Skip to content

Provide theme class for CSS#7559

Merged
Alkarex merged 10 commits intoFreshRSS:edgefrom
Inverle:theme-class
May 7, 2025
Merged

Provide theme class for CSS#7559
Alkarex merged 10 commits intoFreshRSS:edgefrom
Inverle:theme-class

Conversation

@Inverle
Copy link
Member

@Inverle Inverle commented May 6, 2025 •
edited
Loading

Adds a theme class into the HTML to be used inside CSS. Use cases include user-supplied CSS (via UserCSS) and extensions.

For example this is what I'm doing in my User CSS:

	/* toggle sidebar */

	@media (prefers-color-scheme: dark) {
		body:not(.theme-pafat):not(.theme-ansum) {
			.show-sidebar img,
			.close-sidebar img {
				filter: invert(1) brightness(2);
			}
		}
	}
	
	body.theme-nord,
	body.theme-swage,
	body.theme-mapco,
	body.theme-flat,
	body.theme-dark-pink,
	body.theme-dark,
	body.theme-alternative-dark {
		.show-sidebar img,
		.close-sidebar img {
			filter: invert(1) brightness(2);
		}
	}

Alkarex
Alkarex requested changes May 7, 2025
View reviewed changes
@Alkarex Alkarex added this to the 1.27.0 milestone May 7, 2025
Alkarex
Alkarex reviewed May 7, 2025
View reviewed changes
Alkarex
Alkarex reviewed May 7, 2025
View reviewed changes
@Inverle
Copy link
Member Author

Inverle commented May 7, 2025 •
edited
Loading

Whitespace is replaced to prevent injection of other CSS classes, for example when a user sets their theme to a[any whitespace character]dropdown-menu, any page they visit is going to be blank, due to injection of the dropdown-menu class.

The dropdown-menu class has the display: none property inside of it, among others.

@Inverle Inverle requested a review from Alkarex May 7, 2025 10:51
Alkarex added a commit to Alkarex/FreshRSS that referenced this pull request May 7, 2025
@Alkarex
Fix encoding of themes
68944c8 
Several HTML and URL encoding issues in the case of special chars in theme directory or in metadata.
Also usefull to simplify FreshRSS#7559
@Alkarex Alkarex mentioned this pull request May 7, 2025
Merged
Alkarex
Alkarex reviewed May 7, 2025
View reviewed changes
@Inverle
Copy link
Member Author

Inverle commented May 7, 2025

I decided to go with theme_ instead of theme-, once again for consistency.

@Inverle Inverle requested a review from Alkarex May 7, 2025 15:41
Alkarex added a commit that referenced this pull request May 7, 2025
@Alkarex
Fix encoding of themes (#7565)
25f57be 
* Fix encoding of themes
Several HTML and URL encoding issues in the case of special chars in theme directory or in metadata.
Also usefull to simplify #7559

* Minor simplification

* Stricter decoding
@Alkarex
Copy link
Member

Alkarex commented May 7, 2025

Looks good to me. Let me know if you would better like it with strtolower() of whether it is good enough as it is

@Inverle
Copy link
Member Author

Inverle commented May 7, 2025

Looks good to me. Let me know if you would better like it with strtolower() of whether it is good enough as it is

It's good

@Alkarex Alkarex merged commit 4968ff7 into FreshRSS:edge May 7, 2025
1 check passed
@Alkarex Alkarex modified the milestones: 1.27.0, 1.26.3 May 23, 2025
@Inverle Inverle mentioned this pull request May 30, 2025
Closed
@Inverle Inverle mentioned this pull request Jul 7, 2025
Merged
Alkarex pushed a commit that referenced this pull request Jul 7, 2025
@Inverle
Disallow setting non-existent theme (#7722)
6549932 
Related: FreshRSS/xExtension-Demo#2, #7559 (comment)

Mostly to make sure that no one is able to break the demo instance
But the issues below could possibly be exploited in other scenarios too:
* Setting a theme like `../../lib/core-extensions/UserJS`: this directory contains `metadata.json` like themes do, so FreshRSS treats it as a theme after setting it and doesn't load any CSS
* Setting a theme like `x dropdown-menu`: the `dropdown-menu` class was able to get injected into the `<body>` element since #7559 and turn every page blank
@Inverle Inverle deleted the theme-class branch September 2, 2025 05:15
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@Alkarex Alkarex Alkarex approved these changes

Assignees

No one assigned

Labels

Extension 🔌 Theme 🖌

Projects

None yet

Milestone

1.26.3

Development

Successfully merging this pull request may close these issues.

2 participants

@Inverle @Alkarex