Improve SimplePie redirects (POST to GET, remove authentication cross-origin)

[Inverle]

Follow-up of #76
FreshRSS/FreshRSS#8400

[Alkarex]

Is it correctly understood that passing CURLOPT_FOLLOWLOCATION as a cURL option will allow skipping this new code?
I am interested in keeping an option to let cURL perform the work rather than using our or SimplePie's re-implementation

[Alkarex]

Although we only use the cURL path in FreshRSS, the fsockopen path further below should probably be updated in the same manner

[Inverle]

Is it correctly understood that passing CURLOPT_FOLLOWLOCATION as a cURL option will allow skipping this new code? I am interested in keeping an option to let cURL perform the work rather than using our or SimplePie's re-implementation

Not yet, because CURLOPT_FOLLOWLOCATION is forced to false:

simplepie/src/File.php

Line 525 in 843cc8b

curl_setopt($fp, CURLOPT_FOLLOWLOCATION, false); // FreshRSS

[Alkarex]

I have tried to apply the same logic to the fsockopen path. But not tested. Checks welcome

[Inverle]

I have tried to apply the same logic to the fsockopen path. But not tested. Checks welcome

Testing with a patch like this in FreshRSS, I can confirm the auth headers are removed correctly after a redirect:

diff --git a/app/Models/SimplePieFetch.php b/app/Models/SimplePieFetch.php
index 1a0737b3d..2e41d87d7 100644
--- a/app/Models/SimplePieFetch.php
+++ b/app/Models/SimplePieFetch.php
@@ -31,7 +31,13 @@ final class FreshRSS_SimplePieFetch extends \SimplePie\File
                } elseif ($redirects < 0) {
                        $redirects = -1; // infinite redirects
                }
-               parent::__construct($url, $timeout, $redirects, $headers, $useragent, $force_fsockopen, $curl_options);
+               if (!isset($GLOBALS['fsockopen_test'])) {
+                       $GLOBALS['fsockopen_test'] = 1;
+                       $headers['Cookie'] = 'test=123';
+                       $headers['Authorization'] = 'test';
+                       $headers['X-SomeOtherHeader'] = '123';
+               }
+               parent::__construct($url, $timeout, $redirects, $headers, $useragent, true, $curl_options);
        }
 
        #[\Override]

[Alkarex]

If possible, I would still like a way, for instance by passing a CURLOPT_FOLLOWLOCATION, to use the native cURL handing of redirections