meta referrer origin

[Alkarex]

#955
Tested in Firefox 48, Chrome 53, Edge 25

[Frenzie]

I think this may have broken the ability to update stuff in extensions, unless something went wrong for me while upgrading to 1.5.

Error 403 - Forbidden

You don’t have permission to access this page [HTTP_REFERER=]
← Go back to your RSS feeds

[Frenzie]

Specifically it's this codepath that gets executed:

FreshRSS/app/FreshRSS.php

Lines 58 to 73 in 17c8c03

	private static function initAuth() {
	FreshRSS_Auth::init();
	if (Minz_Request::isPost() && !(is_referer_from_same_domain() && FreshRSS_Auth::isCsrfOk())) {
	// Basic protection against XSRF attacks
	FreshRSS_Auth::removeAccess();
	$http_referer = empty($_SERVER['HTTP_REFERER']) ? '' : $_SERVER['HTTP_REFERER'];
	Minz_Translate::init('en'); //TODO: Better choice of fallback language
	Minz_Error::error(
	403,
	array('error' => array(
	_t('feedback.access.denied'),
	' [HTTP_REFERER=' . htmlspecialchars($http_referer) . ']'
	))
	);
	}
	}

[Alkarex]

Yes indeed. Related issue #1253
I believe the CSRF token is missing for the extensions.