Navigator.share returns a promise that's executed in the background, but
unless we await it explicitly, we won't get the exceptions in the
try/catch block.
Prior to this commit, to share an entry, a user has to click on the
share link and then copy the URL they are redirected to. The danger is
that they may right-click and copy the share link without actually
clicking on it, and therefore share a link that, when authenticated,
shares the entry, rather than actually sharing the entry.
Here, we avoid this misinterpretation by making sharing into a POST
request and using a form rather than a link.
Because Miniflux runs as a confidential service, a missing client secret
is a mistake in configuration. An empty client secret appears to be
valid per RFC 6749 (and is in fact the default set by Miniflux!), so we
log a warning.
Steps to reproduce:
1. In /unread, open a feed's settings in a new tab. The feed must have unread entries in /unread.
2. In the new tab/window, delete the feed.
3. Without refreshing, mark an entry from the now-deleted feed as read.
4. Result: The total unread count in the UI header switches to NaN.
The [strings.Fields](https://pkg.go.dev/strings#Fields) considers `'\t', '\n',
'\v', '\f', '\r', ' ', U+0085 (NEL), U+00A0 (NBSP).` as spaces, so no need to
remove them beforehand.
This is a continuation of f2f60a8f73
Currently, removing a feed from `/category/{id}/feeds` redirects incorrectly to `/feeds`. This change fixes it so that
removing a feed will now correctly redirect to `/category/{id}/feeds`. Removing a feed from `/feeds` is unaffected and
will work as it does currently.
To fix this, a new UI endpoint `/category/{categoryID}/feed/{feedID}/remove` is added and a corresponding handler method
to validate and perform the removal from DB.
- Mark a method as `static`
- use `Math.sqrt` instead of `Math.pow(…, 0.5)`
- Use `Math.sign` instead of a condition on the sign
- Inline some used-once variables
- Reduce the scope of some variables
According to https://caniuse.com/?search=passive,
all browsers released after 2016 do support passive event listeners,
so no need to check for its presence.
- Use `….classList.toggle` instead of `….classList.add`/`….classList.remove` in a condition
- Replace a `function()` with a `() =>`
- Use `Math.min` instead of a handwritten condition
Miniflux can be build with `go build -tags=sqlite` to test this. Note that
while it builds, it will fail at runtime, as some of the SQL used in miniflux is
postgresql-specific.
The implementation is equivalent to
`cases.Title(language.English).String(strings.ToLower(…))`,
and this is the only place in miniflux where
"golang.org/x/text/cases" and "golang.org/x/text/language"
are (directly) used.
This reduces the binary size from 27015590 to
26686112 on my machine.
Kudos to https://gsa.zxilly.dev for making it straightforward to catch things
like this.
The coverage information isn't used anywhere in the CI, so no need to have it
for every OS. As for `-race`, there is no point in using it everywhere, one
time should be enough, especially since it's taking a lot of time on Windows.
- Use chained strings.Contains instead of a regex for
blacklistCandidatesRegexp, as this is a bit faster
- Simplify a Find.Each.Remove to Find.Remove
- Don't concatenate id and class for removeUnlikelyCandidates, as it makes no
sense to match on overlaps. It might also marginally improve performances, as
regex now have to run on two strings separately, instead of both.
- Add a small benchmark
Some websites are using images of O(10kB) when not )O(100kB) for their
favicons. As miniflux only displays them with a 16x16 resolution, let's do our
best to resize them before storing them in the database. This should make
miniflux consume less bandwidth when serving pages, for the joy of mobile users
on a small data plan.
Of course, images that already are 16x16 aren't resized.
No need for brittle regex when matching plain strings or domain names.
This should save some negligible amount of heap memory as well as
tremendously speeding up the matching.
- Replace a completely overkill regex
- Use `.Remove()` instead of a hand-rolled loop
- Use a strings.Builder instead of a bytes.NewBufferString
- Replace a call to Fprintf with string concatenation, as the latter are much
faster
- Remove a superfluous cast
- Delay some computations
- Add some tests
As mentioned in goquery's documentation (https://pkg.go.dev/github.com/PuerkitoBio/goquery#Single):
> By default, Selection.Find and other functions that accept a selector string
to select nodes will use all matches corresponding to that selector. By using
the Matcher returned by Single, at most the first match will be selected.
>
> The one using Single is optimized to be potentially much faster on large documents.
In internal/reader/handler/handler.go:RefreshFeed, there is a call to
store.UserByID pretty early, which is only used for
originalFeed.WithTranslatedErrorMessage(localizedError.Translate(user.Language)
Its only other usage is in processor.ProcessFeedEntries(store, originalFeed,
user, forceRefresh), which is pretty late in RefreshFeed, and only called if
there are new items in the feed. It makes sense to only fetch the user's
language if the error localization function is used.
Calls to `store.UserByID` take around 10% of the CPU time of RefreshFeed in my
profiling.
This commit also makes `processor.ProcessFeedEntries` take a `userID` instead
of a `user`, to make the code a bit more concise.
This should close#2984
While doing some profiling for #2900, I noticed that
`miniflux.app/v2/internal/locale.LoadCatalogMessages` is responsible for more
than 10% of the consumed memory. As most miniflux instances won't have enough
diverse users to use all the available translations at the same time, it
makes sense to load them on demand.
The overhead is a single function call and a check in a map, per call to
translation-related functions.
- Use string concatenation instead of `Sprintf`, as this is much faster, and the
call to `Sprintf` is responsible for 30% of the CPU time of the function
- Anchor the youtube regex, to allow it to bail early, as this also account for
another 30% of the CPU time. It might be worth chaining calls to `TrimPrefix`
and check if the string has been trimmed instead of using a regex, to speed
things up even more, but this needs to be benchmarked properly.
It was added in 2022 by #1513, to support blog.laravel.com, which has
since switched to HTML. The Atom 0.3/1.0, RSS 1.0/2.0, RDF, and JSON formats
don't support markdown in their spec, and any website serving it there should
be considered as buggy and fixed.
This shaves off 2MB from the miniflux binary, which is quite steep for a
feature that nobody is/should be using, and remove a dependency which is always
a good thing.
- Use `token.String()` instead of `html.EscapeString(token.Data)`
- Refactor conditions to highlight their similitude, enabling further
refactoring
This refactoring brings forth at least one bug: `tagStack` is never emptied.
The `isAnchor` function's first parameter was always `a`, instead of being
passed `tagName`. As this function is a single line and was only called in a
single place, it can be inlined.
- Use `[^"]` instead of `.`, to help the regex engine to determine boundaries,
instead of having it bruteforce its way to find them
- Use `+` instead of `*`, as empty rules don't make sense
This function takes around 1.5% of the total CPU time on my instance, and most
of it is spent in `mapassign_faststr` to initialize the `map`. This is replaced
with a switch-case construct, that should be both significantly faster as well
as pretty dull in term of memory consumption.
- Pre-allocate a slice
- Inline a local variable
- Remove a superfluous call to `strings.TrimSpace`
- Simplify some conditions via a switch-case construct
The `pg_timezone_names` view was added in 8.2.
It should be equivalent to the function query.
See: https://pgpedia.info/p/pg_timezone_names.html
This small change allows `miniflux` to run on postgres-compatible
databases like CockroachDB, which don't have this function.
When you download/save proxified media, the original filename is lost. That
information could be retained by passing a header `Content-Disposition: inline;
filename="ORIGNAL_FILENAME.EXT"` when serving the media file. The requested URL
would still be obfuscated, but if the client downloads the file it'll use that
original filename.
Since go-webauthn v0.11.0, the backup eligibility flag is strictly validated, but Miniflux does not store this flag.
This workaround to set the flag based on the parsed response, and avoid "BackupEligible flag inconsistency detected during login validation" error.
See https://github.com/go-webauthn/webauthn/pull/240
When a server returns a 304 response with a strong validator, any other
stored fields must be updated if they are also present in the response.
This behaviour is described in RFC9111, sections 3.2 and 4.3.4.
Shared entry does not link to any user and therefore should not display
any saved progression. Curiously, the progression of a user (the one that shared ?)
was still integrated in the page. This does not make sens regarding the sharing
feature itself. It is also a leak of user personal information onto a public page.
I simply removed the data from the template when the user object is not present.
I tested the change on "regular" entry page, ensuring the save progression feature
still works, and on shared page checking if any error happened in the JavaScript console.
Everything seems in order.
Why:
Passing an empty string as an endpoint to Client when instantiating a
new client might seem like something that should never happen but I
managed to trigger it while parsing some input files to register feeds
in bulk.
What:
In the execute() function, check early if the endpoint is "" and then
return immediately nil and a new error, named ErrEmptyEndpoint with a
descriptive string
When upgrading my installation, I noticed that `miniflux -migrate` does
not provide any output by default. This can be a bit confusing since one
cannot be sure whether anything has happened. Use `Info` instead of
`Debug` to provide some basic output by default.
[LibreJS][0] is a browser extension developed by GNU which ensures only Free (libre) JavaScript is run. To determine whether given JavaScript is Free, LibreJS consults metadata included in the JavaScript file. Since Miniflux is Free Software, getting its JavaScript to work when LibreJS is installed is just a matter of adding license metadata to the returned JavaScript source.
[0]: https://www.gnu.org/software/librejs/index.html
Currently there's no way through the API to mimic the Unread page of the client.
This is now possible by filtering on globally_visible=true and status=unread.
As per the MDN article on HTTP caching:
During cache revalidation, if both If-Modified-Since and If-None-Match
are present, then If-None-Match takes precedence for the validator.
https://developer.mozilla.org/en-US/docs/Web/HTTP/Caching
Previously Miniflux would consider a resource unmodified if the
Last-Modified header had not changed, even if the ETag had changed.
With this commit, Miniflux will consider a resource modified if the ETag
header has changed, even if Last-Modified has not.
This fixes Bug 1 in https://rachelbythebay.com/w/2024/06/11/fsr/
The Issue:
When saving an entry that is already bookmarked on Pinboard,
Miniflux was overriding all existing data on Pinboard. This action
removed any extended content or, worse, changed the private settings
to public, making previously private bookmarks publicly available.
The Fix:
Now, upon saving an entry as a bookmark, I first fetch it. If it
already exists, I apply the necessary modifications (adding tags and any state)
that Miniflux would have normally done, then add it again. This way, no
data is lost in the process. Pinboard has a stable API, so I don't anticipate
any new fields being added soon.
I manually tested the integration by hitting the save button in the following situations:
- Entry URL does not exist on Pinboard:
- Bookmark is properly added on Pinboard with tags and "to read" status according to Miniflux settings.
- Entry URL already exists on Pinboard:
- Existing data remains unchanged.
- Tags from Miniflux settings are properly added to the bookmark.
- "To read" status is set to yes when the option is checked in Miniflux. Nothing is changed otherwise.
39d752c removed a link to the feed name to solve a web preview issue. This change brings back the feed name without the link, thus restoring the feed name without bringing back the issue.
Fixes#2620
Some server on the wild are badly configured. Either by mistake or lack
of maintenance. Safe and unsafe Ciphers change overtime based on new
discoveries.
This proposition will include considered unsafe ciphers when `Allow self-signed or invalid certificates` is used.
It could be put into a separate option but, I felt this could fit in.
fix#2671
In order to be more resilient to YouTube URLs variation and
to address this feature_request: https://github.com/miniflux/v2/issues/2628
I've reworked a bit the way the YouTube feed extraction is done.
I've kept all the `FindSubscriptionsFromYouTube*` in order
to keep all the existing unit tests as-is ensuring little to no
regressions. By doing so, I had to call twice `youtubeURLIDExtractor`.
Small performance penalty for peace of mind in my opinion.
`youtubeURLIDExtractor` is made in a way only one kind
of page can be detected at a time. This mean I can
solve the "video in a playlist" feature_request
by prioritizing the playlist ID over the Video ID
Also, by using `url.Parse()` to get ids, it's safer
to url mangle and variation. The most common variation
being the `t=42` parameters that start the playback
at a given position. Previously, this kind of url
would not be detected as "YouTube URL".
I deliberately ignored the url parsing error
to keep previous behavior (skip the YouTube analysis and follow with the other analysis)
I also tried to keep debug logs the same as before as much as I could.
I manually tested all the YouTube cases (video,channel,playlist)
and they all work as expected except for the video. But this one
does not work either on main. The `meta` html tag that was searched for
does not seem to exist anymore.
fix: #2628
The original idea was to have two digit precision at all time
in order to ensure the length of the string is always the same.
This prevents the UI button to move when pressed.
I completely missed the first press as the precision was not right
upon first click.
On shared entries, there is no speed configured as this
is bound to the user. Shared entries are displayed without user config.
I've changed the default view to reflect the
actual default playback speed in this case. 1x.
It's possible to specify a rewrite regex that validates but doesn't compile such
as:
rewrite("(((unmatched-capture-group"|"rewrite)))")
In case we encounter one, exit early instead of letting the server panic.
This adds a new "description" field to the feed settings. This allows to
save custom description regarding a feed. It is also exported and
imported as "description" in OPML.
This ensures that session cookies are not expiring before the session is cleaned up from the database as per CLEANUP_REMOVE_SESSIONS_DAYS.
As of now the usefulness of this configuration option is diminished as extending it has no effect on the actual browser session due to the cookie expiry.
Fixes: #2214
When listening to podcast, it is usual to want to speed up the playback.
https://github.com/miniflux/v2/pull/2521 was addressing the need globally, this PR
allow to address it for just the current open enclosure media. (no save) Some Browser
already include this control directly, but firefox does not (directly anyway).
Also, it is often useful to be able to skip chunk of a podcast, to skip commercials
for example, or get back a bit because we couldn't hear the last part. I added rudimentary
seek controls with the usual +/-10 and 30 seconds chuck size. This is pretty handy when podcast
are very long and using the seek bar is way too tricky to just skip 30s.
As always, I'm French and could only provide English and French translation for the few
text I added in the locale/translations files. Any help is welcome.
Tested mostly on Firefox (121.0) and quickly on Vivaldi(6.5.3206.53), chrome based.
Fixes: #1845#1846
Compress the html of feed entries before storing it. This should reduce the
size of the database a bit, but more importantly, reduce the amount of data
sent to clients
minify being [stupidly fast](https://github.com/tdewolff/minify/?tab=readme-ov-file#performance), the performance impact should be in the noise level.
When clicking the unread counter, the following exception occurs:
```
Uncaught TypeError: Cannot read properties of null (reading 'getAttribute')
```
This is due to `onClickMainMenuListItem` not working correctly for the
unread counter `span`s, which return `null` when using `querySelector`.
In cf96ab45c1, support was added for using Docker related Github
actions in repositories of other owners. This was pretty helpful as it
allowed running modified forks off of main in a nightly fashion before
patches were pushed upstream. This was 6e870cdccc, add it
back
- Specify Docker registry explicitly (e.g., Podman does not use
`docker.io` by default)
- Use `make miniflux` instead of duplicating `go build` arguments (this
leverages Go's PIE build mode)
- Enable cgo to fix ARM containers (we need to make sure to use the same
OS version for both container stages to avoid libc issues)
By default, Oglaf show some disclaimer/warning about its content, and this
doesn't play well with rss readers, so let's rewrite it to show the actual
comic instead of a placeholder.
rand.Intn(math.MaxInt64) causes tests to fail on 32-bit architectures.
Use the simpler rand.Int() instead, which still provides plenty of room
for generating pseudo-random test usernames.
This commit adds a bunch of checks to prevent reader/rss from adding empty tags
to rss items, as well as some minor refactors like nested conditions and loops
unrolling.
This commit adds a policy, and make use of it in the Content-Security-Policy.
I've tested it the best I could, both on a modern browser supporting
trusted-types (Chrome) and on one that doesn't (firefox).
Thanks to @lweichselbaum for giving me a hand to wrap this up!
- Move the population of the feed's entries into a new function, to make
`BuildFeed` easier to understand/separate concerns/implementation details
- Use `sort+compact` instead of `compact+sort` to remove duplicates
- Change `if !a { a = } if !a {a = }` constructs into `if !a { a = ; if !a {a = }}`.
This reduce the number of comparisons, but also improves a tad the
control-flow readability.
Use a sort+compact construct instead of doing it by hand with a hashmap. The
time complexity is now O(nlogn+n) instead of O(n), and space complexity around
O(logn) instead of O(n+uniq(n)), but it shouldn't matter anyway, since
removeDuplicates is only called to deduplicate tags.
- Simplify a switch-case by moving a common condition above it.
- Remove a superfluous error-check: `strconv.ParseInt` returns `0` when passed
an empty string.
- Online some one-line functions
- Transform a free-standing function into a method
- Massively simplify `removeClickbait`
- Use a proper constant instead of a magic number in `applyFuncOnTextContent`
No need to compile them once for matching on the url,
once per tag, once per title, once per author, … one time is enough.
It also simplify error handling, since while regexp compilation can fail,
matching can't.
- The jwt token was declared as using HS256 as algorithm, but was using HS512.
- No need to base64-encode then remove the padding when we can simply encode
without padding.
- Factorize the header+payload concatenation as data
Odds are that this integration was broken from the start (HS512 vs HS256), so
I'm not sure if it's better to add tests or to simply get rid of it.
- re-use ProxifiedUrl to implement AbsoluteProxifyURL, reducing the copy-pasta
- reduce the internal indentation of ProxifiedUrl by inverting some conditions
- Don't use lambdas to return a function, use directly the function instead.
- Remove a hack for "Chrome 67 and earlier" since it was released in 2018.
There is no need to detect the format and then the version when both can be
done at the same time.
Add a benchmark as well, on large and small atom and rss files.
- replace a lot of `let` with `const`
- inline some `querySelectorAll` calls
- reduce the scope of some variables
- use some ternaries where it makes sense
- inline one-line functions
Refactor away some trival usages of `.innerHTML`. Unfortunately, there is no way to
enabled trusted-types in report-only mode via `<meta>` tags, see
https://github.com/w3c/webappsec-csp/issues/277
The variable `triggers` is only used to check if in contains a particular
value. Given that the number of keyboard shortcuts is starting to be
significant, let's future-proof the performances and use a `Set` instead of an
`Array` instead.
This will allow to make use of func (*Reader) Seek, instead of re-recreating a
new reader. It's a large commit for a small change, but anything to simply the
reader/buffer/ReadAll/… mess is a step in the right direction I think, and it
should enable more follow-up simplifications.
- allow youtube urls to start with `www`
- use `strings.Builder` instead of a `bytes.Buffer`
- use a `strings.NewReader` instead of a `bytes.NewBufferString`
- sprinkles a couple of `continue` to make the code-flow more obvious
- inline calls to `inList`, and put their parameters in the right order
- simplify isPixelTracker
- simplify `isValidIframeSource`, by extracting the hostname and comparing it
directly, instead of using the full url and checking if it starts with
multiple variations of the same one (`//`, `http:`, `https://` multiplied by
``/`www.`)
- add a benchmark
There is no need to do extra work like creating a session and its associated
view until the user has been properly identified and as many possibly-failing sql request have been successfully run.
- Reduce the amount of nested loops: it's preferable to search the whole page
once and filter on it (even with filters that should always be false),
than searching it again for every element we're looking for.
- Factorize the proxying conditions into a `shouldProxy` function to reduce the
copy-pasta.
- Refactorise the tests and add some
- Use 250 signs instead of the whole text
- Only check for Korean, Chinese and Japanese script
- Add a benchmark
- Use a more idiomatic control flow
```console
$ # main branch
$ go test -bench=.
goos: linux
goarch: amd64
pkg: miniflux.app/v2/internal/reader/readingtime
BenchmarkEstimateReadingTime-12 267 4821268 ns/op
PASS
ok miniflux.app/v2/internal/reader/readingtime 1.754s
$ # speed_up_reading_time branch
$ go test -bench=.
goos: linux
goarch: amd64
pkg: miniflux.app/v2/internal/reader/readingtime
cpu: 12th Gen Intel(R) Core(TM) i7-1265U
BenchmarkEstimateReadingTime-12 1941 653312 ns/op
PASS
ok miniflux.app/v2/internal/reader/readingtime 1.342s
$
```
If the user doesn't display reading times, there is no need to compute them.
This should speed things up a bit, since `whatlanggo.Detect` is abysmally slow.
Instead of having to allocate a ~100 keys map containing possibly dynamic
values (at least to the go compiler), allocate it once in a global variable.
This significantly speeds things up, by reducing the garbage
collector/allocator involvements.
Local synthetic benchmarks have shown a improvements from 38% of wall time to only
12%.
- `make([]a, b)` create a slice of `b` elements `a`
- `make([]a, b, c)` create a slice of `0` elements `a`, but reserve space for `c` of them
When using `append` on the former, it will result on a slice with `b` leading
elements, which is unlikely to be what we want. This commit replaces the two
instances where this happens with the latter construct.
Go 1.22 introduced a new [for-range](https://go.dev/ref/spec#For_range)
construct that looks a tad better than the usual `for i := 0; i < N; i++`
construct. I also tool the liberty of replacing some
`for i := 0; i < len(myitemsarray); i++ { … myitemsarray[i] …}`
with `for item := range myitemsarray` when `myitemsarray` contains only pointers.
- Use a simple regex to parse data uri instead of a hand-rolled parser, and
document what fields are considered mandatory.
- Use case-insensitive matching to find (fav)icons, instead of doing the same
query twice with different letter cases
- Add 'apple-touch-icon-precomposed.png' as a fallback favicon
- Reorder the queries to have i`con` first, since it seems to be the most
popular one. It used to be last, meaning that pages had to be parsed
completely 4 times, instead of one now.
- Minor factorisation in findIconURLsFromHTMLDocument
- Split dates formats into those that require local times
and those who don't, so that there is no need to have a switch-case in the
for loop with around 250 iterations at most.
- Be more strict when it comes to timezones, previously invalid ones like -13
were accepted. Also add a test for this.
- Bail out early if the date is an empty string.
- make findContentUsingCustomRules' more idiomatic,
since in golang a function returning an error might
return garbage in other parameter. Moreover, ignoring
errors is bad practise.
- getPredefinedScraperRules is now running in constant-time,
instead of iterating on a list with around 50 items in it.
- Surface `localizedError` in FindSubscriptionsFromWellKnownURLs via slog
- Use an inline declaration for new subscriptions, like done elsewhere in the
file, if only for consistency's sake
- Preallocate the `subscriptions` slice when using an RSS-bridge,
it's a good practise, and it might even marginally improve
performances when adding __a lot__ of feeds via an rss-bridge instance, wooo!
- `NOT (hash=ANY(%4))` can be expressed as `hash NOT IN $4`
- There is no need for a subquery operating on the same table,
moving the conditions out is equivalent.
No need for a `BETWEEN`: we want to filter on entries published in the last
week, no need to express is as "entries published between now and last week",
"entries published after last week" is enough.
- Use constant time access for maps instead of iterating on them
- Build a ~large whitelist map inline instead of constructing it item by item
(and remove a duplicate key/value pair)
- Use `slices` instead of hand-rolled loops
Given that there is always a ton of `Entry` floating around, reordering its
field to take less space is a quick/simple way to reduce miniflux' memory
consumption.
I kept the `ID` field as the first member, as I think it's the most important
one, and moving it somewhere else would drown it in other fields.
Anyway, this still provides a reduction of 32 bytes per Entry:
```console
$ fieldalignment ./client/model.go 2>&1 | grep 203
~/v2/client/model.go:203:12: struct with 280 pointer bytes could be 240
$ fieldalignment ./client/model.go 2>&1 | grep 203
~/v2/client/model.go:203:12: struct with 248 pointer bytes could be 240
$
```
The same optimisation pass could be applied to other structs, but since they
aren't present in obviously great numbers during miniflux' life cycle, it would
likely require some profiling to see if it's worth doing it.
There are a few things that need to be done, to make this work.
First, we need to register `Enter` as another hotkey that opens the
selected item.
However, by default the `KeyboardHandler` will override all default
actions. That might make sense for any other key, but for the `Enter`
key, we want to keep the default behavior (i.e. follow a selected link
or press a button). So for this single key event, we do not call
`preventDefault()`.
I see this as unproblematic for the following reasons.
1. With the changes from #2348, when we're in a list of items (articles,
categories, feeds), there is no link selected. This is what made the
`Enter` key work _implicitly_ in the past. With nothing selected, the
`Enter` key will do nothing by default.
2. If we have **any** link selected (including when we are in a view
with a list of selectable items), we'll get the default action of
`Enter` (i.e. follow a link), which is exactly what we had before.
Lastly, we need to update the list of keyboard shortcuts displayed when
pressing `?`.
This fixes#2366.
# Change HTML tag to button
Replace the link tag with an HTML button to prevent some screen readers from having confusing announcements. By using the HTML button, users can use the Enter and Space keys to activate actions by default, instead of implementing them in JavaScript.
# Differentiate links and buttons visually
When activating the link element, the user may expect the web page to navigate to the URL and the page will refresh; when activating the button element, the user may expect the web page to still be on the same page, so that their current state, such as: input value, won't disappear.
Links and buttons should have different styles visually, so that users can't expect what will happen when they activate a link or a button.
I added the underline to the links, because that is the common pattern. Buttons have border and background color in a common pattern. But I think that will change the current layout drastically. So I added the focus, hover and active classes to the buttons instead.
This patch adjusts the distroless image to use the predefined non-root UID, which uses explicit UID definitions. This allows orchestrators like Kubernetes to validate non-zero UIDs directly by checking the Image metadata.
The previous setup without an explicit `runAsUser` in the securityContext would produce the following error when enabling `runAsNonRoot`:
```
Error: container has runAsNonRoot and image has non-numeric user (nonroot), cannot verify user is non-root (pod: "miniflux-97cc5955f-pt7vf_miniflux(d1c56d29-ea0a-407c-b3f3-9821fbd7ee61)", container: miniflux)
```
- Translate missing entries.
- Hiphenate some phrases.
- Improve some translation.
- Some translations where seemingly done automatically.
- Some translation could be phrased a bit better (subjectively).
As per [OPML 2.0 specification]:
> Each sub-element of the body of the OPML document is a node of type rss or an outline element that contains nodes of type rss.
> Required attributes: type, text, xmlUrl.
[OPML 2.0 specification]: http://opml.org/spec2.opml#subscriptionLists
The recent HTTP client refactor in 14e25ab9fe
caused feed refreshes to no longer make conditional requests. Prior to
the refactor, `client.WithCacheHeaders` handled this. Now this function
is split into `fetcher.WithETag` and `fetcher.WithLastModified` but
these functions are only declared and never actually used. Fix this by
calling them inside `handler.RefreshFeed`.
The recent HTTP client refactor in 14e25ab9fe
introduced a bug in which the global default User-Agent is no longer
used for requests. Unless a per-feed User-Agent exists, the Go standard
library's default User-Agent is used, which looks something like
"Go-http-client/1.1". To fix this, make RequestBuilder.WithUserAgent
take an additional argument, the default User-Agent, which will be used
if there is no per-feed User-Agent (i.e. it is an empty string).
Fixes#2188Fixes#2189
For example, seeing "Next check: 14m56.245483933s" in feeds list after force-refreshing a feed.
This rounds to the nearest second, so it'll instead be "14m56s"
Other examples from latter two test cases:
- "12.345678s" -> "12s"
- "1m27.654321s" -> "1m28s"
- Remove dependency on `go-telegram-bot-api`
- Add new options: optional topic ID, disable page preview, disable notifications
- Add new button to go to article
When the touchmove listener is registered with passive: false, scrolling
up on Firefox Android only works every other attempt. When scrolling
breaks, the touchmove callback is never invoked.
The passive flag was originally set to false as part of a fix to prevent
vertical scrolling while swiping: 3f31744911.
Setting passive to true doesn't seem to negatively affect that in both
Firefox and Chrome, but fixes the scoll up behavior on Firefox.
Fixes: #2053
Signed-off-by: Andrew Gunnerson <accounts+github@chiller3.com>
Go module versioning expect Git tags to start with the letter v.
The goal is to keep the existing naming convention for generated
artifacts and have proper versioning for the Go module.
* Fix modal aria role
* Trap focusing with tab / shift+tab inside the modal
* Restore keyboard focus when closing modal
* Automatically move keyboard focus to first focusable element unless specified otherwise
* Keyboard shortcut help modal: move keyboard focus to modal title
* Keyboard shortcut help modal: change close control from link to button
https://github.com/mccutchen/go-httpbin is MIT licensed and implements httpbin interfaces in Golang.
Combining this package with `httptest.Server` allows client unit tests to run entirely locally with no dependency on remote calls to httpbin.org
When a bunch of entries are marked as read at once, they should have the
same `changed_at`; fall back to sorting them chronologically by
publication date.
In order to ease podcast listening, the player can be put on top of the feed entry as main content.
Use the `Use podcast player` option to enable that. It works on audio and video.
Also, when playing audio or video, progression will be saved in order to be able to resume listening later.
This position saving is done using the original attachement/enclosures player AND podcast player and do not rely on
the podcast player option ti be enabled.
Additionally, I made the player fill the width with the entry container to ease seeking and have a bigger video.
updateEnclosures now keep existing enclosures based on URL
When feeds get updated, enclosures entries are always wiped and re-created. This cause two issue
- enclosure progression get lost in the process
- enclosure ID changes
I used the URL as identifier of an enclosure. Not perfect but hopefully should work.
When an enclosure already exist, I simply do nothing and leave the entry as is in the database.
If anyone is listening/watching to this enclosure during the refresh, the id stay coherent and progression saving still works.
The updateEnclosures function got a bit more complex. I tried to make it the more clear I could.
Some optimisation are possible but would make the function harder to read in my opinion.
I'm not sure if this is often the case, but some feeds may include tracking or simply change the url each
time we update the feed. In those situation, enclosures ids and progression will be lost.
I have no idea how to handle this last situation. Use the size instead/alongside url to define the identity of an enclosure ?
Translation: english as placeholder for every language except French
Aside, I tested a video feed and fixed a few things for it. In fact, the MimeType was not working
at all on my side, and found a pretty old stackoverflow discussion that suggest to use an Apple non-standard MimeType for
m4v video format. I only did one substitution because I only have one feed to test. Any new video feed can make this go away
or evolve depending on the situation. Real video feeds does not tend to be easy to find and test extensively this.
Co-authored-by: toastal
Recent versions of Android allows the user to choose their own
homescreen icons shape. This introduces the concept of maskable PWA
icons, which without the "purpose" tag and properly padded icons makes
the homescreen icon look really boxy and weird.
This adds a new version of the icon with more padding in three sizes, as
well as the "purpose" attribute in the manifest.json file. The three old
icons are retained for compatibility with desktop and iOS.
Articles on The Verge sometimes contain a section for related articles.
This section can be distracting in reader mode. Therefore, filter the
related article section using the scraper rules.
* Refactor `TouchHandler` to handle double-tap and swipe gestures.
* Renamed existing `onTouch` JavaScript methods to `onItemTouch` and
added `onContentTouch` methods for swipe gesture.
* Refactor double-tap. It's now a method in `TouchHandler` versus
anonymous functions in `listen()` method.
* Updated CSS classes.
* Added `touch-action` CSS for `.entry-content`.
* Renamed CSS classes for adding events in `TouchHandler`.
* Updated users settings to replace checkbox for double tap with select
for none, double tap, or swipe.
* Added database migrations for new gesture_nav option.
* Rename `users.double_tap` to `users.gesture_nav` and migrate
existing user settings.
* Updated translation files. (Non-English updated with Google
Translate.)
Resolves#1449, closes#1495
For a long time, we’ve not been limited to ASCII and have machines that
can properly render the typographically-correct punctuation symbols for
our languages. This leads to a better, clearer reading experience and
also matches the `<meta charset="utf-8">` and the the use of such
punctuation on FAQs.
Changes:
• Ellipsis: `...` → `…` (https://en.wikipedia.org/wiki/Ellipsis)
• Apostrophe: `'` → `’` (https://en.wikipedia.org/wiki/Apostrophe)
While I could try to do research on other languages, I’m not a native
speaker in them and wouldn’t feel comfortable making any adjustments
outside of English.
Feed entries are usually ordered from most to least recent.
Processing older entries first ensures that their creation timestamp
is lower than that of newer entries.
This is useful when we order by creation, because then we get a
consistent timeline.
Creating an RSS feed item with the inline description containing an `<img>` tag
with a `srcset` attribute pointing to an invalid URL like
`http:a<script>alert(1)</script>`, we can coerce the proxy handler into an error
condition where the invalid URL is returned unescaped and in full.
This results in JavaScript execution on the Miniflux instance as soon as the
user is convinced to open the broken image.
HTTP headers like X-Forwarded-For or X-Real-Ip can be easily spoofed. As
such, it cannot be used to test if the client IP is allowed.
The recommendation is to use HTTP Basic authentication to protect the
metrics endpoint, or run Miniflux behind a trusted reverse-proxy.
This type of challenge works purely at the TLS layer and is compatible
with SNI proxies. The existing HTTP-01 challenge support has been left
as-is.
Fixes#1476.
* `integration/shaarli`: factorize the header+payload concatenation as data
* `integration/shaarli`: no need to base64-encode then remove the padding when we can simply encode without padding
* `integration/shaarli`: the JWT token was declared as using HS256 as algorithm, but was using HS512
* `integration/webhook`: add category title to request body
* `locale`: update Turkish translations
* `man page`: sort config options in alphabetical order
* `mediaproxy`: reduce the internal indentation of `ProxifiedUrl` by inverting some conditions
* `mediaproxy`: simplify and refactor the package
* `model`: replace` Optional{Int,Int64,Float64}` with a generic function `OptionalNumber()`
* `model`: use struct embedding for `FeedCreationRequestFromSubscriptionDiscovery` to reduce code duplication
* `reader/atom`: avoid debug message when the date is empty
* `reader/atom`: change `if !a { a = } if !a {a = }` constructs into `if !a { a = ; if !a {a = }}` to reduce the number of comparisons and improve readability
* `reader/atom`: Move the population of the feed's entries into a new function, to make BuildFeed easier to understand/separate concerns/implementation details
* `reader/atom`: refactor Atom parser to use an adapter
* `reader/atom`: use `sort+compact` instead of `compact+sort` to remove duplicates
* `reader/atom`: when detecting the format, detect its version as well
* `reader/encoding`: inline a one-liner function
* `reader/handler`: fix force refresh feature
* `reader/json`: refactor JSON Feed parser to use an adapter
* `reader/media`: remove a superfluous error-check: `strconv.ParseInt` returns `0` when passed an empty string
* `reader/media`: simplify switch-case by moving a common condition above it
* `reader/processor`: compile block/keep regex only once per feed
* `reader/rdf`: refactor RDF parser to use an adapter
* `reader/rewrite`: inline some one-line functions
* `reader/rewrite`: simplify `removeClickbait`
* `reader/rewrite`: transform a free-standing function into a method
* `reader/rewrite`: use a proper constant instead of a magic number in `applyFuncOnTextContent`
* `reader/rss`: add support for `<media:category>` element
* `reader/rss`: don't add empty tags to RSS items
* `reader/rss`: refactor RSS parser to use a default namespace to avoid some limitations of the Go XML parser
* `reader/rss`: refactor RSS Parser to use an adapter
* `reader/rss`: remove some duplicated code in RSS parser
* `reader`: ensure that enclosure URLs are always absolute
* `reader`: move iTunes and GooglePlay XML definitions to their own packages
* `reader`: parse podcast categories
* `reader`: remove trailing space in `SiteURL` and `FeedURL`
* `storage`: do not store empty tags
* `storage`: simplify `removeDuplicates()` to use a `sort`+`compact` construct instead of doing it by hand with a hashmap
* `storage`: Use plain strings concatenation instead of building an array and then joining it
* `timezone`: make sure the tests pass when the timezone database is not installed on the host
* `ui/css`: align `min-width` with the other `min-width` values
* `ui/css`: fix regression: "Add to Home Screen" button is unreadable
* `ui/js`: don't use lambdas to return a function, use directly the function instead
* `ui/js`: enable trusted-types
* `ui/js`: fix download button loading label
* `ui/js`: fix JavaScript error on the login page when the user not authenticated
* `ui/js`: inline one-line functions
* `ui/js`: inline some `querySelectorAll` calls
* `ui/js`: reduce the scope of some variables
* `ui/js`: remove a hack for "Chrome 67 and earlier" since it was released in 2018
* `ui/js`: replace `DomHelper.findParent` with `.closest`
* `ui/js`: replace `let` with `const`
* `ui/js`: simplify `DomHelper.getVisibleElements` by using a `filter` instead of a loop with an index
* `ui/js`: use a `Set` instead of an array in a `KeyboardHandler`'s member
* `ui/js`: use some ternaries where it makes sense
* `ui/static`: make use of `HashFromBytes` everywhere
* `ui/static`: set minifier ECMAScript version
* `ui`: add keyboard shortcuts for scrolling to top/bottom of the item list
* `ui`: add media player control playback speed
* `ui`: remove unused variables and improve JSON decoding in `saveEnclosureProgression()`
* `validator`: display an error message on edit feed page when the feed URL is not unique
* Bump `github.com/coreos/go-oidc/v3` from `3.9.0` to `3.10.0`
* Bump `github.com/go-webauthn/webauthn` from `0.10.1` to `0.10.2`
* Bump `github.com/tdewolff/minify/v2` from `2.20.18` to `2.20.19`
* Bump `google.golang.org/protobuf` from `1.32.0` to `1.33.0`
Version 2.1.1 (March 10, 2024)
-----------------------------
* Move search form to a dedicated page
* Add Readeck integration
* Add feed option to disable HTTP/2 to avoid fingerprinting
* Add `Enter` key as a hotkey to open selected item
* Proxify `video` element `poster` attribute
* Add a couple of new possible locations for feeds
* Hugo likes to generate `index.xml`
* `feed.atom` and `feed.rss` are used by enterprise-scale/old-school gigantic CMS
* Fix categories import from Thunderbird's OPML
* Fix logo misalignment when using languages that are more verbose than English
* Google Reader: Do not return a 500 error when no items is returned
* Handle RDF feeds with duplicated `<title>` elements
* Sort integrations alphabetically
* Add more URL validation in media proxy
* Add unit test to ensure each translation has the correct number of plurals
* Add missing plurals for some languages
* Makefile: quiet `git describe` and `rev-parse` stderr: When building from a tarball instead of a cloned git repo, there would be two `fatal: not a git repository` errors emitted even though the build succeeds. This is because of how `VERSION` and `COMMIT` are set in the Makefile. This PR suppresses the stderr for these variable assignments.
* Makefile: do not force `CGO_ENABLED=0` for `miniflux` target
* Add GitHub Action pipeline to build packages on-demand
* Remove Golint (deprecated), use `staticcheck` and `golangci-lint` instead
* Build amd64/arm64 Debian packages with CGO disabled
* Update `go.mod` and add `.exe` suffix to Windows binary
* Add a couple of fuzzers
* Fix CodeQL workflow
* Code and performance improvements:
* Use an `io.ReadSeeker` instead of an `io.Reader` to parse feeds
* Speed up the sanitizer:
- Allow Youtube URLs to start with `www`
- Use `strings.Builder` instead of a `bytes.Buffer`
- Use a `strings.NewReader` instead of a `bytes.NewBufferString`
- Sprinkles a couple of `continue` to make the code-flow more obvious
- Inline calls to `inList`, and put their parameters in the right order
- Simplify `isPixelTracker`
- Simplify `isValidIframeSource`, by extracting the hostname and comparing it directly, instead of using the full url and checking if it starts with multiple variations of the same one (`//`, `http:`, `https://` multiplied by `/www.`)
- Add a benchmark
- Instead of having to allocate a ~100 keys map containing possibly dynamic values (at least to the go compiler), allocate it once in a global variable. This significantly speeds things up, by reducing the garbage
- Use constant time access for maps instead of iterating on them
- Build a ~large whitelist map inline instead of constructing it item by item (and remove a duplicate key/value pair)
- Use `slices` instead of hand-rolled loops
collector/allocator involvements.
* Reuse a `Reader` instead of copying to a buffer when parsing an Atom feed
* Preallocate memory when exporting to OPML: This should marginally increase performance when exporting a large amount of feeds to OPML
* Delay call of `view.New` after logging the user in: There is no need to do extra work like creating a session and its associated view until the user has been properly identified and as many possibly-failing sql request have been successfully run
* Use constant-time comparison for anti-csrf tokens: This is probably completely overkill, but since anti-csrf tokens are secrets, they should be compared against untrusted inputs in constant time
* Simplify and optimize `genericProxyRewriter`
- Reduce the amount of nested loops: it's preferable to search the whole page once and filter on it (even with filters that should always be false), than searching it again for every element we're looking for.
- Factorize the proxying conditions into a `shouldProxy` function to reduce the copy-pasta.
* Speed up `removeUnlikelyCandidates`: `.Not` returns a brand new `Selection`, copied element by element
* Improve `EstimateReadingTime`'s speed by a factor 7
- Refactorise the tests and add some
- Use 250 signs instead of the whole text
- Only check for Korean, Chinese and Japanese script
- Add a benchmark
- Use a more idiomatic control flow
* Don't compute reading-time when unused: If the user doesn't display reading times, there is no need to compute them. This should speed things up a bit, since `whatlanggo.Detect` is abysmally slow.
* Simplify `username` generation for the integration tests: No need to generate random numbers 10 times, generate a single big-enough one. A single int64 should be more than enough
* Add missing regex anchor detected by CodeQL
* Don't mix up slices capacity and length
* Use prepared statements for intervals, `ArchiveEntries` and `updateEnclosures`
* Use modern for-loops introduced with Go 1.22
* Remove a superfluous condition: No need to check if the length of `line` is positive since we're checking afterwards that it contains the `=` sign
* Close resources as soon as possible, instead of using `defer()` in a loop
* Remove superfluous escaping in a regex
* Use `strings.ReplaceAll` instead of `strings.Replace(…, -1)`
* Use `strings.EqualFold` instead of `strings.ToLower(…) ==`
* Use `.WriteString(` instead of `.Write([]byte(…`
* Use `%q` instead of `"%s"`
* Make `internal/worker/worker.go` read-only
* Use a switch-case construct in `internal/locale/plural.go` instead of an avalanche of `if`
* Template functions: simplify `formatFileSize` and `duration` implementation
* Inline some templating functions
* Make use of `printer.Print` when possible
* Add a `printer.Print` to `internal/locale/printer.go`: No need to use variadic functions with string format interpolation to generate static strings
* Minor code simplification in `internal/ui/view/view.go`: No need to create the map item by item when we can create it in one go
* Build the map inline in `CountAllFeeds()`: No need to build an empty map to then add more fields in it one by one
* Miscellaneous improvements to `internal/reader/subscription/finder.go`:
- Surface `localizedError` in `FindSubscriptionsFromWellKnownURLs` via `slog`
- Use an inline declaration for new subscriptions, like done elsewhere in the
file, if only for consistency's sake
- Preallocate the `subscriptions` slice when using an RSS-bridge,
* Use an update-where for `MarkCategoryAsRead` instead of a subquery
* Simplify `CleanOldUserSessions`' query: No need for a subquery, filtering on `created_at` directly is enough
* Simplify `cleanupEntries`' query
- `NOT (hash=ANY(%4))` can be expressed as `hash NOT IN $4`
- There is no need for a subquery operating on the same table, moving the conditions out is equivalent.
* Reformat `ArchiveEntries`'s query for consistency's sake and replace the `=ANY` with an `IN`
* Reformat the query in `GetEntryIDs` and `GetReadTime`'s query for consistency's sake
* Simplify `WeeklyFeedEntryCount`: No need for a `BETWEEN`: we want to filter on entries published in the last week, no need to express is as "entries published between now and last week", "entries published after last week" is enough
* Add some tests for `add_image_title`
* Remove `github.com/google/uuid` dependencies: Replace it with a hand-rolled implementation. Heck, an UUID isn't even a requirement according to Omnivore API docs
* Simplify `internal/reader/icon/finder.go`:
- Use a simple regex to parse data uri instead of a hand-rolled parser, and document what fields are considered mandatory.
- Use case-insensitive matching to find (fav)icons, instead of doing the same query twice with different letter cases
- Add `apple-touch-icon-precomposed.png` as a fallback `favicon`
- Reorder the queries to have `icon` first, since it seems to be the most popular one. It used to be last, meaning that pages had to be parsed completely 4 times, instead of one now.
- Minor factorisation in `findIconURLsFromHTMLDocument`
* Small refactoring of `internal/reader/date/parser.go`:
- Split dates formats into those that require local times and those who don't, so that there is no need to have a switch-case in the for loop with around 250 iterations at most.
- Be more strict when it comes to timezones, previously invalid ones like -13 were accepted. Also add a test for this.
- Bail out early if the date is an empty string.
* Make use of Go ≥ 1.21 slices package instead of hand-rolled loops
* Reorder the fields of the `Entry` struct to save some memory
* Dependencies update:
* Bump `golang.org/x/oauth2` from `0.17.0` to `0.18.0`
* Bump `github.com/prometheus/client_golang` from `1.18.0` to `1.19.0`
* Bump `github.com/tdewolff/minify/v2` from `2.20.16` to `2.20.18`
* Bump `github.com/PuerkitoBio/goquery` from `1.8.1` to `1.9.1`
* Bump `golang.org/x/crypto` from `0.19.0` to `0.20.0`
* Bump `github.com/go-jose/go-jose/v3` from `3.0.1` to `3.0.3`
Version 2.1.0 (February 17, 2024)
---------------------------------
* Add Linkwarden integration
* Add LinkAce integration
* Add `FORCE_REFRESH_INTERVAL` config option
* Add `item-meta-info-reading-time` CSS class
* Add `add_dynamic_iframe` rewrite function
* Add attribute `data-original-mos` to `add_dynamic_image` rewrite candidates
* Update entry processor to allow blocking/keeping entries by tags and/or authors
* Change default `Accept` header when fetching feeds
* Rewrite relative RSS Bridge URL to absolute URL
* Use numeric user ID in Alpine and distroless container image (avoid `securityContext` error in Kubernetes)
* Always try to use HTTP/2 when fetching feeds if available
* Add `type` attribute in OPML export as per OPML 2.0 specs
* Fix missing translation argument for the key `error.unable_to_parse_feed`
* Fix Debian package builder when using Go 1.22 and `armhf` architecture
* Fix typo in log message
* Fix incorrect label shown when saving an article
* Fix incorrect condition in refresh feeds cli
* Fix incorrect label `for` attribute
* Add missing label ID for custom CSS field
* Accessibility improvements:
* Add workaround for macOS VoiceOver that didn't announce `details` and `summary` when expanded
* Add `alert` role to alert message element
* Add a `h2` heading to the article element so that the screen reader users can navigate the article through the heading level
* Add an `aria-label` attribute for the article element for screen readers
* Remove the icon image `alt` attribute in feeds list to prevent screen reader to announce it before entry title
* Add `sr-only` CSS class for screen reader users (provides more context)
* Differentiate between buttons and links
* Change links that could perform actions to buttons
* Improve translation of hidden Aria elements
* Remove the redundant article role
* Add a search landmark for the search form so that the screen reader users can navigate to it
* Add skip to content link
* Add `nav` landmark to page header links
* Limit feed/category entry pagination to unread entries when coming from unread entry list
* Update German translation
* Update GitHub Actions to Go 1.22
* Bump `golang.org/x/term` from `0.16.0` to `0.17.0`
* Bump `github.com/google/uuid` from `1.5.0` to `1.6.0`
* Bump `github.com/yuin/goldmark` from `1.6.0` to `1.7.0`
* Bump `golang.org/x/oauth2` from `0.15.0` to `0.17.0`
* Bump `github.com/tdewolff/minify/v2` from `2.20.10` to `2.20.12`
* Bump `golang.org/x/term` from `0.15.0` to `0.16.0`
* Bump `github.com/prometheus/client_golang` from `1.17.0` to `1.18.0`
* Bump `github.com/tdewolff/minify/v2` from `2.20.9` to `2.20.16`
* Bump `golang.org/x/crypto` from `0.16.0` to `0.19.0`
* Bump `github.com/go-webauthn/webauthn` from `0.9.4` to` 0.10.1`
* Bump `golang.org/x/net` from `0.20.0` to `0.21.0`
Version 2.0.51 (December 13, 2023)
----------------------------------
* Add Omnivore integration
* Fixes for the regressions introduced in version 2.0.50:
* Ensure all HTML documents are encoded in UTF-8
* Send default User-Agent and HTTP caching headers when making HTTP requests
* Allow Youtube links to be opened outside the `iframe` (avoid `ERR_BLOCKED_BY_RESPONSE` error)
* Fix inaccessible metrics endpoint when listening on Unix socket
* Allow renaming and moving feed at the same time in the Google Reader API
* Log `nb_jobs` only when number of jobs is larger than 0 in background scheduler
* Deduplicate feed URLs when parsing HTML document during discovery process
* Calculate a virtual weekly count based on the average updating frequency (`POLLING_SCHEDULER=entry_frequency`)
* Update GitHub Actions workflow to be able to run the linter and tests on-demand
- Bookmarklet for subscribing to websites directly from any web browser.
- Webhooks for real-time notifications or custom integrations.
- Compatibility with existing mobile applications using the Fever or Google Reader API.
- REST API with client libraries available in [Go](https://github.com/miniflux/v2/tree/main/client) and [Python](https://github.com/miniflux/python-client).
- Single binary compiled statically without dependency.
- Works only with [PostgreSQL](https://www.postgresql.org/).
- Does not use any ORM or any complicated frameworks.
- Uses modern vanilla JavaScript only when necessary.
- All static files are bundled into the application binary using the Go `embed` package.
- Supports the Systemd `sd_notify` protocol for process monitoring.
- Configures HTTPS automatically with Let's Encrypt.
- Allows the use of custom <abbr title="Secure Sockets Layer">SSL</abbr> certificates.
- Supports [HTTP/2](https://en.wikipedia.org/wiki/HTTP/2) when TLS is enabled.
- Updates feeds in the background using an internal scheduler or a traditional cron job.
- Sanitizes external content before rendering it.
- Enforces a [Content Security Policy](https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP) that permits only application JavaScript and blocks inline scripts and styles.
- Uses native lazy loading for images and iframes.
- Compatible only with modern browsers.
- Adheres to the [Twelve-Factor App](https://12factor.net/) methodology.
- Provides official Debian/RPM packages and pre-built binaries.
- Publishes a Docker image to Docker Hub, GitHub Registry, and Quay.io Registry, with ARM architecture support.
Documentation
-------------
@@ -29,7 +119,7 @@ The Miniflux documentation is available here: <https://miniflux.app/docs/> ([Man
- [Command Line Usage](https://miniflux.app/docs/cli.html)
@@ -6,4 +6,6 @@ Only the latest stable version is supported.
## Reporting a Vulnerability
Send an email to `security AT miniflux DOT net` with all the steps to reproduce the problem.
Preferably, [report the vulnerability privately using GitHub](https://github.com/miniflux/v2/security/advisories/new) ([documentation](https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing/privately-reporting-a-security-vulnerability)).
If you do not want to use GitHub, send an email to `security AT miniflux DOT net` with all the steps to reproduce the problem.
sql:=`ALTER TABLE integrations DROP COLUMN fever_password`
_,err=tx.Exec(sql)
returnerr
},
func(tx*sql.Tx)(errerror){
sql:=`
ALTER TABLE feeds
ADD COLUMN blocklist_rules text not null default '',
ADD COLUMN keeplist_rules text not null default ''
`
_,err=tx.Exec(sql)
returnerr
},
func(tx*sql.Tx)(errerror){
sql:=`ALTER TABLE entries ADD COLUMN reading_time int not null default 0`
_,err=tx.Exec(sql)
returnerr
},
func(tx*sql.Tx)(errerror){
sql:=`
ALTER TABLE entries ADD COLUMN created_at timestamp with time zone not null default now();
UPDATE entries SET created_at = published_at;
`
_,err=tx.Exec(sql)
returnerr
},
func(tx*sql.Tx)(errerror){
_,err=tx.Exec(`
ALTER TABLE users
ADD column stylesheet text not null default '',
ADD column google_id text not null default '',
ADD column openid_connect_id text not null default ''
`)
iferr!=nil{
returnerr
}
_,err=tx.Exec(`
DECLARE my_cursor CURSOR FOR
SELECT
id,
COALESCE(extra->'custom_css', '') as custom_css,
COALESCE(extra->'google_id', '') as google_id,
COALESCE(extra->'oidc_id', '') as oidc_id
FROM users
FOR UPDATE
`)
iferr!=nil{
returnerr
}
defertx.Exec("CLOSE my_cursor")
for{
var(
userIDint64
customStylesheetstring
googleIDstring
oidcIDstring
)
iferr:=tx.QueryRow(`FETCH NEXT FROM my_cursor`).Scan(&userID,&customStylesheet,&googleID,&oidcID);err!=nil{
iferr==sql.ErrNoRows{
break
}
returnerr
}
_,err:=tx.Exec(
`UPDATE
users
SET
stylesheet=$2,
google_id=$3,
openid_connect_id=$4
WHERE
id=$1
`,
userID,customStylesheet,googleID,oidcID)
iferr!=nil{
returnerr
}
}
returnerr
},
func(tx*sql.Tx)(errerror){
_,err=tx.Exec(`
ALTER TABLE users DROP COLUMN extra;
CREATE UNIQUE INDEX users_google_id_idx ON users(google_id) WHERE google_id <> '';
CREATE UNIQUE INDEX users_openid_connect_id_idx ON users(openid_connect_id) WHERE openid_connect_id <> '';
`)
returnerr
},
func(tx*sql.Tx)(errerror){
_,err=tx.Exec(`
CREATE INDEX entries_feed_url_idx ON entries(feed_id, url);
CREATE INDEX entries_user_status_feed_idx ON entries(user_id, status, feed_id);
CREATE INDEX entries_user_status_changed_idx ON entries(user_id, status, changed_at);
`)
returnerr
},
func(tx*sql.Tx)(errerror){
_,err=tx.Exec(`
CREATE TABLE acme_cache (
key varchar(400) not null primary key,
data bytea not null,
updated_at timestamptz not null
);
`)
returnerr
},
func(tx*sql.Tx)(errerror){
_,err=tx.Exec(`
ALTER TABLE feeds ADD COLUMN allow_self_signed_certificates boolean not null default false
`)
returnerr
},
func(tx*sql.Tx)(errerror){
sql:=`
CREATE TYPE webapp_display_mode AS enum('fullscreen', 'standalone', 'minimal-ui', 'browser');
ALTER TABLE users ADD COLUMN display_mode webapp_display_mode default 'standalone';
`
_,err=tx.Exec(sql)
returnerr
},
func(tx*sql.Tx)(errerror){
sql:=`ALTER TABLE feeds ADD COLUMN cookie text default ''`
_,err=tx.Exec(sql)
returnerr
},
func(tx*sql.Tx)(errerror){
_,err=tx.Exec(`
ALTER TABLE categories ADD COLUMN hide_globally boolean not null default false
`)
returnerr
},
func(tx*sql.Tx)(errerror){
_,err=tx.Exec(`
ALTER TABLE feeds ADD COLUMN hide_globally boolean not null default false
`)
returnerr
},
func(tx*sql.Tx)(errerror){
sql:=`
ALTER TABLE integrations ADD COLUMN telegram_bot_enabled bool default 'f';
ALTER TABLE integrations ADD COLUMN telegram_bot_token text default '';
ALTER TABLE integrations ADD COLUMN telegram_bot_chat_id text default '';
`
_,err=tx.Exec(sql)
returnerr
},
func(tx*sql.Tx)(errerror){
sql:=`
CREATE TYPE entry_sorting_order AS enum('published_at', 'created_at');
ALTER TABLE users ADD COLUMN entry_order entry_sorting_order default 'published_at';
`
_,err=tx.Exec(sql)
returnerr
},
func(tx*sql.Tx)(errerror){
sql:=`
ALTER TABLE integrations ADD COLUMN googlereader_enabled bool default 'f';
ALTER TABLE integrations ADD COLUMN googlereader_username text default '';
ALTER TABLE integrations ADD COLUMN googlereader_password text default '';
`
_,err=tx.Exec(sql)
returnerr
},
func(tx*sql.Tx)(errerror){
sql:=`
ALTER TABLE integrations ADD COLUMN espial_enabled bool default 'f';
ALTER TABLE integrations ADD COLUMN espial_url text default '';
ALTER TABLE integrations ADD COLUMN espial_api_key text default '';
ALTER TABLE integrations ADD COLUMN espial_tags text default 'miniflux';
`
_,err=tx.Exec(sql)
returnerr
},
func(tx*sql.Tx)(errerror){
sql:=`
ALTER TABLE integrations ADD COLUMN linkding_enabled bool default 'f';
ALTER TABLE integrations ADD COLUMN linkding_url text default '';
ALTER TABLE integrations ADD COLUMN linkding_api_key text default '';
`
_,err=tx.Exec(sql)
returnerr
},
func(tx*sql.Tx)(errerror){
_,err=tx.Exec(`
ALTER TABLE feeds ADD COLUMN url_rewrite_rules text not null default ''
`)
returnerr
},
func(tx*sql.Tx)(errerror){
_,err=tx.Exec(`
ALTER TABLE users ADD COLUMN default_reading_speed int default 265;
ALTER TABLE users ADD COLUMN cjk_reading_speed int default 500;
`)
return
},
func(tx*sql.Tx)(errerror){
_,err=tx.Exec(`
ALTER TABLE users ADD COLUMN default_home_page text default 'unread';
`)
return
},
func(tx*sql.Tx)(errerror){
_,err=tx.Exec(`
ALTER TABLE integrations ADD COLUMN wallabag_only_url bool default 'f';
`)
return
},
func(tx*sql.Tx)(errerror){
_,err=tx.Exec(`
ALTER TABLE users ADD COLUMN categories_sorting_order text not null default 'unread_count';
`)
return
},
func(tx*sql.Tx)(errerror){
sql:=`
ALTER TABLE integrations ADD COLUMN matrix_bot_enabled bool default 'f';
ALTER TABLE integrations ADD COLUMN matrix_bot_user text default '';
ALTER TABLE integrations ADD COLUMN matrix_bot_password text default '';
ALTER TABLE integrations ADD COLUMN matrix_bot_url text default '';
ALTER TABLE integrations ADD COLUMN matrix_bot_chat_id text default '';
`
_,err=tx.Exec(sql)
return
},
}
Some files were not shown because too many files have changed in this diff
Show More
Reference in New Issue
Block a user
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Frédéric Guillot