⚰ _skip_self_url_path_checks

this setting, originally intended for debugging and/or development, is being blatantly misused by people who try to use it as a crutch instead of learning how to fix their malfunctioning frontend, creating hard to diagnose issues as a result.

it’s especially bad now that SELF_URL_PATH is used to open things in browser windows on the frontend, you could have set it to a wrong value previously and never really notice.

my plan is to remove it from trunk soon™ (maybe next week?) unless i see a bunch of really convincing arguments to the contrary.

FAQ

i’m too lazy to figure out how to pass HTTP host and/or protocol to tt-rss

this is not a convincing argument.

because going the other way around while rewriting relative urls would allow attackers access to tt-rss context via the feed which would be really, really bad.

so we’ll need to check if its actually local kind of maybe safe relative urls and perform some kind of special handling for those. imagine all the inevitable exploits that would follow.

i’m not going to comment on the kind of setup you’ve described other than it only made me more convinced that this hack should be removed.

also,

:face_with_raised_eyebrow:

e: around here these kinds of “solutions” are called (roughly translated) rectal tonsilectomy.

https://git.tt-rss.org/fox/tt-rss/commit/50087df16291af5b74e9fb78d497850730814c82

this is now officially removed from master.