Cleaner limit anonymous mode to default user (#9235)

While waiting for https://github.com/FreshRSS/FreshRSS/issues/1553

app/Controllers/feedController.php

@@ -14,7 +14,6 @@ class FreshRSS_feed_Controller extends FreshRSS_ActionController {
 	public function firstAction(): void {
 		if (!FreshRSS_Auth::hasAccess()) {
 			$action = Minz_Request::actionName();
-			$allow_anonymous_refresh = FreshRSS_Context::systemConf()->allow_anonymous_refresh;
 
 			// Likely coming from bookmarklet, redirect to the login page
 			if ($action === 'add') {
@@ -22,7 +21,7 @@ class FreshRSS_feed_Controller extends FreshRSS_ActionController {
 				return;
 			}
 
-			if ($action !== 'actualize' || (!$allow_anonymous_refresh && !Minz_Request::tokenIsOk())) {
+			if ($action !== 'actualize' || (!FreshRSS_Auth::allowAnonymousRefresh() && !Minz_Request::tokenIsOk())) {
 				Minz_Error::error(403);
 			}
 		}

app/Controllers/indexController.php

@@ -102,9 +102,12 @@ class FreshRSS_index_Controller extends FreshRSS_ActionController {
 	 * This action displays the normal view of FreshRSS.
 	 */
 	public function normalAction(): void {
-		$allow_anonymous = FreshRSS_Context::systemConf()->allow_anonymous;
-		if (!FreshRSS_Auth::hasAccess() && !$allow_anonymous) {
-			Minz_Request::forward(['c' => 'auth', 'a' => 'login']);
+		if (!FreshRSS_Auth::hasAccess() && !FreshRSS_Auth::allowAnonymous()) {
+			if (Minz_Request::paramString('user') !== '') {
+				Minz_Error::error(403, redirect: false);
+			} else {
+				Minz_Request::forward(['c' => 'auth', 'a' => 'login']);
+			}
 			return;
 		}
 
@@ -208,9 +211,12 @@ class FreshRSS_index_Controller extends FreshRSS_ActionController {
 	 * This action displays the global view of FreshRSS.
 	 */
 	public function globalAction(): void {
-		$allow_anonymous = FreshRSS_Context::systemConf()->allow_anonymous;
-		if (!FreshRSS_Auth::hasAccess() && !$allow_anonymous) {
-			Minz_Request::forward(['c' => 'auth', 'a' => 'login']);
+		if (!FreshRSS_Auth::hasAccess() && !FreshRSS_Auth::allowAnonymous()) {
+			if (Minz_Request::paramString('user') !== '') {
+				Minz_Error::error(403, redirect: false);
+			} else {
+				Minz_Request::forward(['c' => 'auth', 'a' => 'login']);
+			}
 			return;
 		}
 
@@ -251,10 +257,8 @@ class FreshRSS_index_Controller extends FreshRSS_ActionController {
 	 * @deprecated See user query RSS sharing instead
 	 */
 	public function rssAction(): void {
-		$allow_anonymous = FreshRSS_Context::systemConf()->allow_anonymous;
-
 		// Check if user has access.
-		if (!FreshRSS_Auth::hasAccess() && !$allow_anonymous && !Minz_Request::tokenIsOk()) {
+		if (!FreshRSS_Auth::hasAccess() && !FreshRSS_Auth::allowAnonymous() && !Minz_Request::tokenIsOk()) {
 			Minz_Error::error(403, redirect: false);
 			return;
 		}
@@ -288,10 +292,8 @@ class FreshRSS_index_Controller extends FreshRSS_ActionController {
 	}
 
 	public function opmlAction(): void {
-		$allow_anonymous = FreshRSS_Context::systemConf()->allow_anonymous;
-
 		// Check if user has access.
-		if (!FreshRSS_Auth::hasAccess() && !$allow_anonymous && !Minz_Request::tokenIsOk()) {
+		if (!FreshRSS_Auth::hasAccess() && !FreshRSS_Auth::allowAnonymous() && !Minz_Request::tokenIsOk()) {
 			Minz_Error::error(403, redirect: false);
 			return;
 		}

app/Controllers/javascriptController.php

@@ -19,10 +19,7 @@ class FreshRSS_javascript_Controller extends FreshRSS_ActionController {
 	}
 
 	public function actualizeAction(): void {
-		if (!FreshRSS_Auth::hasAccess() && !(
-			FreshRSS_Context::systemConf()->allow_anonymous
-			&& FreshRSS_Context::systemConf()->allow_anonymous_refresh
-			)) {
+		if (!FreshRSS_Auth::hasAccess() && !FreshRSS_Auth::allowAnonymousRefresh()) {
 			Minz_Error::error(403);
 			return;
 		}
@@ -58,7 +55,7 @@ class FreshRSS_javascript_Controller extends FreshRSS_ActionController {
 	}
 
 	public function nbUnreadsPerFeedAction(): void {
-		if (!FreshRSS_Auth::hasAccess() && !FreshRSS_Context::systemConf()->allow_anonymous) {
+		if (!FreshRSS_Auth::hasAccess() && !FreshRSS_Auth::allowAnonymous()) {
 			Minz_Error::error(403);
 			return;
 		}

app/Controllers/tagController.php

@@ -145,7 +145,7 @@ class FreshRSS_tag_Controller extends FreshRSS_ActionController {
 	}
 
 	public function getTagsForEntryAction(): void {
-		if (!FreshRSS_Auth::hasAccess() && !FreshRSS_Context::systemConf()->allow_anonymous) {
+		if (!FreshRSS_Auth::hasAccess() && !FreshRSS_Auth::allowAnonymous()) {
 			Minz_Error::error(403);
 		}
 		$this->view->_layout(null);

app/FreshRSS.php

@@ -57,7 +57,7 @@ class FreshRSS extends Minz_FrontController {
 		// Complete initialization of the other FreshRSS / Minz components.
 		self::initI18n();
 		// Enable extensions for the current (logged) user.
-		if (FreshRSS_Auth::hasAccess() || FreshRSS_Context::systemConf()->allow_anonymous) {
+		if (FreshRSS_Auth::hasAccess() || FreshRSS_Auth::allowAnonymous()) {
 			$ext_list = FreshRSS_Context::userConf()->extensions_enabled;
 			Minz_ExtensionManager::enableByList($ext_list, 'user');
 		}
@@ -76,9 +76,9 @@ class FreshRSS extends Minz_FrontController {
 				(Minz_Request::controllerName() === 'auth' && Minz_Request::actionName() === 'login') ||
 				(Minz_Request::controllerName() === 'user' && Minz_Request::actionName() === 'create' && !FreshRSS_Auth::hasAccess('admin')) ||
 				(Minz_Request::controllerName() === 'feed' && Minz_Request::actionName() === 'actualize' &&
-					FreshRSS_Context::systemConf()->allow_anonymous_refresh) ||
+					FreshRSS_Auth::allowAnonymousRefresh()) ||
 				(Minz_Request::controllerName() === 'javascript' && Minz_Request::actionName() === 'actualize' &&
-					FreshRSS_Context::systemConf()->allow_anonymous)
+					FreshRSS_Auth::allowAnonymous())
 				)) {
 				// Token-based protection against XSRF attacks, except for the login or self-create user forms
 				self::initI18n();

app/Models/Auth.php

@@ -270,4 +270,16 @@ class FreshRSS_Auth {
 
 		return false;
 	}
+
+	public static function allowAnonymous(): bool {
+		$defaultUser = FreshRSS_Context::systemConf()->default_user;
+		$requestedUser = Minz_Request::paramString('user');
+		return FreshRSS_Context::systemConf()->allow_anonymous &&
+			Minz_User::name() === $defaultUser &&
+			($requestedUser === '' || $requestedUser === $defaultUser);
+	}
+
+	public static function allowAnonymousRefresh(): bool {
+		return FreshRSS_Context::systemConf()->allow_anonymous_refresh && self::allowAnonymous();
+	}
 }

app/layout/header.phtml

@@ -16,7 +16,7 @@
 	</div>
 
 	<div class="item search">
-		<?php if (FreshRSS_Auth::hasAccess() || FreshRSS_Context::systemConf()->allow_anonymous) { ?>
+		<?php if (FreshRSS_Auth::hasAccess() || FreshRSS_Auth::allowAnonymous()) { ?>
 		<form action="<?= $this->html_url ?>" method="get">
 			<?php if (Minz_Request::controllerName() === 'index'): ?>
 				<?php if (in_array(Minz_Request::actionName(), ['normal', 'global', 'reader'], true)) { ?>

app/layout/nav_menu.phtml

@@ -285,7 +285,7 @@
 		</div>
 	</div>
 
-	<?php if (FreshRSS_Auth::hasAccess() || FreshRSS_Context::systemConf()->allow_anonymous_refresh) { ?>
+	<?php if (FreshRSS_Auth::hasAccess() || FreshRSS_Auth::allowAnonymousRefresh()) { ?>
 		<div id="nav_menu_actualize" class="group">
 			<a id="actualize" class="btn" href="<?= _url('feed', 'actualize') ?>" title="<?= _t('gen.action.actualize') ?>"><?= _i('refresh') ?></a>
 		</div>

app/views/helpers/javascript_vars.phtml

@@ -4,7 +4,7 @@ declare(strict_types=1);
 $mark = FreshRSS_Context::userConf()->mark_when;
 $s = FreshRSS_Context::userConf()->shortcuts;
 $extData = Minz_ExtensionManager::callHook(Minz_HookType::JsVars, []);
-$canView = FreshRSS_Auth::hasAccess() || FreshRSS_Context::systemConf()->allow_anonymous;
+$canView = FreshRSS_Auth::hasAccess() || FreshRSS_Auth::allowAnonymous();
 echo json_encode([
 	'context' => [
 		'anonymous' => !FreshRSS_Auth::hasAccess(),