| Commit message (Expand) | Author | Age |
|---|
| * | Make ignoring symlinks configurablegit-annex | Christopher Baines | 2015-02-28 |
| * | fix another unchecked malloc•••<joeyh> any parrticular reason 12?
<igli> well maximum a 32-bit can go is 10 chars
<igli> so one for \0 and round up to 4
| Joey Hess | 2015-01-25 |
| * | Fix NULL ptr deref on ENOMOM in wrapper. (Thanks, igli)•••Probably not exploitable, but who knows..
| Joey Hess | 2015-01-25 |
| * | In VCS-committed anonymous comments, link to url. | Amitai Schlair | 2015-01-08 |
| * | Update blogspam to the 2.0 API. | Amitai Schlair | 2015-01-02 |
| * | po: If msgmerge falls over on a problem po file, print a warning message, but... | Joey Hess | 2014-12-30 |
| * | Avoid uninitialized warnings with comments+no CGI. | Amitai Schlair | 2014-12-28 |
| * | ikiwiki-comment: optionally override parameters. | Amitai Schlair | 2014-12-27 |
| * | Squelch "keys on reference is experimental". | Amitai Schlair | 2014-12-27 |
| * | page.tmpl: tell mobile browsers we have a responsive layout, unless told not to•••Mobile browsers typically assume that arbitrary web pages are
designed for a "desktop-sized" browser window (around 1000px)
and display that layout, zoomed out, in order to avoid breaking
naive designs that assume nobody will ever look at a website on
a phone or something. People who are actually doing "responsive
design" need to opt-in to mobile browsers rendering it at a
more normal size.
| Simon McVittie | 2014-12-01 |
| * | Merge branch 'ready/html5' | Simon McVittie | 2014-11-26 |
| |\ |
|
| | * | Now that we're always using HTML5, <base href> can be relative | Simon McVittie | 2014-10-16 |
| | * | Always produce HTML5 doctype and new attributes, but not new elements•••According to caniuse.com, a significant fraction of Web users are
still using Internet Explorer versions that do not support HTML5
sectioning elements. However, claiming we're XHTML 1.0 Strict
means we can't use features invented in the last 12 years, even if
they degrade gracefully in older browsers (like the role and placeholder
attributes).
This means our output is no longer valid according to any particular
DTD. Real browsers and other non-validator user-agents have never
cared about DTD compliance anyway, so I don't think this is a real loss.
| Simon McVittie | 2014-10-16 |
| * | | Fix numeric comparisons with undef | Simon McVittie | 2014-11-26 |
| * | | fix some typos | Simon McVittie | 2014-11-26 |
| * | | Merge remote-tracking branch 'spalax/calendar-autocreate' | Simon McVittie | 2014-11-26 |
| |\ \ |
|
| | * | | Corrected error: month pages were created even without calendar_autocreate co... | Louis | 2014-11-14 |
| | * | | Deleted unnecessary code | Louis | 2014-11-14 |
| | * | | Indentation | Louis | 2014-11-14 |
| | * | | Calendar pages are now rebuilt when previous or next page have changed | Louis | 2014-07-07 |
| | * | | Making use of the transient plugin | Louis | 2014-07-07 |
| | * | | Added option `calendar_fill_gaps` | Louis | 2014-07-05 |
| | * | | Simplifying code•••Thanks to review from http://ikiwiki.info/todo/calendar_autocreate/
| Louis | 2014-07-05 |
| | * | | calendar plugin: Autocreate archive pages if needed | Louis | 2014-06-24 |
| * | | | openid: Stop suppressing the email field on the Preferences page.•••This is needed for notifyemail, and not all openid providers report an
email address, or necessarily the one the user wants to get email.
| Joey Hess | 2014-11-06 |
| * | | | add ikiwiki-comment program | Joey Hess | 2014-10-20 |
| * | | | Remove space from perl shebang path. | Amitai Schlair | 2014-10-17 |
| * | | | IkiWiki::Plugin::openid: as a precaution, do not call non-coderefs•••We're running under "use strict" here, so if CGI->param's array-context
misbehaviour passes an extra non-ref parameter, it shouldn't be executed
anyway... but it's as well to be safe.
[commit message added by smcv]
| Amitai Schlair | 2014-10-16 |
| * | | | Call CGI->param_fetch instead of CGI->param in array context•••CGI->param has the misfeature that it is context-sensitive, and in
particular can expand to more than one scalar in function calls.
This led to a security vulnerability in Bugzilla, and recent versions
of CGI.pm will warn when it is used in this way.
In the situations where we do want to cope with more than one parameter
of the same name, CGI->param_fetch (which always returns an
array-reference) makes the intention clearer.
[commit message added by smcv]
| Amitai Schlair | 2014-10-16 |
| * | | | Make sure we do not pass multiple CGI parameters in function calls•••When CGI->param is called in list context, such as in function
parameters, it expands to all the potentially multiple values
of the parameter: for instance, if we parse query string a=b&a=c&d=e
and call func($cgi->param('a')), that's equivalent to func('b', 'c').
Most of the functions we're calling do not expect that.
I do not believe this is an exploitable security vulnerability in
ikiwiki, but it was exploitable in Bugzilla.
| Simon McVittie | 2014-10-16 |
| | |/
|/| |
|
| * | | Do not pass ignored sid parameter to checksessionexpiry•••checksessionexpiry's signature changed from
(CGI::Session, CGI->param('sid')) to (CGI, CGI::Session) in commit
985b229b, but editpage still passed the sid as a useless third
parameter, and this was later cargo-culted into remove, rename and
recentchanges.
| Simon McVittie | 2014-10-12 |
| * | | comments: don't log remote IP address for signed-in users•••The intention was that signed-in users (for instance via httpauth,
passwordauth or openid) are already adequately identified, but
there's nothing to indicate who an anonymous commenter is unless
their IP address is recorded.
| Simon McVittie | 2014-10-12 |
| * | | In html5 mode, generate a host- or protocol-relative <base> for the CGI•••This increases the number of situations in which we do the right thing.
| Simon McVittie | 2014-10-05 |
| * | | Add reverse_proxy option which hard-codes cgiurl in CGI output•••This solves several people's issues with the CGI trying to be
too clever when IkiWiki is placed behind a reverse-proxy.
| Simon McVittie | 2014-10-05 |
| * | | Force use of $config{url} as top URL in w3mmode | Simon McVittie | 2014-10-05 |
| * | | Fix crash that can occur when only_committed_changes is set and a file is del...•••srcfile_stat got called on a file from the underlay that no longer existed.
I am not 100% sure of the circumstances of that; I was able to reproduce
the bug but neglected to snapshot the tree, and then accidentially
got it to stop crashing. I know that a transient tag page got deleted using
the web interface to trigger the crash.
It seems that process_changed_files must have returned the file, despite it
being deleted. And since the file was not checked into git, it seems it
must have not been included in @IkiWiki::underlayfiles, which would have
caused process_changed_files to not return it.
I do not know why a transient tag page would not be in
@IkiWiki::underlayfiles. There is a bug here that I don't understand.
This is just a workaround -- run srcfile_stat such that it won't crash,
and if it is unable to stat a file, find_changed knows it's not changed,
so it's ok to skip it.
Also made find_new_files run srcfile_stat such that it won't crash, just
because I was there.
| Joey Hess | 2014-09-26 |
| * | | img: raise an error if we cannot find the image's size•••This happens for PDFs without ghostscript installed, for instance.
| Simon McVittie | 2014-09-16 |
| * | | Merge branch 'ready/templatebody' | Simon McVittie | 2014-09-15 |
| |\ \ |
|
| | * | | Assume that every page has been scanned by the time the scan phase ends•••This doesn't prevent memory from being used to track what we have
and haven't scanned, but it does make it temporary. The existing
%rendered hash, which is filled afterwards, will be larger than %scanned
in practice anyway: %scanned will contain an entry for each page
that changed, plus an entry for each template used by templatebody,
whereas %rendered will contain an entry for each page that changed
plus an entry for each page rendered due to links or dependencies.
| Simon McVittie | 2014-03-05 |
| | * | | Track whether we're in the scan or render phase•••In the scan phase, it's too early to match pagespecs or sort pages;
in the render phase, both of those are OK.
It would be possible to add phases later, renumbering them if necessary
to maintain numerical order.
| Simon McVittie | 2014-03-05 |
| | * | | Add templatebody plugin and directive, and enable it by default•••Also add a regression test for templatebody.
| Simon McVittie | 2014-03-05 |
| | * | | IkiWiki::Render: make 'scan' idempotent•••If it does nothing when a page has already been scanned, we can use it
at any time to force a page to be scanned. In particular, the
templatebody plugin is going to need this.
| Simon McVittie | 2014-03-05 |
| * | | | Merge branch 'ready/autoindex-more-often' | Simon McVittie | 2014-09-15 |
| |\ \ \ |
|
| | * | | | Allow creation of transient index pages for directories outside srcdir•••After this change autoindex creates index pages also for empty directories
included in underlays, but only if it isn't going to commit them to the
srcdir ($config{autoindex_commit} = 0).
Inspired by a patch from Tuomas Jormola.
Bug-Debian: http://bugs.debian.org/611068
| Simon McVittie | 2014-07-04 |
| | * | | | autoindex: remove unnecessary special case for transient underlay•••It's not clear that the transient underlay should be excluded from
indexing; see [[bugs/transient autocreated tagbase is not transient
autoindexed]].
In any case, the code that checks what directories might need indexes
specifically checks for the srcdir anyway, so the only effect this extra
check can have is negative (it could fail to notice files in the
transient underlay and attempt to recreate them unnecessarily).
| Simon McVittie | 2014-07-04 |
| | | |/
| |/| |
|
| * | | | Merge branch 'ready/more-magic' | Simon McVittie | 2014-09-15 |
| |\ \ \ |
|
| | * | | | filecheck: accept MIME types that don't contain ';' | Simon McVittie | 2014-09-10 |
| * | | | | Merge remote-tracking branch 'jcflack/early-env' | Simon McVittie | 2014-09-15 |
| |\ \ \ \ |
|
| | * | | | | More cautious escaping of environment values.•••Tightened the escaping per this review comment:
http://source.ikiwiki.branchable.com/?p=source.git;a=commitdiff;h=f35fc6a603b5473ce2c07bb0236e28e57f718315
(I didn't introduce a $tmp, as $val was local to that block already, and each
hex encoding is in its own C string literal to avoid consuming subsequent
chars that are valid hex digits.)
| Lafayette Chamber Singers Webmaster | 2014-09-14 |
| | * | | | | Installing ikiwiki on a shared-hosting server, there may be no access to•••install prerequisite Perl modules in the systemwide locations. They may
have to be installed under the home directory, such as by using local::lib
(which is how the cPanel Perl-module installer works, on systems that use it).
For that to work, the local::lib-defined value for PERL5LIB must be in
the environment when Perl starts up. The former way %config{ENV} was handled
was too late, depending on the Perl code to unpack it from the storable and
put it into the environment.
Easy solution is to build the wrapper to repopulate the environment based on
%config{ENV} before ever exec'ing Perl (and then remove it from the storable
as there is nothing more that the Perl code will need to do with it).
| Lafayette Chamber Singers Webmaster | 2014-09-14 |
| | |/ / / |
|