FreshRSS 1.30.0 added unregister_unsafe_protocols() to lib/lib_rss.php,
which unregisters every PHP stream wrapper except file:// and php:// at
boot as an SSRF mitigation. That removed the https:// wrapper, so the
stream-context-based fetch in apiGet() stopped working entirely — every
API call failed with "Unable to find the wrapper https".
Because the call site used @file_get_contents(), the failure was silent:
apiGet() returned null, loadThread() fell through to its null fallback,
and entries were saved with their unenriched RSS content. The visible
symptom was Bluesky posts rendering with no thread and no embeds, with
nothing in the logs to explain it.
Switch apiGet() to cURL, which does not go through stream wrappers (and
is how FreshRSS fetches feeds itself, which is why feed retrieval kept
working throughout). Connect timeout added and redirect-following
explicitly disabled — a public XRPC endpoint has no reason to redirect,
and following redirects would reopen an SSRF vector.
Also stop swallowing failures: transport errors, non-2xx responses and
malformed JSON are now reported via Minz_Log::warning() so this class of
breakage is visible next time.
Tests: add testApiGetWorksWithoutHttpsStreamWrapper, which unregisters
the https wrapper before calling the API and so fails against the old
implementation, plus testApiGetLogsWarningOnFailure. Add a Minz_Log stub
and curl to the CI extension list.
Co-Authored-By: Claude Opus 5 <[email protected]>
Replies had no left padding from the border (padding-left:0) and too-tight
vertical spacing (margin:4px). Bump to padding-left:12px and margin:8px.
Closes#2
Co-Authored-By: Claude Opus 4.6 <[email protected]>
Fixes#1. Replaces the plain div wrapper and separate "View on Bluesky"
link with a <blockquote> element, and makes the @handle the permalink
to the quoted post.
Co-Authored-By: Claude Sonnet 4.6 <[email protected]>
Only replies from the root post's author are rendered; replies from other
users are skipped. Adds fixture and test for a real-world post with an
other-author reply (3mhypinzezo2l).
Co-Authored-By: Claude Sonnet 4.6 <[email protected]>
- Add 22 unit tests covering feed parsing, thread rendering, facets,
needsRefetch staleness windows, and handleConfigureAction
- Add FreshRSS class stubs so tests run without a full FreshRSS install
- Add RSS feed fixture (hockeyviz.com snapshot) and thread API fixture
for post 3mhtk7awhrp26 (1 root + 2 replies)
- Add Gitea Actions workflow (.gitea/workflows/ci.yml) running on PHP 8.2
- Fix POST_URL_PATTERN: using '#' as PCRE delimiter with '#' inside a
character class caused PHP to close the pattern early, so no Bluesky
URL ever matched; switch delimiter to '~'
Co-Authored-By: Claude Sonnet 4.6 <[email protected]>
Minz_HookType enum does not exist in this version of FreshRSS;
registerHook() expects plain strings.
Co-Authored-By: Claude Sonnet 4.6 <[email protected]>
thatguygriff
KydoimosandClaude Opus 5