feat: add new settings option to allow external fonts

client/model.go

@@ -45,6 +45,7 @@ type User struct {
 	MediaPlaybackRate      float64    `json:"media_playback_rate"`
 	BlockFilterEntryRules  string     `json:"block_filter_entry_rules"`
 	KeepFilterEntryRules   string     `json:"keep_filter_entry_rules"`
+	ExternalFontHosts      string     `json:"external_font_hosts"`
 }
 
 func (u User) String() string {
@@ -88,6 +89,7 @@ type UserModificationRequest struct {
 	MediaPlaybackRate      *float64 `json:"media_playback_rate"`
 	BlockFilterEntryRules  *string  `json:"block_filter_entry_rules"`
 	KeepFilterEntryRules   *string  `json:"keep_filter_entry_rules"`
+	ExternalFontHosts      *string  `json:"external_font_hosts"`
 }
 
 // Users represents a list of users.

internal/api/api_integration_test.go

@@ -592,6 +592,59 @@ func TestUpdateUserEndpointByChangingDefaultTheme(t *testing.T) {
 	}
 }
 
+func TestUpdateUserEndpointByChangingExternalFonts(t *testing.T) {
+	testConfig := newIntegrationTestConfig()
+	if !testConfig.isConfigured() {
+		t.Skip(skipIntegrationTestsMessage)
+	}
+
+	adminClient := miniflux.NewClient(testConfig.testBaseURL, testConfig.testAdminUsername, testConfig.testAdminPassword)
+	regularTestUser, err := adminClient.CreateUser(testConfig.genRandomUsername(), testConfig.testRegularPassword, false)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer adminClient.DeleteUser(regularTestUser.ID)
+
+	regularUserClient := miniflux.NewClient(testConfig.testBaseURL, regularTestUser.Username, testConfig.testRegularPassword)
+
+	userUpdateRequest := &miniflux.UserModificationRequest{
+		ExternalFontHosts: miniflux.SetOptionalField("  fonts.example.org  "),
+	}
+
+	updatedUser, err := regularUserClient.UpdateUser(regularTestUser.ID, userUpdateRequest)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	if updatedUser.ExternalFontHosts != "fonts.example.org" {
+		t.Fatalf(`Invalid external font hosts, got "%v"`, updatedUser.ExternalFontHosts)
+	}
+}
+
+func TestUpdateUserEndpointByChangingExternalFontsWithInvalidValue(t *testing.T) {
+	testConfig := newIntegrationTestConfig()
+	if !testConfig.isConfigured() {
+		t.Skip(skipIntegrationTestsMessage)
+	}
+
+	adminClient := miniflux.NewClient(testConfig.testBaseURL, testConfig.testAdminUsername, testConfig.testAdminPassword)
+	regularTestUser, err := adminClient.CreateUser(testConfig.genRandomUsername(), testConfig.testRegularPassword, false)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer adminClient.DeleteUser(regularTestUser.ID)
+
+	regularUserClient := miniflux.NewClient(testConfig.testBaseURL, regularTestUser.Username, testConfig.testRegularPassword)
+
+	userUpdateRequest := &miniflux.UserModificationRequest{
+		ExternalFontHosts: miniflux.SetOptionalField("'self' *"),
+	}
+
+	if _, err := regularUserClient.UpdateUser(regularTestUser.ID, userUpdateRequest); err == nil {
+		t.Fatal(`Updating the user with an invalid external font host should raise an error`)
+	}
+}
+
 func TestUpdateUserEndpointByChangingCustomJS(t *testing.T) {
 	testConfig := newIntegrationTestConfig()
 	if !testConfig.isConfigured() {

internal/database/migrations.go

@@ -947,4 +947,9 @@ var migrations = []func(tx *sql.Tx) error{
 		_, err = tx.Exec(sql)
 		return err
 	},
+	func(tx *sql.Tx) (err error) {
+		sql := `ALTER TABLE users ADD COLUMN external_font_hosts text not null default '';`
+		_, err = tx.Exec(sql)
+		return err
+	},
 }

internal/locale/translations/de_DE.json

@@ -391,7 +391,7 @@
     "form.prefs.label.gesture_nav": "Geste zum Navigieren zwischen Einträgen",
     "form.prefs.label.show_reading_time": "Geschätzte Lesezeit für Artikel anzeigen",
     "form.prefs.label.custom_css": "Benutzerdefiniertes CSS",
-    "form.prefs.label.custom_js": "Benutzerdefiniertes JS",
+    "form.prefs.label.custom_js": "Benutzerdefiniertes JavaScript",
     "form.prefs.label.entry_order": "Artikel-Sortierspalte",
     "form.prefs.label.default_home_page": "Standard-Startseite",
     "form.prefs.label.categories_sorting_order": "Kategorie-Sortierung",
@@ -403,6 +403,9 @@
     "form.prefs.fieldset.authentication_settings": "Authentifizierungseinstellungen",
     "form.prefs.fieldset.reader_settings": "Reader-Einstellungen",
     "form.prefs.fieldset.global_feed_settings": "Global Feed Settings",
+    "form.prefs.label.external_font_hosts": "Externe Schriftarten-Hosts",
+    "form.prefs.help.external_font_hosts": "Space separated list of external font hosts to allow. For example: \"fonts.gstatic.com fonts.googleapis.com\".",
+    "error.settings_invalid_domain_list": "Invalid domain list. Please provide a space separated list of domains.",
     "form.import.label.file": "OPML Datei",
     "form.import.label.url": "URL",
     "form.integration.betula_activate": "Save entries to Betula",

internal/locale/translations/el_EL.json

@@ -391,7 +391,7 @@
     "form.prefs.label.gesture_nav": "Χειρονομία για πλοήγηση μεταξύ των καταχωρήσεων",
     "form.prefs.label.show_reading_time": "Εμφάνιση εκτιμώμενου χρόνου ανάγνωσης για άρθρα",
     "form.prefs.label.custom_css": "Προσαρμοσμένο CSS",
-    "form.prefs.label.custom_js": "Προσαρμοσμένο JS",
+    "form.prefs.label.custom_js": "Προσαρμοσμένο JavaScript",
     "form.prefs.label.entry_order": "Στήλη ταξινόμησης εισόδου",
     "form.prefs.label.default_home_page": "Προεπιλεγμένη αρχική σελίδα",
     "form.prefs.label.categories_sorting_order": "Ταξινόμηση κατηγοριών",
@@ -403,6 +403,9 @@
     "form.prefs.fieldset.authentication_settings": "Authentication Settings",
     "form.prefs.fieldset.reader_settings": "Reader Settings",
     "form.prefs.fieldset.global_feed_settings": "Global Feed Settings",
+    "form.prefs.label.external_font_hosts": "External font hosts",
+    "form.prefs.help.external_font_hosts": "Space separated list of external font hosts to allow. For example: \"fonts.gstatic.com fonts.googleapis.com\".",
+    "error.settings_invalid_domain_list": "Invalid domain list. Please provide a space separated list of domains.",
     "form.import.label.file": "Αρχείο OPML",
     "form.import.label.url": "URL",
     "form.integration.betula_activate": "Save entries to Betula",

internal/locale/translations/en_US.json

@@ -391,7 +391,7 @@
     "form.prefs.label.gesture_nav": "Gesture to navigate between entries",
     "form.prefs.label.show_reading_time": "Show estimated reading time for entries",
     "form.prefs.label.custom_css": "Custom CSS",
-    "form.prefs.label.custom_js": "Custom JS",
+    "form.prefs.label.custom_js": "Custom JavaScript",
     "form.prefs.label.entry_order": "Entry sorting column",
     "form.prefs.label.default_home_page": "Default home page",
     "form.prefs.label.categories_sorting_order": "Categories sorting",
@@ -403,6 +403,9 @@
     "form.prefs.fieldset.authentication_settings": "Authentication Settings",
     "form.prefs.fieldset.reader_settings": "Reader Settings",
     "form.prefs.fieldset.global_feed_settings": "Global Feed Settings",
+    "form.prefs.label.external_font_hosts": "External font hosts",
+    "form.prefs.help.external_font_hosts": "Space separated list of external font hosts to allow. For example: \"fonts.gstatic.com fonts.googleapis.com\".",
+    "error.settings_invalid_domain_list": "Invalid domain list. Please provide a space separated list of domains.",
     "form.import.label.file": "OPML file",
     "form.import.label.url": "URL",
     "form.integration.betula_activate": "Save entries to Betula",

internal/locale/translations/es_ES.json

@@ -391,7 +391,7 @@
     "form.prefs.label.gesture_nav": "Gesto para navegar entre entradas",
     "form.prefs.label.show_reading_time": "Mostrar el tiempo estimado de lectura de los artículos",
     "form.prefs.label.custom_css": "CSS personalizado",
-    "form.prefs.label.custom_js": "JS personalizado",
+    "form.prefs.label.custom_js": "JavaScript personalizado",
     "form.prefs.label.entry_order": "Columna de clasificación de artículos",
     "form.prefs.label.default_home_page": "Página de inicio por defecto",
     "form.prefs.label.categories_sorting_order": "Clasificación por categorías",
@@ -403,6 +403,9 @@
     "form.prefs.fieldset.authentication_settings": "Ajustes de la autentificación",
     "form.prefs.fieldset.reader_settings": "Ajustes del lector",
     "form.prefs.fieldset.global_feed_settings": "Ajustes globales del feed",
+    "form.prefs.label.external_font_hosts": "External font hosts",
+    "form.prefs.help.external_font_hosts": "Space separated list of external font hosts to allow. For example: \"fonts.gstatic.com fonts.googleapis.com\".",
+    "error.settings_invalid_domain_list": "Invalid domain list. Please provide a space separated list of domains.",
     "form.import.label.file": "Archivo OPML",
     "form.import.label.url": "URL",
     "form.integration.betula_activate": "Guardar artículos en Betula",

internal/locale/translations/fi_FI.json

@@ -391,7 +391,7 @@
     "form.prefs.label.gesture_nav": "Ele siirtyäksesi merkintöjen välillä",
     "form.prefs.label.show_reading_time": "Näytä artikkeleiden arvioitu lukuaika",
     "form.prefs.label.custom_css": "Mukautettu CSS",
-    "form.prefs.label.custom_js": "Mukautettu JS",
+    "form.prefs.label.custom_js": "Mukautettu JavaScript",
     "form.prefs.label.entry_order": "Lajittele sarakkeen mukaan",
     "form.prefs.label.default_home_page": "Oletusarvoinen etusivu",
     "form.prefs.label.categories_sorting_order": "Kategorioiden lajittelu",
@@ -403,6 +403,9 @@
     "form.prefs.fieldset.authentication_settings": "Authentication Settings",
     "form.prefs.fieldset.reader_settings": "Reader Settings",
     "form.prefs.fieldset.global_feed_settings": "Global Feed Settings",
+    "form.prefs.label.external_font_hosts": "External font hosts",
+    "form.prefs.help.external_font_hosts": "Space separated list of external font hosts to allow. For example: \"fonts.gstatic.com fonts.googleapis.com\".",
+    "error.settings_invalid_domain_list": "Invalid domain list. Please provide a space separated list of domains.",
     "form.import.label.file": "OPML-tiedosto",
     "form.import.label.url": "URL",
     "form.integration.betula_activate": "Save entries to Betula",

internal/locale/translations/fr_FR.json

@@ -391,7 +391,7 @@
     "form.prefs.label.gesture_nav": "Geste pour naviguer entre les entrées",
     "form.prefs.label.show_reading_time": "Afficher le temps de lecture estimé des articles",
     "form.prefs.label.custom_css": "Feuille de style personnalisée",
-    "form.prefs.label.custom_js": "Script personnalisée",
+    "form.prefs.label.custom_js": "Code JavaScript personnalisé",
     "form.prefs.label.entry_order": "Colonne de tri des entrées",
     "form.prefs.label.default_home_page": "Page d'accueil par défaut",
     "form.prefs.label.categories_sorting_order": "Colonne de tri des catégories",
@@ -403,6 +403,9 @@
     "form.prefs.fieldset.authentication_settings": "Paramètres d'authentification",
     "form.prefs.fieldset.reader_settings": "Paramètres du lecteur",
     "form.prefs.fieldset.global_feed_settings": "Paramètres globaux des abonnements",
+    "form.prefs.label.external_font_hosts": "Polices externes autorisées",
+    "form.prefs.help.external_font_hosts": "Liste de domaine externes autorisés, séparés par des espaces. Par exemple : « fonts.gstatic.com fonts.googleapis.com ».",
+    "error.settings_invalid_domain_list": "Liste de domaines invalide. Veuillez fournir une liste de domaines séparés par des espaces.",
     "form.import.label.file": "Fichier OPML",
     "form.import.label.url": "URL",
     "form.integration.betula_activate": "Sauvegarder les entrées vers Betula",

internal/locale/translations/hi_IN.json

@@ -403,6 +403,9 @@
     "form.prefs.fieldset.authentication_settings": "Authentication Settings",
     "form.prefs.fieldset.reader_settings": "Reader Settings",
     "form.prefs.fieldset.global_feed_settings": "Global Feed Settings",
+    "form.prefs.label.external_font_hosts": "External font hosts",
+    "form.prefs.help.external_font_hosts": "Space separated list of external font hosts to allow. For example: \"fonts.gstatic.com fonts.googleapis.com\".",
+    "error.settings_invalid_domain_list": "Invalid domain list. Please provide a space separated list of domains.",
     "form.import.label.file": "ओपीएमएल फ़ाइल",
     "form.import.label.url": "यूआरएल",
     "form.integration.betula_activate": "Save entries to Betula",

internal/locale/translations/id_ID.json

@@ -381,7 +381,7 @@
     "form.prefs.label.gesture_nav": "Isyarat untuk menavigasi antar entri",
     "form.prefs.label.show_reading_time": "Tampilkan perkiraan waktu baca untuk artikel",
     "form.prefs.label.custom_css": "Modifikasi CSS",
-    "form.prefs.label.custom_js": "Modifikasi JS",
+    "form.prefs.label.custom_js": "Modifikasi JavaScript",
     "form.prefs.label.entry_order": "Pengurutan Kolom Entri",
     "form.prefs.label.default_home_page": "Beranda Baku",
     "form.prefs.label.categories_sorting_order": "Pengurutan Kategori",
@@ -393,6 +393,9 @@
     "form.prefs.fieldset.authentication_settings": "Authentication Settings",
     "form.prefs.fieldset.reader_settings": "Reader Settings",
     "form.prefs.fieldset.global_feed_settings": "Global Feed Settings",
+    "form.prefs.label.external_font_hosts": "External font hosts",
+    "form.prefs.help.external_font_hosts": "Space separated list of external font hosts to allow. For example: \"fonts.gstatic.com fonts.googleapis.com\".",
+    "error.settings_invalid_domain_list": "Invalid domain list. Please provide a space separated list of domains.",
     "form.import.label.file": "Berkas OPML",
     "form.import.label.url": "URL",
     "form.integration.betula_activate": "Save entries to Betula",

internal/locale/translations/it_IT.json

@@ -391,7 +391,7 @@
     "form.prefs.label.gesture_nav": "Gesto per navigare tra le voci",
     "form.prefs.label.show_reading_time": "Mostra il tempo di lettura stimato per gli articoli",
     "form.prefs.label.custom_css": "CSS personalizzati",
-    "form.prefs.label.custom_js": "JS personalizzati",
+    "form.prefs.label.custom_js": "JavaScript personalizzati",
     "form.prefs.label.entry_order": "Colonna di ordinamento delle voci",
     "form.prefs.label.default_home_page": "Pagina iniziale predefinita",
     "form.prefs.label.categories_sorting_order": "Ordinamento delle categorie",
@@ -403,6 +403,9 @@
     "form.prefs.fieldset.authentication_settings": "Authentication Settings",
     "form.prefs.fieldset.reader_settings": "Reader Settings",
     "form.prefs.fieldset.global_feed_settings": "Global Feed Settings",
+    "form.prefs.label.external_font_hosts": "External font hosts",
+    "form.prefs.help.external_font_hosts": "Space separated list of external font hosts to allow. For example: \"fonts.gstatic.com fonts.googleapis.com\".",
+    "error.settings_invalid_domain_list": "Invalid domain list. Please provide a space separated list of domains.",
     "form.import.label.file": "File OPML",
     "form.import.label.url": "URL",
     "form.integration.betula_activate": "Save entries to Betula",

internal/locale/translations/ja_JP.json

@@ -381,7 +381,7 @@
     "form.prefs.label.gesture_nav": "エントリ間を移動するジェスチャー",
     "form.prefs.label.show_reading_time": "記事の推定読書時間を表示する",
     "form.prefs.label.custom_css": "カスタム CSS",
-    "form.prefs.label.custom_js": "カスタム JS",
+    "form.prefs.label.custom_js": "カスタム JavaScript",
     "form.prefs.label.entry_order": "記事の表示順の基準",
     "form.prefs.label.default_home_page": "デフォルトのトップページ",
     "form.prefs.label.categories_sorting_order": "カテゴリの表示順",
@@ -393,6 +393,9 @@
     "form.prefs.fieldset.authentication_settings": "Authentication Settings",
     "form.prefs.fieldset.reader_settings": "Reader Settings",
     "form.prefs.fieldset.global_feed_settings": "Global Feed Settings",
+    "form.prefs.label.external_font_hosts": "External font hosts",
+    "form.prefs.help.external_font_hosts": "Space separated list of external font hosts to allow. For example: \"fonts.gstatic.com fonts.googleapis.com\".",
+    "error.settings_invalid_domain_list": "Invalid domain list. Please provide a space separated list of domains.",
     "form.import.label.file": "OPML ファイル",
     "form.import.label.url": "URL",
     "form.integration.betula_activate": "Save entries to Betula",

internal/locale/translations/nl_NL.json

@@ -391,7 +391,7 @@
     "form.prefs.label.gesture_nav": "Gebaar om tussen artikelen te navigeren",
     "form.prefs.label.show_reading_time": "Toon geschatte leestijd van artikelen",
     "form.prefs.label.custom_css": "Aangepaste CSS",
-    "form.prefs.label.custom_js": "Aangepaste JS",
+    "form.prefs.label.custom_js": "Aangepaste JavaScript",
     "form.prefs.label.entry_order": "Artikelen sorteren",
     "form.prefs.label.default_home_page": "Startpagina",
     "form.prefs.label.categories_sorting_order": "Volgorde categorieën",
@@ -403,6 +403,9 @@
     "form.prefs.fieldset.authentication_settings": "Authenticatie Instellingen",
     "form.prefs.fieldset.reader_settings": "Lees Instellingen",
     "form.prefs.fieldset.global_feed_settings": "Globale Feed Instellingen",
+    "form.prefs.label.external_font_hosts": "External font hosts",
+    "form.prefs.help.external_font_hosts": "Space separated list of external font hosts to allow. For example: \"fonts.gstatic.com fonts.googleapis.com\".",
+    "error.settings_invalid_domain_list": "Invalid domain list. Please provide a space separated list of domains.",
     "form.import.label.file": "OPML-bestand",
     "form.import.label.url": "URL",
     "form.integration.betula_activate": "Artikelen opslaan in Betula",

internal/locale/translations/pl_PL.json

@@ -401,7 +401,7 @@
     "form.prefs.select.tap": "Podwójne wciśnięcie",
     "form.prefs.select.swipe": "Trzepnąć",
     "form.prefs.label.custom_css": "Niestandardowy CSS",
-    "form.prefs.label.custom_js": "Niestandardowy JS",
+    "form.prefs.label.custom_js": "Niestandardowy JavaScript",
     "form.prefs.label.entry_order": "Kolumna sortowania wpisów",
     "form.prefs.label.default_home_page": "Domyślna strona główna",
     "form.prefs.label.categories_sorting_order": "Sortowanie kategorii",
@@ -413,6 +413,9 @@
     "form.prefs.fieldset.authentication_settings": "Authentication Settings",
     "form.prefs.fieldset.reader_settings": "Reader Settings",
     "form.prefs.fieldset.global_feed_settings": "Global Feed Settings",
+    "form.prefs.label.external_font_hosts": "External font hosts",
+    "form.prefs.help.external_font_hosts": "Space separated list of external font hosts to allow. For example: \"fonts.gstatic.com fonts.googleapis.com\".",
+    "error.settings_invalid_domain_list": "Invalid domain list. Please provide a space separated list of domains.",
     "form.import.label.file": "Plik OPML",
     "form.import.label.url": "URL",
     "form.integration.betula_activate": "Save entries to Betula",

internal/locale/translations/pt_BR.json

@@ -391,7 +391,7 @@
     "form.prefs.label.gesture_nav": "Gesto para navegar entre as entradas",
     "form.prefs.label.show_reading_time": "Mostrar tempo estimado de leitura de artigos",
     "form.prefs.label.custom_css": "CSS customizado",
-    "form.prefs.label.custom_js": "JS customizado",
+    "form.prefs.label.custom_js": "JavaScript customizado",
     "form.prefs.label.entry_order": "Coluna de Ordenação de Entrada",
     "form.prefs.label.default_home_page": "Página inicial predefinida",
     "form.prefs.label.categories_sorting_order": "Classificação das categorias",
@@ -403,6 +403,9 @@
     "form.prefs.fieldset.authentication_settings": "Authentication Settings",
     "form.prefs.fieldset.reader_settings": "Reader Settings",
     "form.prefs.fieldset.global_feed_settings": "Global Feed Settings",
+    "form.prefs.label.external_font_hosts": "External font hosts",
+    "form.prefs.help.external_font_hosts": "Space separated list of external font hosts to allow. For example: \"fonts.gstatic.com fonts.googleapis.com\".",
+    "error.settings_invalid_domain_list": "Invalid domain list. Please provide a space separated list of domains.",
     "form.import.label.file": "Arquivo OPML",
     "form.import.label.url": "URL",
     "form.integration.betula_activate": "Save entries to Betula",