Freshrss: [Feature Request] Share to Mastodon

[prolibre]

tout est dans le titre :-)

et un grand merci pour votre travail... FreshRSS est une perle !

[Alkarex]

@prolibre Merci. Auriez-vous sous la main la syntaxe du partage avec Mastodon ?

[prolibre]

désolé je reviens tardivement et les mains vides ... non pour l'heure je n'ai rien trouvé pour vous aider :-(

[Epy]

Je crois que tout est décrit dans cette page de doc: https://github.com/tootsuite/documentation/blob/master/Using-the-API/API.md

[aledeg]

I guess it's called a Status on Mastodon. See here.
The main difference between that share and the one we already have is the HTTP action. ATM we only use the GET action but this one requires a POST action.
It's not as easy as it sounds at the first glance.

[Alkarex]

I have not read the spec' yet. Do any of you have an example of cURL request(s) that would do the job?

[aledeg]

Here is something that might help!

[aledeg]

So, I was working on that. I'm almost done but something came in the way. Firefox is blocking the post due to Content Security Policy. Apparently, there is no easy way to overcome that.
If you have any ideas, I would love to hear them.

[Alkarex]

@aledeg Could you give some more details about the problem?

[aledeg]

@Alkarex When I send the post, the message is blocked by the browser because the destination URL is not on the same server. Thus triggering the rules of Content Security Policy.
I don't know if you need more than that.

[Frenzie]

Is the destination URL something controlled by a third-party?

Edit: silly question, of course it is or there would be an easy way around. :-P

[Alkarex]

Maybe the request can be sent server-side, using OAuth https://github.com/tootsuite/documentation/blob/master/Using-the-API/Testing-with-cURL.md

[marienfressinaud]

Asking Mastodon developers to add a GET action for sharing might be easier, don't you think? :p

[aledeg]

@marienfressinaud it could be done for Mastodon alone, but if we want to ask all providers, it would be a mess. For reference, #1513 .

[Alkarex]

If not server side, and if the only problem client side is our own CSP rule, then we could dynamically alter our CSP rule to allow the domains used in our list of shares. I believe this also requires the destination server to have appropriate CORS rules.

[aledeg]

@Alkarex I tried to add my CSP rules but it didn't work (so far). I have to make some readings about it.
We need to find a way to add them dynamically. I haven't look deeply that issue.

Does anyone have ideas on how to apply the CSP rules? Or at least a good documentation about it?

[Alkarex]

https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP
Are you asking about the format, or how it works?
Did you succeed with the POST request when CSP is disabled (i.e. comment-out this line)?
https://github.com/FreshRSS/FreshRSS/blob/3a5427ea7f0269361264ea918db87ccbe501bce8/app/FreshRSS.php#L114

[aledeg]

I had no time yet. I will try again this week-end. Thanks for the documentation!

[aledeg]

It works when the default-src has the value 'self' *.
We need to find a way to inject the share url in that header.

[aledeg]

@prolibre There is a PR available. Could you try it out? THX

[Alkarex]

Merged in the /dev branch. Tests welcome :-)

[lapineige]

How does this work ? What should be used as an instance URL ?
(I'm trying with https://mamot.fr, but the URI of the share link is just /rss/i/POST)

[prolibre]

Salut @lapineige ... idem for me

[Sp3r4z]

Hi
There is a problem, I suppose, on Mastodon Sharing. I try to test that right now, and I always "p/i/POST" on sharing link.
It seems to be a problem with POST HTTP method, POST doesn't look correctly handled.

Is POST method a problem for FreshRSS? How can I do fixing this?

If someone can help me with. Thx

[Alkarex]

@aledeg Could you have a chance to look at this issue?

[aledeg]

I will when I have time. I don't know when though

[Alkarex]

Follow-up in https://github.com/FreshRSS/FreshRSS/issues/1904

[Alkarex]

Fixed in https://github.com/FreshRSS/FreshRSS/pull/1916
Tests welcome