FreshRSS 1.30.0

• Milestone

This is a security-oriented major release with several important security patches, so users are encouraged to update without delay.

From this release, we are also making it clear that our rolling-release channel (*edge*) is recommended for faster security patches.

Breaking change :

• Disallow access to local networks such as 127.0.0.1 by default, for security reasons

Feature highlights:

• Filter global view feed list by state and search
• New option to hide badges showing number of unread articles (*Phantom Obligation*)
• Refresh only feeds in the current view
• Offer to add a prefix when re-sharing user labels

Bug fixes highlights :

• Several security attack scenarios patched
• Fix lost elements while parsing search query
• Fix "mark as read older than..." widening the active search
• Fix saving user queries
• Fix SQL errors breaking some regex searches with MySQL / MariaDB

This release has been made by @Alkarex, @andris155, @ColonelMoutarde, @Frenzie, @IEEE-754, @Inverle, @math-GH, @nykula, @polybjorn, @Stunkymonkey and newcomers @0xdeadrelay, @AdamKorcz, @aligundogar, @bossaarebecca-alt, @Cactys12, @chrislongros, @Divinelink, @Elgeryy1, @featurecreep-cron, @Fripix, @fzlzjerry, @georatas, @gshimo, @iatman ,@ihsanarifr, @jamalkamaladdin, @JamBalaya56562, @jbrayton, @jeremy-code, @juherr, @kobihikri, @LeeXiaolan, @masskrdjn, @mohammadlashkari, @nathanpixodeo, @Otolock, @payaci, @salvador-castro, @SamCyber001, @satyvm, @senti-man, @simitana, @ThomasVermeer, @Totara-thib, @TowyTowy, @utkutibet, @XiaoSong1223

Full changelog:

• Security
• Disallow access to local networks such as 127.0.0.1 by default, for security reasons (breaking change) #8400,

#9195

• Selected local networks can be allowed under *System configuration* or using the INTERNAL_HOST_ALLOWLIST environment variable
• Passing * allows all networks like before (unsafe)
• Improve SSRF mitigations by restricting CURLOPT_PROXY #8950
• Fix auth CSRFs (login and register actions) #9171
• Log invalid challenge and ignore JSON error during login #9278
• Disallow fetching of non remote URI #9215
• Only allow HTTP/HTTPS schemes for enclosure and thumbnail URLs #9272
• Fix access control in rss and opml actions #8912
• Refactor to use CSRF field directly instead of borrowing it from a form #9169, #9205
• Cleaner limit anonymous mode to default user #9235
• Fix HTML ingestions in templates #9146, #9170
• Fix bad header filtering bypass #8964
• Sanitize all fields during JSON import #9168
• Gate greader (JSON) user query share format behind *Share by OPML* #9248
• Public OPML should not contain cURL parameters #9070
• Ignore security-relevant OPML attributes for dynamic OPML sources #9276
• Strip feed URL credentials from anonymous user query output #9246
• Set limits for regex during search #8913
• Fix path disclosure in cache error message #9206
• Limit the length and parentheses nesting depth of a search query #9277
• Use timing-safe comparison for tokens #8945
• Use hash_equals() for GReader API token comparison #9183
• Mailer: allow disabling SMTPAutoTLS via config #9026
• Warn during install if document root does not point to ./p/ #9010
• Stop the unread-count poller after the session ends #9065
• Add remote IP address to warning on form login #8942
• Pin the GitHub actions using SHA #9200
• Harden cache and SimplePie cache deserialization #9273
• SimplePie
• Security: Disallow javascript: URI scheme (protocol) #8263
• Fix wrong player parent logic leading to invalid type #8893, simplepie#978
• Consistently enable XML_OPTION_PARSE_HUGE #8894, simplepie#977
• Fix null warning in IRI for PHP 8.5+ #8918, simplepie#979
• Fix sanitizer whitelist stripping order #9066
• Show only one representation per media:group #9009
• Bump upstream SimplePie #8947
• Features
• Filter global view feed list by state and search #9132
• Use global view when searching from subscription page #9144
• New option to hide badges showing number of unread articles (*Phantom Obligation*) #8844
• Refresh only feeds in the current view #9060
• Offer to add a prefix when resharing user labels #9236
• Add log search to the logs page #9059
• Add configurable log_level system setting #9185
• New option to keep or not the custom sort order when navigating between categories and feeds #8969
• New per-feed option to show or hide enclosures (attachments) #9015
• Detect JSON feeds from URLs containing json #9058
• Also when subscribing via the API #9167
• Order categories during OPML import/export according to position #9203
• OPML: include each feed's refresh interval (TTL) in export/import #8982
• Log failed CSS content retrieval (Web scraping) #9077
• Allow providing a category when adding a feed by bookmarklet #9047
• Add LinkAce sharing service #9024
• Add Nextcloud Bookmarks sharing service #9032
• Bug fixing
• Fix lost elements while parsing search query #8884
• Fix "mark as read older than..." widening the active search #9173
• Fix saving user queries #9190
• Fix SQL errors breaking some regex searches with MySQL / MariaDB #9036
• Fix marking filtered label articles as read in SQLite and PostgreSQL #9264
• Fix tagging an already-tagged entry on PostgreSQL raising a SQL error instead of being a no-op #9136
• PostgreSQL: make committing new entries resilient to duplicate keys #9231
• Preserve negative timezone offsets in date intervals #9071
• Fix feed dropdown bugs due to hash desync #8949
• Fix slider not reinitializing after form submit #8973
• Minz: Skip loading duplicated JS/CSS assets #9000
• Respect simplepie_syslog_enabled for the *uses cache* logs #8986
• Fix statistics repartition averages #8996
• Fix article hover date visibility #8997
• Keep search and state filters when marking articles as read #9007
• Fix --db-prefix silently drops following CLI flags #9042
• Remove stale dynamic favicon links #9127
• Fix desync between favicon and title unread counters #9262
• Fix outdated username length hint on registration and install forms #9013
• Redirect away from wrong URL paths #9075
• Fix auto-share shortcut on first use #9072
• Exclude hidden feeds from global view counts #9152
• Fix only the last <media:credit> being written to the RSS output #9174
• CLI
• New cli/reconfigure-user.php to read/write per-user config attributes #8873
• Report new articles count per feed in app/actualize_script.php output #8948
• Output a diagnostic when the cli/health.php check fails #8980
• API
• Add a warning message to the API password section and a log warning when a client uses GET instead of recommended POST #8845
• Fever API: log the client IP address on authentication failure #8981
• WebSub: ignore HTTP/HTTPS scheme difference in Self URL comparison #9005
• Deployment
• Docker alternative image updated to Alpine 3.24 with PHP 8.5.7 and Apache 2.4.67 #8916
• Start supporting PHP 8.6+
• Docker dev :newest with PHP 8.6 #9155
• Docker: attach provenance and SBOM attestations to the published image #9150
• Apache use only CONN_REMOTE_ADDR in logs when mod_remoteip is available, for compatibility with LiteSpeed Web Server #8890
• Fix .dockerignore being ignored during build in CI #9001
• New ENABLE_ACCESS_LOG environment variable to disable access logs #9191
• Check GMP during 32-bit installation #9046
• Improve actualize mutex to allow multiple instances #9045
• OIDC: redirect to a default URL on expired auth state instead of 400 #9143
• UI
• Always jump article to top when header is offscreen, also when *Stick the article to the top when opened* is disabled #8870
• Move article header/footer options (feed title, authors and date, icons position, tags) from *Reading* to *Display* configuration #9139
• Move disable button before remove button in user management #8944
• Keep scroll position of slider after form submit #8974
• Group export feeds by category #9079, #9154
• Sort feed names with locale-aware collation #8985
• Sort labels with locale-aware collation #9023
• Format unread counter in title on page load #9263
• Display slider after submit for all buttons in feed update UI #8999
• Improve aside keyboard navigation #9202
• Allows usage of <kbd>Ctrl/Shift</kbd> keys with the open website shortcut #9186
• Fix padding for .nav_menu in Alternative-Dark, Flat, and Nord themes #8901
• Fix typo in alert error border color variable #9266
• Use JavaScript Event() constructor instead of deprecated initEvent() #9035