreshRSS/pull/6793)
 	* Update dev dependencies [#6780](https://github.com/FreshRSS/FreshRSS/pull/6780)
 
 

app/Controllers/authController.php

@@ -187,8 +187,8 @@ public function formLoginAction(): void {
 				Minz_Request::forward(['c' => 'auth', 'a' => 'login'], false);
 			}
 		} elseif (FreshRSS_Context::systemConf()->unsafe_autologin_enabled) {
-			$username = Minz_Request::paramString('u');
-			$password = Minz_Request::paramString('p');
+			$username = Minz_Request::paramString('u', plaintext: true);
+			$password = Minz_Request::paramString('p', plaintext: true);
 			Minz_Request::_param('p');
 
 			if ($username === '') {

app/Controllers/configureController.php

@@ -202,7 +202,7 @@ public function shortcutAction(): void {
 		$this->view->list_keys = SHORTCUT_KEYS;
 
 		if (Minz_Request::isPost()) {
-			$shortcuts = Minz_Request::paramArray('shortcuts');
+			$shortcuts = Minz_Request::paramArray('shortcuts', plaintext: true);
 			if (Minz_Request::paramBoolean('load_default_shortcuts')) {
 				$default = Minz_Configuration::load(FRESHRSS_PATH . '/config-user.default.php');
 				$shortcuts = $default['shortcuts'];
@@ -379,12 +379,13 @@ public function queryAction(): void {
 				$name = _t('conf.query.number', $id + 1);
 			}
 			if (!empty($params['get']) && is_string($params['get'])) {
-				$queryParams['get'] = htmlspecialchars_decode($params['get'], ENT_QUOTES);
+				$queryParams['get'] = $params['get'];
 			}
 			if (!empty($params['order']) && is_string($params['order'])) {
-				$queryParams['order'] = htmlspecialchars_decode($params['order'], ENT_QUOTES);
+				$queryParams['order'] = $params['order'];
 			}
 			if (!empty($params['search']) && is_string($params['search'])) {
+				// Search must be as plain text to be XML-encoded or URL-encoded depending on the situation
 				$queryParams['search'] = htmlspecialchars_decode($params['search'], ENT_QUOTES);
 			}
 			if (!empty($params['state']) && is_array($params['state'])) {
@@ -398,7 +399,7 @@ public function queryAction(): void {
 			$queryParams['url'] = Minz_Url::display(['params' => $queryParams]);
 			$queryParams['name'] = $name;
 			if (!empty($params['description']) && is_string($params['description'])) {
-				$queryParams['description'] = htmlspecialchars_decode($params['description'], ENT_QUOTES);
+				$queryParams['description'] = $params['description'];
 			}
 			if (!empty($params['imageUrl']) && is_string($params['imageUrl'])) {
 				$queryParams['imageUrl'] = $params['imageUrl'];

app/Controllers/feedController.php

@@ -92,7 +92,7 @@ public static function addFeed(string $url, string $title = '', int $cat_id = 0,
 		}
 
 		$feedDAO = FreshRSS_Factory::createFeedDao();
-		if ($feedDAO->searchByUrl($feed->url())) {
+		if ($feedDAO->searchByUrl($feed->url()) !== null) {
 			throw new FreshRSS_AlreadySubscribed_Exception($url, $feed->name());
 		}
 
@@ -340,7 +340,7 @@ public function addAction(): void {
 			}
 
 			$feed = $feedDAO->searchByUrl($this->view->feed->url());
-			if ($feed) {
+			if ($feed !== null) {
 				// Already subscribe so we redirect to the feed configuration page.
 				$url_redirect['a'] = 'feed';
 				$url_redirect['params']['id'] = $feed->id();
@@ -385,7 +385,8 @@ public function truncateAction(): void {
 	 * 	list of feeds for which a cache refresh is needed
 	 * @throws FreshRSS_BadUrl_Exception
 	 */
-	public static function actualizeFeeds(?int $feed_id = null, ?string $feed_url = null, ?int $maxFeeds = null, ?SimplePie $simplePiePush = null): array {
+	public static function actualizeFeeds(?int $feed_id = null, ?string $feed_url = null, ?int $maxFeeds = null,
+		?\SimplePie\SimplePie $simplePiePush = null): array {
 		if (function_exists('set_time_limit')) {
 			@set_time_limit(300);
 		}
@@ -443,6 +444,7 @@ public static function actualizeFeeds(?int $feed_id = null, ?string $feed_url =
 			}
 
 			$url = $feed->url();	//For detection of HTTP 301
+			$oldSimplePieHash = $feed->attributeString('SimplePieHash');
 
 			$pubSubHubbubEnabled = $pubsubhubbubEnabledGeneral && $feed->pubSubHubbubEnabled();
 			if ($simplePiePush === null && $feed_id === null && $pubSubHubbubEnabled && ($feed->lastUpdate() > $pshbMinAge)) {
@@ -617,9 +619,9 @@ public static function actualizeFeeds(?int $feed_id = null, ?string $feed_url =
 
 						$needFeedCacheRefresh = true;
 
-						if ($pubSubHubbubEnabled && !$simplePiePush) {	//We use push, but have discovered an article by pull!
+						if ($pubSubHubbubEnabled && $simplePiePush === null) {	//We use push, but have discovered an article by pull!
 							$text = 'An article was discovered by pull although we use PubSubHubbub!: Feed ' .
-								SimplePie_Misc::url_remove_credentials($url) .
+								\SimplePie\Misc::url_remove_credentials($url) .
 								' GUID ' . $entry->guid();
 							Minz_Log::warning($text, PSHB_LOG);
 							Minz_Log::warning($text);
@@ -657,11 +659,14 @@ public static function actualizeFeeds(?int $feed_id = null, ?string $feed_url =
 			}
 
 			$feedProperties = [];
+			if ($oldSimplePieHash !== $feed->attributeString('SimplePieHash')) {
+				$feedProperties['attributes'] = $feed->attributes();
+			}
 
-			if ($pubsubhubbubEnabledGeneral && $feed->hubUrl() && $feed->selfUrl()) {	//selfUrl has priority for WebSub
+			if ($pubsubhubbubEnabledGeneral && $feed->hubUrl() !== '' && $feed->selfUrl() !== '') {	//selfUrl has priority for WebSub
 				if ($feed->selfUrl() !== $url) {	// https://github.com/pubsubhubbub/PubSubHubbub/wiki/Moving-Feeds-or-changing-Hubs
 					$selfUrl = checkUrl($feed->selfUrl());
-					if ($selfUrl) {
+					if ($selfUrl != false) {
 						Minz_Log::debug('WebSub unsubscribe ' . $feed->url(false));
 						if (!$feed->pubSubHubbubSubscribe(false)) {	//Unsubscribe
 							Minz_Log::warning('Error while WebSub unsubscribing from ' . $feed->url(false));
@@ -672,8 +677,8 @@ public static function actualizeFeeds(?int $feed_id = null, ?string $feed_url =
 					}
 				}
 			} elseif ($feed->url() !== $url) {	// HTTP 301 Moved Permanently
-				Minz_Log::notice('Feed ' . SimplePie_Misc::url_remove_credentials($url) .
-					' moved permanently to ' .  SimplePie_Misc::url_remove_credentials($feed->url(false)));
+				Minz_Log::notice('Feed ' . \SimplePie\Misc::url_remove_credentials($url) .
+					' moved permanently to ' .  \SimplePie\Misc::url_remove_credentials($feed->url(false)));
 				$feedProperties['url'] = $feed->url();
 			}
 
@@ -709,7 +714,7 @@ public static function actualizeFeeds(?int $feed_id = null, ?string $feed_url =
 			}
 
 			$feed->faviconPrepare();
-			if ($pubsubhubbubEnabledGeneral && $feed->pubSubHubbubPrepare()) {
+			if ($pubsubhubbubEnabledGeneral && $feed->pubSubHubbubPrepare() != false) {
 				Minz_Log::notice('WebSub subscribe ' . $feed->url(false));
 				if (!$feed->pubSubHubbubSubscribe(true)) {	//Subscribe
 					Minz_Log::warning('Error while WebSub subscribing to ' . $feed->url(false));
@@ -798,7 +803,8 @@ public static function commitNewEntries(): int {
 	 * 	list of feeds for which a cache refresh is needed
 	 * @throws FreshRSS_BadUrl_Exception
 	 */
-	public static function actualizeFeedsAndCommit(?int $feed_id = null, ?string $feed_url = null, ?int $maxFeeds = null, ?SimplePie $simplePiePush = null): array {
+	public static function actualizeFeedsAndCommit(?int $feed_id = null, ?string $feed_url = null, ?int $maxFeeds = null,
+		?SimplePie\SimplePie $simplePiePush = null): array {
 		$entryDAO = FreshRSS_Factory::createEntryDao();
 		[$nbUpdatedFeeds, $feed, $nbNewArticles, $feedsCacheToRefresh] = FreshRSS_feed_Controller::actualizeFeeds($feed_id, $feed_url, $maxFeeds, $simplePiePush);
 		if ($nbNewArticles > 0) {
@@ -997,7 +1003,7 @@ public function deleteAction(): void {
 				break;
 			case 'normal':
 				$get = Minz_Request::paramString('get');
-				if ($get) {
+				if ($get !== '') {
 					$redirect_url = ['c' => 'index', 'a' => 'normal', 'params' => ['get' => $get]];
 				} else {
 					$redirect_url = ['c' => 'index', 'a' => 'normal'];

app/Controllers/importExportController.php

@@ -351,7 +351,7 @@ private function importJson(string $article_file, bool $starred = false): bool {
 				}
 			}
 
-			if ($feed != null) {
+			if ($feed !== null) {
 				$article_to_feed[$item['guid']] = $feed->id();
 				if (!isset($newFeedGuids['f_' . $feed->id()])) {
 					$newFeedGuids['f_' . $feed->id()] = [];
@@ -393,18 +393,15 @@ private function importJson(string $article_file, bool $starred = false): bool {
 			$labels = [];
 			for ($i = count($tags) - 1; $i >= 0; $i--) {
 				$tag = trim($tags[$i]);
-				if (strpos($tag, 'user/-/') !== false) {
-					if ($tag === 'user/-/state/com.google/starred') {
+				if (preg_match('%^user/[A-Za-z0-9_-]+/%', $tag)) {
+					if (preg_match('%^user/[A-Za-z0-9_-]+/state/com.google/starred$%', $tag)) {
 						$is_starred = true;
-					} elseif ($tag === 'user/-/state/com.google/read') {
+					} elseif (preg_match('%^user/[A-Za-z0-9_-]+/state/com.google/read$%', $tag)) {
 						$is_read = true;
-					} elseif ($tag === 'user/-/state/com.google/unread') {
+					} elseif (preg_match('%^user/[A-Za-z0-9_-]+/state/com.google/unread$%', $tag)) {
 						$is_read = false;
-					} elseif (strpos($tag, 'user/-/label/') === 0) {
-						$tag = trim(substr($tag, 13));
-						if ($tag != '') {
-							$labels[] = $tag;
-						}
+					} elseif (preg_match('%^user/[A-Za-z0-9_-]+/label/\s*(?P<tag>.+?)\s*$%', $tag, $matches)) {
+						$labels[] = $matches['tag'];
 					}
 					unset($tags[$i]);
 				}
@@ -630,7 +627,7 @@ public function exportAction(): void {
 
 		foreach ($export_feeds as $feed_id) {
 			$result = $export_service->generateFeedEntries((int)$feed_id, $max_number_entries);
-			if (!$result) {
+			if ($result === null) {
 				// It means the actual feed_id doesn’t correspond to any existing feed
 				continue;
 			}

app/Controllers/subscriptionController.php

@@ -304,7 +304,7 @@ public function feedAction(): void {
 				case 'normal':
 				case 'reader':
 					$get = Minz_Request::paramString('get');
-					if ($get) {
+					if ($get !== '') {
 						$url_redirect = ['c' => 'index', 'a' => $from, 'params' => ['get' => $get]];
 					} else {
 						$url_redirect = ['c' => 'index', 'a' => $from];

app/Controllers/tagController.php

@@ -40,7 +40,7 @@ public function tagEntryAction(): void {
 			if ($id_entry != '') {
 				$tagDAO = FreshRSS_Factory::createTagDao();
 				if ($id_tag == 0 && $name_tag !== '' && $checked) {
-					if ($existing_tag = $tagDAO->searchByName($name_tag)) {
+					if (($existing_tag = $tagDAO->searchByName($name_tag)) !== null) {
 						// Use existing tag
 						$tagDAO->tagEntry($existing_tag->id(), $id_entry, $checked);
 					} else {

app/FreshRSS.php

@@ -111,7 +111,7 @@ public static function loadStylesAndScripts(): void {
 			return;
 		}
 		$theme = FreshRSS_Themes::load(FreshRSS_Context::userConf()->theme);
-		if ($theme) {
+		if (is_array($theme)) {
 			foreach (array_reverse($theme['files']) as $file) {
 				switch (substr($file, -3)) {
 					case '.js':

app/Models/BooleanSearch.php

@@ -402,6 +402,7 @@ public function __toString(): string {
 		return $this->getRawInput();
 	}
 
+	/** @return string Plain text search query. Must be XML-encoded or URL-encoded depending on the situation */
 	public function getRawInput(): string {
 		return $this->raw_input;
 	}

app/Models/Category.php

@@ -181,7 +181,7 @@ public function refreshDynamicOpml(): bool {
 		$opml = httpGet($url, $cachePath, 'opml', $this->attributes(), $this->curlOptions());
 		if ($opml == '') {
 			Minz_Log::warning('Error getting dynamic OPML for category ' . $this->id() . '! ' .
-				SimplePie_Misc::url_remove_credentials($url));
+				\SimplePie\Misc::url_remove_credentials($url));
 			$ok = false;
 		} else {
 			$dryRunCategory = new FreshRSS_Category();
@@ -229,7 +229,7 @@ public function refreshDynamicOpml(): bool {
 			} else {
 				$ok = false;
 				Minz_Log::warning('Error loading dynamic OPML for category ' . $this->id() . '! ' .
-					SimplePie_Misc::url_remove_credentials($url));
+					\SimplePie\Misc::url_remove_credentials($url));
 			}
 		}
 

app/Models/CategoryDAO.php

@@ -12,7 +12,7 @@ public function resetDefaultCategoryName(): bool {
 			$stm->bindValue(':id', self::DEFAULTCATEGORYID, PDO::PARAM_INT);
 			$stm->bindValue(':name', 'Uncategorized');
 		}
-		return $stm && $stm->execute();
+		return $stm !== false && $stm->execute();
 	}
 
 	protected function addColumn(string $name): bool {
@@ -126,7 +126,7 @@ public function addCategory(array $valuesTmp): int|false {
 			$catId = $this->pdo->lastInsertId('`_category_id_seq`');
 			return $catId === false ? false : (int)$catId;
 		} else {
-			$info = $stm == null ? $this->pdo->errorInfo() : $stm->errorInfo();
+			$info = $stm === false ? $this->pdo->errorInfo() : $stm->errorInfo();
 			if ($this->autoUpdateDb($info)) {
 				return $this->addCategory($valuesTmp);
 			}
@@ -137,7 +137,7 @@ public function addCategory(array $valuesTmp): int|false {
 
 	public function addCategoryObject(FreshRSS_Category $category): int|false {
 		$cat = $this->searchByName($category->name());
-		if (!$cat) {
+		if ($cat === null) {
 			$values = [
 				'kind' => $category->kind(),
 				'name' => $category->name(),
@@ -175,7 +175,7 @@ public function updateCategory(int $id, array $valuesTmp): int|false {
 		if ($stm !== false && $stm->execute($values)) {
 			return $stm->rowCount();
 		} else {
-			$info = $stm == null ? $this->pdo->errorInfo() : $stm->errorInfo();
+			$info = $stm === false ? $this->pdo->errorInfo() : $stm->errorInfo();
 			if ($this->autoUpdateDb($info)) {
 				return $this->updateCategory($id, $valuesTmp);
 			}
@@ -196,7 +196,7 @@ public function updateLastUpdate(int $id, bool $inError = false, int $mtime = 0)
 		if ($stm !== false && $stm->execute($values)) {
 			return $stm->rowCount();
 		} else {
-			$info = $stm == null ? $this->pdo->errorInfo() : $stm->errorInfo();
+			$info = $stm === false ? $this->pdo->errorInfo() : $stm->errorInfo();
 			Minz_Log::error('SQL error ' . __METHOD__ . json_encode($info));
 			return false;
 		}
@@ -211,7 +211,7 @@ public function deleteCategory(int $id): int|false {
 		if ($stm !== false && $stm->bindParam(':id', $id, PDO::PARAM_INT) && $stm->execute()) {
 			return $stm->rowCount();
 		} else {
-			$info = $stm == null ? $this->pdo->errorInfo() : $stm->errorInfo();
+			$info = $stm === false ? $this->pdo->errorInfo() : $stm->errorInfo();
 			Minz_Log::error('SQL error ' . __METHOD__ . json_encode($info));
 			return false;
 		}
@@ -290,7 +290,7 @@ public function listCategories(bool $prePopulateFeeds = true, bool $details = fa
 				 * 	'id'?:int,'name'?:string,'url'?:string,'kind'?:int,'category'?:int,'website'?:string,'priority'?:int,'error'?:int|bool,'attributes'?:string,'cache_nbEntries'?:int,'cache_nbUnreads'?:int,'ttl'?:int}> $res */
 				return self::daoToCategoriesPrepopulated($res);
 			} else {
-				$info = $stm == null ? $this->pdo->errorInfo() : $stm->errorInfo();
+				$info = $stm === false ? $this->pdo->errorInfo() : $stm->errorInfo();
 				if ($this->autoUpdateDb($info)) {
 					return $this->listCategories($prePopulateFeeds, $details);
 				}
@@ -315,7 +315,7 @@ public function listCategoriesOrderUpdate(int $defaultCacheDuration = 86400, int
 			$stm->execute()) {
 			return self::daoToCategories($stm->fetchAll(PDO::FETCH_ASSOC));
 		} else {
-			$info = $stm ? $stm->errorInfo() : $this->pdo->errorInfo();
+			$info = $stm !== false ? $stm->errorInfo() : $this->pdo->errorInfo();
 			if ($this->autoUpdateDb($info)) {
 				return $this->listCategoriesOrderUpdate($defaultCacheDuration, $limit);
 			}
@@ -362,7 +362,7 @@ public function checkDefault(): int|bool {
 				$catId = $this->pdo->lastInsertId('`_category_id_seq`');
 				return $catId === false ? false : (int)$catId;
 			} else {
-				$info = $stm == null ? $this->pdo->errorInfo() : $stm->errorInfo();
+				$info = $stm === false ? $this->pdo->errorInfo() : $stm->errorInfo();
 				Minz_Log::error('SQL error ' . __METHOD__ . json_encode($info));
 				return false;
 			}

app/Models/CategoryDAOSQLite.php

@@ -6,7 +6,7 @@ class FreshRSS_CategoryDAOSQLite extends FreshRSS_CategoryDAO {
 	/** @param array<int|string> $errorInfo */
 	#[\Override]
 	protected function autoUpdateDb(array $errorInfo): bool {
-		if ($tableInfo = $this->pdo->query("PRAGMA table_info('category')")) {
+		if (($tableInfo = $this->pdo->query("PRAGMA table_info('category')")) !== false) {
 			$columns = $tableInfo->fetchAll(PDO::FETCH_COLUMN, 1);
 			foreach (['kind', 'lastUpdate', 'error', 'attributes'] as $column) {
 				if (!in_array($column, $columns, true)) {