[Bugfix] Improve OPML route security

[kieraneglin]

What's new?

N/A

What's changed?

• Updates the RSS feed and OPML feed copy buttons to be links. This gives all the UX niceties that links provide while still keeping the same copy functionality as before

What's fixed?

• Improves OPML route security by requiring a token to be passed
  • Before, someone could access your OPML file if they knew the public URL for your Pinchflat instance and you had expose_feed_endpoints enabled. Now, a installation-specific unique token is required to access the OPML file in all cases
  • This isn't a perfect solution since an attacker would only need to know your route token to access your OPML file, but I consider this a low-risk issue both in terms of likelihood and potential risk. If you disagree, please also disable expose_feed_endpoints
  • expose_feed_endpoints is still respected and takes precedence over the token - if you haven't exposed your feed endpoints, both the token and HTTP Basic Auth will be required (if present)
  • The token is auto-generated and automatically copied when you copy the OPML feed - no additional user input should be needed as compared to the old approach
  • Resolves [FR] "secure" the OPML Route #532

Any other comments?

N/A

[kieraneglin]

@robertkleinschuster what do you think? There are still some TODOs and I need to refactor/add tests, but this is the rough idea

[kieraneglin]

oops

[robertkleinschuster]

@robertkleinschuster what do you think? There are still some TODOs and I need to refactor/add tests, but this is the rough idea

Yes great, if I was more familiar with the language and framework I would have done it in a similar way. My PR was only meant as a concept prototype anyway.

Thanks for fixing this.