urosm
/
ikiwiki
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Merge branch 'master' of ssh://git.ikiwiki.info/srv/git/ikiwiki.info

master
Joey Hess 2010-03-13 19:08:24 -05:00
parent a01e0679f4 4da6e94305
commit e96aa16ab9
2 changed files with 22 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
doc/forum/google_openid_broken__63__.mdwn
View File

@ -50,3 +50,11 @@ The openid is
<https://www.google.com/accounts/o8/id?id=AItOawltlTwUCL_Fr1siQn94GV65-XwQH5XSku4>
(what a mouthfull!), and I don't know who that is or how to use it since it
points to a fairly useless xml document, rather than a web page. --[[Joey]]
> That string is what's received via the discovery protocol. The user logging in with a Google account is not supposed to write that when logging in, but rather <https://www.google.com/accounts/o8/id>. The OpenID client library will accept that and redirect the user to a sign in page, which will return that string as the OpenID. It's not really usable as an identifier for edits and whatnots, but an alternative would be to use the attribute exchange extension to get the email address and display that. See <http://code.google.com/apis/accounts/docs/OpenID.html#Parameters>.
> Yahoo's OpenID implementation works alike, but I haven't looked at it as much. It uses <https://me.yahoo.com/> to receive the endpoint.
> I've added buttons that submit the two above URLs for logging in with a Google and Yahoo OpenID, respectively, to my locally changed OpenID login plugin.
> Using the Google profile page as the OpenID is really orthogonal to the above. --[[kaol]]

15
doc/todo/finer_control_over___60__object___47____62__s.mdwn
View File

@ -57,10 +57,23 @@ For Ikiwiki, it may be nice to be able to restrict [URI's][URI] (as required by
>> `usemap`) should make `object` almost as harmless as, say, `img`.
>>> But with local data, one could not embed youtube videos, which surely
>>> is the most obvious use case? Note that youtube embedding uses an
>>> is the most obvious use case?
>>>> Allowing a &ldquo;remote&rdquo; object to render on one's page is a
security issue by itself.
Though, of course, having an explicit whitelist of URI's may make
this issue more tolerable.
&mdash;&nbsp;[[Ivan_Shmakov]], 2010-03-12Z.
>>> Note that youtube embedding uses an
>>> object element with no classid. The swf file is provided via an
>>> enclosed param element. --[[Joey]]
>>>> I've just checked a random video on YouTube and I see that the
`.swf` file is provided via an enclosed `embed` element. Whether
to allow those or not is a different issue.
&mdash;&nbsp;[[Ivan_Shmakov]], 2010-03-12Z.
>> (Though it certainly won't solve the [[SVG_problem|/todo/SVG]] being
>> restricted in such a way.)