EDIT: I forgot to update version number in this release, see #4382
What's Changed
No breaking changes. Mostly fixes to existing bridges, and some new bridges.
But, beware that all bridges are now enabled by default! (instead of the selected handful).
If you dont want all bridges enabled do like this in config.ini.php:
[system]; Only these 3 bridges are enabled
enabled_bridges[] = CssSelectorBridge
enabled_bridges[] = FeedMerge
enabled_bridges[] = FeedReducerBridge
;enabled_bridges[] = *
Noteworthy changes
When debug mode is enabled, php errors are converted to exceptions! Only in debug mode, not in prod mode.
fix: convert php errors to exceptions when in debug mode by @dvikan in #4176
The future
These needs to be discussed:
Bump min php version from 7.4 to 8.0.
Introduce a new document root with separate data folder (e.g. /var/www/rss-bridge/public and /var/www/rss-bridge/var/)
rss-bridge is trivially vulnerable to XSS in the HtmlFormat page since we dont sanitize the html(mostly harmless since theres not much to exploit). Feed readers do sanitize html so no problem there.
rss-bridge is trivially vulnerable to SSRF (mostly harmless? hard to exfiltrate data) Also we actually want to allow to fetch resources from non-public IP addresses, so maybe introduce a config for this allowance
In this release, the coding focus has been on moving to PHP 8.1+ and refactoring the integration of the SimplePie library (which was long due). At the same time, plenty of new features have been added. Enjoy! π
Breaking changes π₯:
Require PHP 8.1+ (and improved support of PHP 8.4+)
Require PostgreSQL 10+ or MariaDB 10.0.5+ or MySQL 8+
β οΈ Advanced regex syntax for searches depends on the database used (SQLite, PostgreSQL, MariaDB, MySQL),
but FreshRSS filter actions such as auto-mark-as-read and auto-favourite always use PHP PCRE2 syntax.
Allow dynamic search operator in user queries, like search:UserQueryA date:P1d
New feed mode HTML+XPath+JSON dot notation (JSON in HTML)
Better HTTP compliance with support for HTTP response headers Cache-Control: max-age and Expires
New unicity policies and heuristic for feeds with bad article IDs (reduce the problem of duplicated articles)
New option to automatically mark new articles as read if an identical title already exists in the same category
Add ability to remove content from articles with CSS selectors, also when not using full content
New condition option to selectively retrieve full content of articles
New UI feature to download a userβ SQLite database or a database SQLite export (to be produced by CLI)
β οΈ Advanced regex syntax for searches depends on the database used (SQLite, PostgreSQL, MariaDB, MySQL),
but FreshRSS filter actions such as auto-mark-as-read and auto-favourite always use PHP PCRE2 syntax.
Allow dynamic search operator in user queries, like search:UserQueryA date:P1d#6851
New feed mode HTML+XPath+JSON dot notation (JSON in HTML) #6888
Better HTTP compliance with support for HTTP response headers Cache-Control: max-age and Expires#6812, FreshRSS/simplepie#26
Support custom HTTP request headers per feed (e.g. for Authorization) #6820
New unicity policies and heuristic for feeds with bad article IDs #4487, #6900
Fixed the alignment of the select-all checkbox in the notifications drawer (#24213 by @Dominic-Marcelino)
Enhanced vertical alignment of SSO icons on login page (#24119 by @robsoncombr)
Fixed an issue with unintentional sorting after editing items in relational interfaces (#24172 by @osmandvc)
A potential licensing issue was reported in our use of TinyMCE (used for the WYSIWYG interface) after they changed licenses in the new major version. We've downgraded to the previous major which is MIT-licensed to resolve that while we look for a long term solution. (#24181 by @paescuj)
Fixed the display of relational fields in nested groups (#24183 by @formfcw)
Improved the default user created display template by using the avatar field (#24160 by @gavalierm)
Fixed thumbnails not appearing in File Library after upload (#24087 by @joselcvarela)
This is a security release to address a vulnerability in our dependencies where specifically formatted requests could be used to manipulate application configuration in environments where a certain PHP option (register_argc_argv) is enabled. This is not an option that's typically enabled in production web-serving environments, but it's advised to update where uncertain.
Full List of Changes
Updated application PHP dependencies.
Updated translations with latest Crowdin changes. (#5317)
Updated setting categories to validate by for existing views, allowing custom categories to be used via the theme system. Thanks to @LachTrip. (#5255, #5251)
Updated translations with latest Crowdin changes. (#5250)
Vulnerability that allows a user with the lowest privilege to conduct a session hijacking, subsequently gaining unauthorized access to the admin and other user accounts. (Muhammad Aizat, datack.my)
Log in
