| Commit message (Collapse) | Author | Age |
|---|
| |
|
|
|
|
|
|
|
|
|
|
|
|
| |
passing the SVG through to the browser
SVG scaling by img directives has subtly changed; where before size=wxh
would preserve aspect ratio, this cannot be done when passing them through
and so specifying both a width and height can change the SVG's aspect
ratio.
(This patch looks significantly more complex than it was, because a large
block of code had to be indented.)
[smcv: drop trailing whitespace, fix some spelling]
|
| |
|
|
|
| |
This mitigates CVE-2016-3714 and similar vulnerabilities by
avoiding passing obviously-wrong input to ImageMagick decoders.
|
| |
|
|
|
|
| |
This mitigates CVE-2016-3714. Wiki administrators who know that they
have prevented arbitrary code execution via other formats can re-enable
the other formats if desired.
|
| |
|
|
|
|
|
|
| |
A site administrator might unwisely set allowed_attachments to
something like '*.jpg or *.png'; if they do, an attacker could attach,
for example, a SVG file named attachment.jpg.
This mitigates CVE-2016-3714.
|
| | |
|
| | |
|
| |
|
|
| |
is not, avoid showing a "Other" box which opens an empty form.
|
| | |
|
| |
|
|
|
|
|
| |
If the relative link from the (page generating the) RSS to the target
would start with "./" or "../", just concatenating it with the URL to
the directory containing the RSS is not sufficient. Go via
URI::new_abs to fix this.
|
| |
|
|
|
|
|
|
| |
Now I'm going to get bug reports about wanting the URLs to be
protocol-relative, but we can't win there as long as we generate RSS,
because RSS doesn't have well-defined semantics for relative URLs
(and the W3C's validator complains about them). If absolute URLs are
a problem for you, please use Atom feeds.
|
| |
|
|
| |
of modules' APIs
|
| |\ |
|
| | | |
|
| | | |
|
| | | |
|
| |\| |
|
| | |
| |
| |
| |
| |
| |
| | |
The old name still works, if its value is numeric.
This name allows a non-numeric "show" to mean the same thing
it does for [[!map]] (show title, show description, etc.).
|
| | | |
|
| | |
| |
| |
| |
| | |
This makes it harder to test, and if we're invoking git anyway,
a couple of extra subprocesses are no big deal.
|
| | |
| |
| |
| |
| |
| |
| | |
in .git/config
This resolves commit errors in versions of git that require a non-trivial
committer identity.
|
| | | |
|
| | | |
|
| | |
| |
| |
| |
| |
| | |
Specifically:
"Unescaped left brace in regex is deprecated, passed through in regex"
|
| | |
| |
| |
| |
| |
| |
| |
| |
| |
| | |
$im->Read() takes a filename-like argument with several sets of special
syntax. Most of the possible metacharacters are escaped by the
default `wiki_file_chars` (and in any case not particularly disruptive),
but the colon ":" is not.
It seems the way to force ImageMagick to treat colons within the
filename as literal is to prepend a colon, so do that.
|
| | | |
|
| | | |
|
| | | |
|
| | |
| |
| |
| | |
reproducibility
|
| | |
| |
| |
| | |
for #786587 in libcgi-pm-perl)
|
| | |
| |
| |
| |
| |
| |
| | |
This avoids nasty surprises on upgrade if a site is using httpauth,
or passwordauth with an account_creation_password, and relying on
only a select group of users being able to edit the site. We can revisit
this for ikiwiki 4.
|
| | | |
|
| | | |
|
| | |
| |
| |
| |
| | |
The wikiname can be pretty un-helpful, the user will probably regognise the
url since they were just at it.
|
| | |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| | |
banned_users
This was needed due to emailauth, but I've also wrapped all IP address
exposure in cloak(), although the function doesn't yet cloak IP addresses.
(One IP address I didn't cloak is the one that appears on the password
reset email template. That is expected to be the user's own IP address,
so ok to show it to them.)
Thanks to smcv for the pointer to
http://xmlns.com/foaf/spec/#term_mbox_sha1sum
|
| | |
| |
| |
| |
| | |
Also prohibit @ in account names, in case the file regexp was relaxed to
allow it.
|
| | |
| |
| |
| |
| |
| | |
There's no real problem if they do change it, except they may get confused
and expect to be able to log in with the changed email and get the same
user account.
|
| | |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| | |
email address
This makes the email not be displayed on the wiki, so spammers won't find
it there.
Note that the full email address is still put into the comment template.
The email is also used as the username of the git commit message
(when posting comments or page edits). May want to revisit this later.
|
| | | |
|
| | | |
|
| | |
| |
| |
| |
| | |
Still some work to do since the user name is an email address and should
not be leaked.
|
| | | |
|
| | | |
|
| | | |
|
| | | |
|
| | |
| |
| |
| | |
Now template variables can be set to control which login methods are shown
|
| | |
| |
| |
| |
| |
| |
| |
| |
| | |
This includes some CSS changes to names of elements.
Also, added Email login button (doesn't work yet of course),
and brought back the small openid login buttons. Demoted yahoo and verison
to small buttons. This makes the big buttons be the main login types, and
the small buttons be provider-specific helpers.
|
| | |
| |
| |
| | |
openid selector display "Password" instead of "Other", so users are more likely to click on it when they don't have an openid.
|
| | |
| |
| |
| |
| |
| |
| |
| |
| |
| | |
[[forum/refresh_and_setup]] indicates some confusion between --setup
and -setup. Both work, but it's clearer if we stick to one in
documentation and code.
A 2012 commit to [[plugins/theme]] claims that "-setup" is required
and "--setup" won't work, but I cannot find any evidence in ikiwiki's
source code that this has ever been the case.
|
| | | |
|
| | | |
|