Commit Graph

3282 Commits (8f2bb4a971bf9ce9d8bb57a28c0fd3025f12dc05)

Author SHA1 Message Date
Simon McVittie 7aca0d40a3 Compose relative URLs in RSS feeds correctly
If the relative link from the (page generating the) RSS to the target
would start with "./" or "../", just concatenating it with the URL to
the directory containing the RSS is not sufficient. Go via
URI::new_abs to fix this.
2016-01-21 08:40:14 +00:00
Simon McVittie 855b757f37 Force comments URL in RSS feeds to be absolute
Now I'm going to get bug reports about wanting the URLs to be
protocol-relative, but we can't win there as long as we generate RSS,
because RSS doesn't have well-defined semantics for relative URLs
(and the W3C's validator complains about them). If absolute URLs are
a problem for you, please use Atom feeds.
2016-01-21 07:50:13 +00:00
Simon McVittie 317d19842c Silence "used only once: possible typo" warnings for variables that are part of modules' APIs 2016-01-19 11:24:18 +00:00
Simon McVittie 72c3b81efb Merge remote-tracking branch 'smcv/pagestats-show' 2015-11-30 20:58:54 +00:00
Simon McVittie b199349ffd Merge remote-tracking branch 'smcv/ready/limit' 2015-11-30 20:55:34 +00:00
Simon McVittie 1f635c6dca ensure_committer: don't do anything if we have the environment variables 2015-11-30 20:46:58 +00:00
Simon McVittie 8550c39701 Don't memoize ensure_committer
This makes it harder to test, and if we're invoking git anyway,
a couple of extra subprocesses are no big deal.
2015-11-30 20:46:58 +00:00
Simon McVittie ed1e1ebe70 git: if no committer identity is known, set it to "IkiWiki <ikiwiki.info>" in .git/config
This resolves commit errors in versions of git that require a non-trivial
committer identity.
2015-11-30 19:34:04 +00:00
Joey Hess 32923e732b emailauth: Added emailauth_sender config. 2015-10-02 11:49:47 -04:00
Amitai Schlair 09916a90ed Fix [[!meta name=foo]] by closing the open quote. 2015-08-22 22:34:53 -04:00
Amitai Schlair 604d0391ba Squelch regex deprecation warnings from Perl 5.22.
Specifically:

"Unescaped left brace in regex is deprecated, passed through in regex"
2015-06-14 21:35:51 -04:00
Simon McVittie 7a2117bf8c img: stop ImageMagick trying to be clever if filenames contain a colon
$im->Read() takes a filename-like argument with several sets of special
syntax. Most of the possible metacharacters are escaped by the
default `wiki_file_chars` (and in any case not particularly disruptive),
but the colon ":" is not.

It seems the way to force ImageMagick to treat colons within the
filename as literal is to prepend a colon, so do that.
2015-06-13 20:00:08 +01:00
Simon McVittie f2365c3e66 inline: change default sort order from age to "age title" for determinism 2015-06-13 19:58:37 +01:00
Simon McVittie 014b9eb1b7 polygen: if deterministic build is requested, use a well-known random seed 2015-06-09 22:30:44 +01:00
Simon McVittie 361076e55d haiku: if deterministic build is requested, return a hard-coded haiku 2015-06-09 22:30:43 +01:00
Simon McVittie 6add4fd4fc Sort backlinks deterministically, by falling back to sorting by href if the link text is identical 2015-06-09 22:30:43 +01:00
Simon McVittie 8e007666d4 brokenlinks: sort the pages that link to the missing page, for better reproducibility 2015-06-09 22:28:31 +01:00
Simon McVittie 2fe003dac4 Populate pagectime from mtime or inode change time, whichever is older
When building ikiwiki from a tarball, the mtime (conceptually, the
last modification date of the file) is preserved by tar, but the inode
change time (creation/metadata-change date of *this copy* of the file)
is not. This seems to lead to unstable sort ordering and
unreproducible builds.

The page can't possibly have been modified before it was created, so
we can assume that the modification date is an upper bound for the
creation date.
2015-06-09 22:22:54 +01:00
Simon McVittie f00ccd0bf6 In rebuilds, assume that every page has been scanned by the time the scan phase ends
This doesn't prevent memory from being used to track what we have
and haven't scanned, but it does make it temporary.

This only applies to rebuilds, as a way to avoid breaking the
templatebody plugin, unlike the earlier version of this optimization.
2015-06-09 00:14:57 +01:00
Simon McVittie 5fd863b5b0 Revert "Assume that every page has been scanned by the time the scan phase ends"
This reverts commit c04a26f3e7, which
turns out to break the templatebody directive: readtemplate() relies
on scan() populating %templates, but if scan() is a no-op after
leaving the scan phase, we can't rely on that.

The assumption made by skipping scan() after the end of the render phase
is that everything that comes from a scan is already in the index.
However, we don't really want to put template bodies in the index:
that would force us to load and save them on every refresh, and
redundantly persist them to disk.

Test-case:

% make clean
% ./Makefile.PL
% make
% grep -E '<div class="notebox">|Use this template to' html/sandbox.html
% touch doc/sandbox/New_blog_entry.mdwn          # sandbox inlines this
% make
% grep -E '<div class="notebox">|Use this template to' html/sandbox.html

Good result: html/sandbox.html contains <div class="notebox"> both times

Bad result: html/sandbox.html contains "Use this template to..." the
second time
2015-06-08 23:47:14 +01:00
Simon McVittie 7a52c87a8c Make the attachment plugin work with CGI.pm 4.x (Closes: #786586; workaround for #786587 in libcgi-pm-perl) 2015-06-07 14:51:13 +01:00
Simon McVittie 2afb0dd663 Do not directly enable emailauth by default, only indirectly via openid
This avoids nasty surprises on upgrade if a site is using httpauth,
or passwordauth with an account_creation_password, and relying on
only a select group of users being able to edit the site. We can revisit
this for ikiwiki 4.
2015-05-27 08:52:01 +01:00
Joey Hess 3676ab329d sohrten url in subject 2015-05-19 17:44:20 -04:00
Joey Hess ba02e7f33d nicer layout of subject 2015-05-19 17:41:14 -04:00
Joey Hess 73e32f7fa6 add url to subject of email
The wikiname can be pretty un-helpful, the user will probably regognise the
url since they were just at it.
2015-05-19 17:38:15 -04:00
Joey Hess ab1bba9dab cloak user PII when making commits etc, and let cloaked PII be used in banned_users
This was needed due to emailauth, but I've also wrapped all IP address
exposure in cloak(), although the function doesn't yet cloak IP addresses.

(One IP address I didn't cloak is the one that appears on the password
reset email template. That is expected to be the user's own IP address,
so ok to show it to them.)

Thanks to smcv for the pointer to
http://xmlns.com/foaf/spec/#term_mbox_sha1sum
2015-05-14 11:58:21 -04:00
Joey Hess 85a529db3d passwordauth: Don't allow registering accounts that look like openids.
Also prohibit @ in account names, in case the file regexp was relaxed to
allow it.
2015-05-14 10:57:56 -04:00
Joey Hess 70cf5bb765 don't let emailauth user's email address be changed on preferences page
There's no real problem if they do change it, except they may get confused
and expect to be able to log in with the changed email and get the same
user account.
2015-05-13 23:32:29 -04:00
Joey Hess 7a68c4a01c when an emailauth user posts a comment, use the username only, not the full email address
This makes the email not be displayed on the wiki, so spammers won't find
it there.

Note that the full email address is still put into the comment template.
The email is also used as the username of the git commit message
(when posting comments or page edits). May want to revisit this later.
2015-05-13 23:26:22 -04:00
Joey Hess 497513e737 avoid showing password prefs for emailauth user 2015-05-13 23:24:07 -04:00
Joey Hess 22339188e7 allow adminuser to be an email address 2015-05-13 23:07:29 -04:00
Joey Hess a7bd24b7b9 fix up session cookie 2015-05-13 23:06:52 -04:00
Joey Hess 95e1e51caa emailauth link sent and verified; user login works
Still some work to do since the user name is an email address and should
not be leaked.
2015-05-13 22:27:03 -04:00
Joey Hess 035c1a2449 move stub auth hook to loginselector 2015-05-13 18:54:13 -04:00
Joey Hess e34533d1a0 email auth plugin now works through email address entry 2015-05-13 18:50:40 -04:00
Joey Hess 5b459737a5 Converted openid-selector into a more generic loginselector helper plugin. 2015-05-13 18:50:29 -04:00
Joey Hess f8add0adb3 rename openid selector files to login-selector 2015-05-13 17:58:59 -04:00
Joey Hess 7765941011 further generalization of openid selector
Now template variables can be set to control which login methods are shown
2015-05-13 17:51:29 -04:00
Joey Hess ab4d9a5467 generalized the openid selector to a login selector
This includes some CSS changes to names of elements.

Also, added Email login button (doesn't work yet of course),
and brought back the small openid login buttons. Demoted yahoo and verison
to small buttons. This makes the big buttons be the main login types, and
the small buttons be provider-specific helpers.
2015-05-13 16:50:44 -04:00
Joey Hess ec72b4c95b When openid and passwordauth are the only enabled auth plugins, make the openid selector display "Password" instead of "Other", so users are more likely to click on it when they don't have an openid. 2015-05-13 12:18:22 -04:00
Simon McVittie a1fda0b516 Standardize on --long-option instead of -long-option
[[forum/refresh_and_setup]] indicates some confusion between --setup
and -setup. Both work, but it's clearer if we stick to one in
documentation and code.

A 2012 commit to [[plugins/theme]] claims that "-setup" is required
and "--setup" won't work, but I cannot find any evidence in ikiwiki's
source code that this has ever been the case.
2015-03-01 16:15:01 +00:00
Anders Kaseorg f35c6a97d1 Fix double UTF-8 decode on Perl < 5.20 with upgraded Encode.pm
Commit feb21ebfac added a
safe_decode_utf8 function that avoids double decoding on Perl 5.20.
But the Perl behavior change actually happened in Encode.pm 2.53
(https://github.com/dankogai/p5-encode/pull/11).  Although Perl 5.20
is the first Perl version to bundle an affected version of Encode.pm,
it’s also possible to upgrade Encode.pm independently; for example,
Fedora 20 has Perl 5.18.4 with Encode.pm 2.54.  On such a system,
editing a non-ASCII file still fails with errors like

Error: Cannot decode string with wide characters at
/usr/lib64/perl5/vendor_perl/Encode.pm line 216.

There doesn’t seem to be any reason not to check Encode::is_utf8 on
old versions too, so just remove the version check altogether.

Signed-off-by: Anders Kaseorg <andersk@mit.edu>
Bug-Debian: https://bugs.debian.org/776181
2015-03-01 12:43:20 +00:00
Joey Hess 6a46c2cf55 fix another unchecked malloc
<joeyh> any parrticular reason 12?
<igli> well maximum a 32-bit can go is 10 chars
<igli> so one for \0 and round up to 4
2015-01-25 00:10:34 -04:00
Joey Hess fe0eaf1870 Fix NULL ptr deref on ENOMOM in wrapper. (Thanks, igli)
Probably not exploitable, but who knows..
2015-01-25 00:00:40 -04:00
Amitai Schlair 3a19663d48 In VCS-committed anonymous comments, link to url. 2015-01-08 08:11:40 -05:00
Amitai Schlair 0451dc4133 Update blogspam to the 2.0 API. 2015-01-02 13:55:10 -05:00
Joey Hess f88e109bec po: If msgmerge falls over on a problem po file, print a warning message, but don't let this problem crash ikiwiki entirely. 2014-12-30 15:51:50 -04:00
Amitai Schlair a87f43d71e Avoid uninitialized warnings with comments+no CGI. 2014-12-28 13:15:45 -05:00
Amitai Schlair 38a088a433 ikiwiki-comment: optionally override parameters. 2014-12-27 22:38:18 -05:00
Amitai Schlair b87e46a76d Squelch "keys on reference is experimental". 2014-12-27 16:55:12 -05:00