Repository navigation
[GridView] Fetch Open Graph images with the FreshRSS HTTP client - #559
Merged
Merged
Conversation
The optional Open Graph thumbnail fetching downloaded article pages with file_get_contents() on an http(s) URL. Since FreshRSS 1.30.0, every stream wrapper except file:// and php:// is unregistered at startup, so that call always fails and no og:image / twitter:image is ever found, both when entries are inserted and through the asynchronous AJAX endpoint. Use FreshRSS_http_Util::httpGet() instead, like the core favicon lookup. It goes through cURL and also applies the system proxy and cURL options, the internal-host (SSRF) checks, Retry-After handling and the HTML cache. The previous 5-second timeout is kept, and relative image URLs are now resolved against the URL reached after redirects. FreshRSS_http_Util::httpGet() exists since FreshRSS 1.28.0, so raise the declared compatibility accordingly and bump the version to 1.1.2.
Member
|
Thanks! |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
The optional Thumbnail fetching feature of Grid View downloads the article page with
file_get_contents()on anhttp(s)://URL to look forog:image/twitter:image.Since FreshRSS 1.30.0,
unregister_unsafe_protocols()removes every stream wrapper exceptfileandphp, so that call always fails and no thumbnail is ever found, neither inentry_before_insertnor through the asynchronous AJAX endpoint used bygrid.js.This is the same root cause as the one found for the external YouTubeChannel2RssFeed extension in #529.
FreshRSS_http_Util::httpGet()(as done by the core favicon lookup), which also brings the system proxy / cURL options, the internal-host (SSRF) checks,Retry-Afterhandling and the HTML cacheFreshRSS_http_Util::httpGet()exists since FreshRSS 1.28.0, so raisecompatibilityfrom 1.25.0 to 1.28.0 (README updated as well) and bump the version to 1.1.2Validation
edgeinstall (so the stream wrappers are unregistered as in production), against a local test server andINTERNAL_HOST_ALLOWLISTset for it:main:extractOgImage()returnsnullfor every URLog:imageis found, including through a301redirect where a relativeimages/cover.jpgis now resolved against the redirected page; a404page still givesnullcomposer run-script php-lint,phpcs,phpstan(with../FreshRSS)