Support plain text and block external resources

[735trv]

Oops, I have already created an issue (#1653) before posting here to discuss.. Sorry.

It would be good if it's possible to block the download of external resources completely, so that images (or tracking pixels) are not loaded and only text is available.

I'm using a strict CSP to do this, but the Android/iOS apps are still downloading these resources.

[Grotax]

Hey, I think we need to split this thought into two sections.

The news app itself on the server only downloads favicons and feed logos.
The sever is exposed anyway though as it fetches the feed.

The favicon or feed logo is however not stored on the server (only a temporary check) and it's not delivered to the clients. The client gets the url to the favicon/logo.

The front-end of the news app displays pictures and so on depending on how they were embedded into the feed.
Here of course the client IP is leaked as your browser requests the object directly from the source same for the logo/favicon.
Development on the front-end is unfortunately basically dead and so far nobody had the capacity to rebuild it.

For the android app and probably all clients it's the same I assume, although I don't know all clients.

In the android app you have a privacy mode that can be activated to stop downloading external recourses, I think this solves your issue already.

Hosting media content directly on the server would be an option of course but also quite some work to implement. Storage management, feeds are currently not shared each user has his own feed and so on.

[735trv]

Development on the front-end is unfortunately basically dead and so far nobody had the capacity to rebuild it.

Thank you for the explanation. I like the frontend. Simple and easy. 😊

In the android app you have a privacy mode that can be activated to stop downloading external recourses, I think this solves your issue already.

Okay, I did not know this option. Thanks for the hint. 👍

Hosting media content directly on the server would be an option

I think that would be too much. A single option in the settings that changes the behavior of the parser should be fine. Filtering by the html tags (img, iframe, video,..) might be difficult if fulltext is enabled.

[Grotax]

I think the webclient would probably also benefit from a privacy mode, in which it does not automatically fetch external resources.

But as said before that it would need to be rebuild on a more modern web framework.

[Grotax]

Thanks for the input 😊

[v2loxb]

As a workaround I use a few triggers written on the database. Sometimes a few feeds are ugly, but fine as a temporary solution:

CREATE TRIGGER `rss_before_insert_iframe` BEFORE INSERT ON `oc_news_items`
 FOR EACH ROW BEGIN
    SET NEW.body = REGEXP_REPLACE(NEW.body, '<iframe.*iframe>', '');
END

CREATE TRIGGER `rss_before_update_iframe` BEFORE UPDATE ON `oc_news_items`
 FOR EACH ROW BEGIN
    SET NEW.body = REGEXP_REPLACE(NEW.body, '<iframe.*iframe>', '');
END

CREATE TRIGGER `rss_before_insert_img` BEFORE INSERT ON `oc_news_items`
 FOR EACH ROW BEGIN
    SET NEW.body = REGEXP_REPLACE(NEW.body, '<img.*[/]?[^pa>]>', '');
END

CREATE TRIGGER `rss_before_update_img` BEFORE UPDATE ON `oc_news_items`
 FOR EACH ROW BEGIN
    SET NEW.body = REGEXP_REPLACE(NEW.body, '<img.*[/]?[^pa>]>', '');
END