ikiwiki.git
6 years agosign previous
Amitai Schlair [Sun, 19 Oct 2014 17:08:13 +0000 (13:08 -0400)] 
sign previous

6 years agoMatch word boundary (think "/usr/bin/perl5.18").
Amitai Schlair [Sun, 19 Oct 2014 16:59:53 +0000 (12:59 -0400)] 
Match word boundary (think "/usr/bin/perl5.18").

6 years ago(no commit message)
https://www.google.com/accounts/o8/id?id=AItOawlGzzISNi9sKsbbqyRjCZEecyypgaFV56U [Sun, 19 Oct 2014 16:04:48 +0000 (12:04 -0400)] 

6 years ago[patch], patch
https://www.google.com/accounts/o8/id?id=AItOawlGzzISNi9sKsbbqyRjCZEecyypgaFV56U [Sun, 19 Oct 2014 16:04:02 +0000 (12:04 -0400)] 
[patch], patch

6 years agoAdded a comment
openmedi [Fri, 17 Oct 2014 17:23:13 +0000 (13:23 -0400)] 
Added a comment

6 years agoRemove space from perl shebang path.
Amitai Schlair [Fri, 17 Oct 2014 13:05:00 +0000 (09:05 -0400)] 
Remove space from perl shebang path.

6 years agoDisambiguate myself a bit (like that's needed).
Amitai Schlair [Fri, 17 Oct 2014 01:51:18 +0000 (21:51 -0400)] 
Disambiguate myself a bit (like that's needed).

6 years agoreformat
Simon McVittie [Fri, 17 Oct 2014 00:07:50 +0000 (01:07 +0100)] 
reformat

6 years agonews
Simon McVittie [Fri, 17 Oct 2014 00:01:53 +0000 (01:01 +0100)] 
news

6 years agoMerge remote-tracking branch 'refs/remotes/dgit/dgit/sid'
Simon McVittie [Thu, 16 Oct 2014 23:02:33 +0000 (00:02 +0100)] 
Merge remote-tracking branch 'refs/remotes/dgit/dgit/sid'

6 years agorelease
Simon McVittie [Thu, 16 Oct 2014 22:28:35 +0000 (23:28 +0100)] 
release

6 years agodebian: fix some wrong paths in the copyright file
Simon McVittie [Thu, 16 Oct 2014 22:28:23 +0000 (23:28 +0100)] 
debian: fix some wrong paths in the copyright file

6 years agodebian: rename debian/link to debian/links so the intended symlinks appear
Simon McVittie [Thu, 16 Oct 2014 22:04:11 +0000 (23:04 +0100)] 
debian: rename debian/link to debian/links so the intended symlinks appear

6 years agoclose a bug
Simon McVittie [Thu, 16 Oct 2014 22:03:48 +0000 (23:03 +0100)] 
close a bug

6 years agoDrop unused python-support dependency
Simon McVittie [Thu, 16 Oct 2014 21:48:09 +0000 (22:48 +0100)] 
Drop unused python-support dependency

6 years agochangelog so far
Simon McVittie [Thu, 16 Oct 2014 21:44:29 +0000 (22:44 +0100)] 
changelog so far

6 years agobuild-depend on libcgi-pm-perl too, for tests
Simon McVittie [Thu, 16 Oct 2014 21:40:52 +0000 (22:40 +0100)] 
build-depend on libcgi-pm-perl too, for tests

6 years agoExplicitly depend on CGI.pm, which is no longer in Perl core
Simon McVittie [Thu, 16 Oct 2014 08:45:36 +0000 (09:45 +0100)] 
Explicitly depend on CGI.pm, which is no longer in Perl core

I was going to depend on the version that has CGI->param_fetch,
but that has been supported since 2.37, which is older than oldstable.

6 years agoIkiWiki::Plugin::openid: as a precaution, do not call non-coderefs
Amitai Schlair [Wed, 15 Oct 2014 22:52:43 +0000 (23:52 +0100)] 
IkiWiki::Plugin::openid: as a precaution, do not call non-coderefs

We're running under "use strict" here, so if CGI->param's array-context
misbehaviour passes an extra non-ref parameter, it shouldn't be executed
anyway... but it's as well to be safe.

[commit message added by smcv]

6 years agoCall CGI->param_fetch instead of CGI->param in array context
Amitai Schlair [Wed, 15 Oct 2014 21:32:02 +0000 (22:32 +0100)] 
Call CGI->param_fetch instead of CGI->param in array context

CGI->param has the misfeature that it is context-sensitive, and in
particular can expand to more than one scalar in function calls.
This led to a security vulnerability in Bugzilla, and recent versions
of CGI.pm will warn when it is used in this way.

In the situations where we do want to cope with more than one parameter
of the same name, CGI->param_fetch (which always returns an
array-reference) makes the intention clearer.

[commit message added by smcv]

6 years agoMake sure we do not pass multiple CGI parameters in function calls
Simon McVittie [Sat, 11 Oct 2014 08:28:22 +0000 (09:28 +0100)] 
Make sure we do not pass multiple CGI parameters in function calls

When CGI->param is called in list context, such as in function
parameters, it expands to all the potentially multiple values
of the parameter: for instance, if we parse query string a=b&a=c&d=e
and call func($cgi->param('a')), that's equivalent to func('b', 'c').
Most of the functions we're calling do not expect that.

I do not believe this is an exploitable security vulnerability in
ikiwiki, but it was exploitable in Bugzilla.

6 years agoAdded a comment: It was an Apache problem...
https://www.google.com/accounts/o8/id?id=AItOawk8U772S3jDrZJCO0WA5WaDLjJv5mMl6Yw [Thu, 16 Oct 2014 14:57:26 +0000 (10:57 -0400)] 
Added a comment: It was an Apache problem...

6 years agobranch
smcv [Thu, 16 Oct 2014 12:11:52 +0000 (08:11 -0400)] 
branch

6 years agocomment
smcv [Thu, 16 Oct 2014 11:52:05 +0000 (07:52 -0400)] 
comment

6 years agoReplace PayPal and Flattr buttons with text links
Simon McVittie [Wed, 15 Oct 2014 20:56:11 +0000 (21:56 +0100)] 
Replace PayPal and Flattr buttons with text links

In particular, this avoids loading third-party resources from the
offline documentation (see
<https://lintian.debian.org/tags/privacy-breach-donation.html>).

6 years agomention pagespec_alias patches
http://anastigmatix.net/ [Thu, 16 Oct 2014 02:53:41 +0000 (22:53 -0400)] 
mention pagespec_alias patches

6 years agoAdded a comment
smcv [Wed, 15 Oct 2014 23:30:22 +0000 (19:30 -0400)] 
Added a comment

6 years agoAdded a comment
smcv [Wed, 15 Oct 2014 23:26:52 +0000 (19:26 -0400)] 
Added a comment

6 years agoAdded a comment
openmedi [Wed, 15 Oct 2014 18:49:16 +0000 (14:49 -0400)] 
Added a comment

6 years agoAdded a comment
https://www.google.com/accounts/o8/id?id=AItOawlcaGfdn9Kye1Gc8aGb67PDVQW4mKbQD7E [Wed, 15 Oct 2014 13:43:25 +0000 (09:43 -0400)] 
Added a comment

6 years agoAdded a comment
openmedi [Wed, 15 Oct 2014 12:33:40 +0000 (08:33 -0400)] 
Added a comment

6 years ago(no commit message)
https://www.google.com/accounts/o8/id?id=AItOawmbuZI4n1RsTe3Yeaqb5F-yhtR7a8BWEIE [Wed, 15 Oct 2014 04:18:10 +0000 (00:18 -0400)] 

6 years agoas usual, macports hasn't moved
Amitai Schlair [Tue, 14 Oct 2014 22:46:41 +0000 (18:46 -0400)] 
as usual, macports hasn't moved

6 years agoAdded a comment
https://www.google.com/accounts/o8/id?id=AItOawlcaGfdn9Kye1Gc8aGb67PDVQW4mKbQD7E [Tue, 14 Oct 2014 22:41:59 +0000 (18:41 -0400)] 
Added a comment

6 years ago(no commit message)
https://www.google.com/accounts/o8/id?id=AItOawlobQ5j7hQVIGkwMWW3yKB_DWqthJcpnsQ [Tue, 14 Oct 2014 22:31:11 +0000 (18:31 -0400)] 

6 years agoAdded a comment
https://www.google.com/accounts/o8/id?id=AItOawlcaGfdn9Kye1Gc8aGb67PDVQW4mKbQD7E [Tue, 14 Oct 2014 22:25:13 +0000 (18:25 -0400)] 
Added a comment

6 years agoone report suffices; not yet clear there's a bug
Amitai Schlair [Tue, 14 Oct 2014 22:19:09 +0000 (18:19 -0400)] 
one report suffices; not yet clear there's a bug

6 years ago(no commit message)
https://www.google.com/accounts/o8/id?id=AItOawk8U772S3jDrZJCO0WA5WaDLjJv5mMl6Yw [Tue, 14 Oct 2014 13:46:55 +0000 (09:46 -0400)] 

6 years ago(no commit message)
https://www.google.com/accounts/o8/id?id=AItOawk8U772S3jDrZJCO0WA5WaDLjJv5mMl6Yw [Tue, 14 Oct 2014 13:20:24 +0000 (09:20 -0400)] 

6 years agoclarify
Amitai Schlair [Mon, 13 Oct 2014 20:21:15 +0000 (16:21 -0400)] 
clarify

6 years agofindings and questions
Amitai Schlair [Mon, 13 Oct 2014 20:13:11 +0000 (16:13 -0400)] 
findings and questions

6 years agoDo not pass ignored sid parameter to checksessionexpiry
Simon McVittie [Sat, 11 Oct 2014 08:28:02 +0000 (09:28 +0100)] 
Do not pass ignored sid parameter to checksessionexpiry

checksessionexpiry's signature changed from
(CGI::Session, CGI->param('sid')) to (CGI, CGI::Session) in commit
985b229b, but editpage still passed the sid as a useless third
parameter, and this was later cargo-culted into remove, rename and
recentchanges.

6 years agocomments: don't log remote IP address for signed-in users
Simon McVittie [Sun, 12 Oct 2014 17:03:28 +0000 (18:03 +0100)] 
comments: don't log remote IP address for signed-in users

The intention was that signed-in users (for instance via httpauth,
passwordauth or openid) are already adequately identified, but
there's nothing to indicate who an anonymous commenter is unless
their IP address is recorded.

6 years agogoogle search plugin: use https for the search
Simon McVittie [Sun, 12 Oct 2014 16:57:14 +0000 (17:57 +0100)] 
google search plugin: use https for the search

6 years agodefault User-Agent changed
smcv [Sun, 12 Oct 2014 16:49:24 +0000 (12:49 -0400)] 
default User-Agent changed

6 years agoSet default User-Agent to something that doesn't mention libwww-perl
Simon McVittie [Sat, 11 Oct 2014 08:43:34 +0000 (09:43 +0100)] 
Set default User-Agent to something that doesn't mention libwww-perl

It appears that both the open-source and proprietary rulesets for
ModSecurity default to blacklisting requests that say they are
from libwww-perl, presumably because some script kiddies use libwww-perl
and are too inept to set a User-Agent that is "too big to blacklist",
like Chrome or the iPhone browser or something. This seems doomed to
failure but whatever.

6 years agoremoved
smcv [Sun, 12 Oct 2014 16:43:14 +0000 (12:43 -0400)] 
removed

6 years agoAdded a comment
smcv [Sun, 12 Oct 2014 16:42:54 +0000 (12:42 -0400)] 
Added a comment

6 years agohelp Markdown make a list
Amitai Schlair [Sun, 12 Oct 2014 16:42:13 +0000 (12:42 -0400)] 
help Markdown make a list

6 years agoAdded a comment: fixed in a recent release, I think
https://www.google.com/accounts/o8/id?id=AItOawlcaGfdn9Kye1Gc8aGb67PDVQW4mKbQD7E [Sun, 12 Oct 2014 16:40:18 +0000 (12:40 -0400)] 
Added a comment: fixed in a recent release, I think

6 years ago(no commit message)
openmedi [Sun, 12 Oct 2014 16:06:59 +0000 (12:06 -0400)] 

6 years agoReplace shebang paths with the build-time $(PERL).
Amitai Schlair [Sun, 12 Oct 2014 15:08:13 +0000 (11:08 -0400)] 
Replace shebang paths with the build-time $(PERL).

On non-Debian systems, /usr/bin/perl might not be the best available
Perl interpreter. Use whichever perl was used to run Makefile.PL,
unless it was "/usr/bin/perl", in which case there's nothing to do.

6 years agoExtract test subs for each site. No change meant.
Amitai Schlair [Sun, 12 Oct 2014 13:30:31 +0000 (09:30 -0400)] 
Extract test subs for each site. No change meant.

6 years agoExtract run_cgi(). No functional change intended.
Amitai Schlair [Sun, 12 Oct 2014 04:01:09 +0000 (00:01 -0400)] 
Extract run_cgi(). No functional change intended.

6 years agoExtract check_generated_content(). Same output.
Amitai Schlair [Sat, 11 Oct 2014 13:52:21 +0000 (09:52 -0400)] 
Extract check_generated_content(). Same output.

6 years agoExtract check_cgi_mode_bits(). No change intended.
Amitai Schlair [Sat, 11 Oct 2014 01:17:39 +0000 (21:17 -0400)] 
Extract check_cgi_mode_bits(). No change intended.

6 years agoExtract thoroughly_rebuild(), a slight test change.
Amitai Schlair [Sat, 11 Oct 2014 00:40:24 +0000 (20:40 -0400)] 
Extract thoroughly_rebuild(), a slight test change.

I didn't try to parameterize when a test should fail when we can't
remove ikiwiki.cgi because there already isn't one. (Hooray, natural
language.) Instead, we stop worrying about it and always tolerate
ENOENT.

6 years agoExtract write_setup_file(). No functional change.
Amitai Schlair [Sat, 11 Oct 2014 00:25:54 +0000 (20:25 -0400)] 
Extract write_setup_file(). No functional change.

Test output differs only by the line numbers of the TODO items.

6 years ago(no commit message)
https://www.google.com/accounts/o8/id?id=AItOawmbuZI4n1RsTe3Yeaqb5F-yhtR7a8BWEIE [Fri, 10 Oct 2014 03:47:44 +0000 (23:47 -0400)] 

6 years agoclarify further
smcv [Thu, 9 Oct 2014 18:50:00 +0000 (14:50 -0400)] 
clarify further

6 years agoclarify
smcv [Thu, 9 Oct 2014 18:36:13 +0000 (14:36 -0400)] 
clarify

6 years agoThat's not how that directive is used, and if you want to try stuff out please edit...
smcv [Thu, 9 Oct 2014 18:31:33 +0000 (14:31 -0400)] 
That's not how that directive is used, and if you want to try stuff out please edit the sandbox instead

This reverts commit 856819a733d90a2ca259a5a3b03cc5d84f72e931

6 years ago(no commit message)
https://www.google.com/accounts/o8/id?id=AItOawnquaJWYPCmQoY-kgn8wH1Ey7WOCB6zcRY [Thu, 9 Oct 2014 18:10:16 +0000 (14:10 -0400)] 

6 years ago(no commit message)
tarojiro [Wed, 8 Oct 2014 11:38:46 +0000 (07:38 -0400)] 

6 years agoalternative plan
smcv [Mon, 6 Oct 2014 21:00:24 +0000 (17:00 -0400)] 
alternative plan

6 years agosimplify IPC::Run check (same behavior)
Amitai Schlair [Mon, 6 Oct 2014 20:31:52 +0000 (16:31 -0400)] 
simplify IPC::Run check (same behavior)

6 years agoexclude openid/troubleshooting
Amitai Schlair [Mon, 6 Oct 2014 17:06:02 +0000 (13:06 -0400)] 
exclude openid/troubleshooting

6 years ago(no commit message)
smcv [Sun, 5 Oct 2014 22:58:56 +0000 (18:58 -0400)] 

6 years agoAdded a comment
smcv [Sun, 5 Oct 2014 22:56:57 +0000 (18:56 -0400)] 
Added a comment

6 years agoAdded a comment
smcv [Sun, 5 Oct 2014 22:55:02 +0000 (18:55 -0400)] 
Added a comment

6 years agoAdded a comment
smcv [Sun, 5 Oct 2014 22:54:07 +0000 (18:54 -0400)] 
Added a comment

6 years agomore fixes
Simon McVittie [Sun, 5 Oct 2014 22:50:57 +0000 (23:50 +0100)] 
more fixes

6 years agoDocument another fix
Simon McVittie [Sun, 5 Oct 2014 22:49:25 +0000 (23:49 +0100)] 
Document another fix

6 years agoIn html5 mode, generate a host- or protocol-relative <base> for the CGI
Simon McVittie [Sun, 5 Oct 2014 22:49:17 +0000 (23:49 +0100)] 
In html5 mode, generate a host- or protocol-relative <base> for the CGI

This increases the number of situations in which we do the right thing.

6 years agoAdd reverse_proxy option which hard-codes cgiurl in CGI output
Simon McVittie [Sun, 5 Oct 2014 22:06:48 +0000 (23:06 +0100)] 
Add reverse_proxy option which hard-codes cgiurl in CGI output

This solves several people's issues with the CGI trying to be
too clever when IkiWiki is placed behind a reverse-proxy.

6 years agoAvoid mixed content when cgiurl is https but url is not
Simon McVittie [Sun, 5 Oct 2014 21:56:55 +0000 (22:56 +0100)] 
Avoid mixed content when cgiurl is https but url is not

6 years agooffer myself to the ravenous consulting market
Amitai Schlair [Sun, 5 Oct 2014 20:37:55 +0000 (16:37 -0400)] 
offer myself to the ravenous consulting market

6 years agoremaining bugs after fixing some of the easier situations
smcv [Sun, 5 Oct 2014 15:09:27 +0000 (11:09 -0400)] 
remaining bugs after fixing some of the easier situations

6 years agoUse protocol-relative URIs if cgiurl and url differ only by authority (hostname)
Simon McVittie [Sun, 5 Oct 2014 14:56:19 +0000 (15:56 +0100)] 
Use protocol-relative URIs if cgiurl and url differ only by authority (hostname)

6 years agoFix a test-case that actually just repeated the previous one instead
Simon McVittie [Sun, 5 Oct 2014 14:48:13 +0000 (15:48 +0100)] 
Fix a test-case that actually just repeated the previous one instead

6 years agoForce use of $config{url} as top URL in w3mmode
Simon McVittie [Sun, 5 Oct 2014 14:19:55 +0000 (15:19 +0100)] 
Force use of $config{url} as top URL in w3mmode

6 years agorelative URLs test: pass an appropriate PERL5LIB through
Simon McVittie [Sun, 5 Oct 2014 14:19:12 +0000 (15:19 +0100)] 
relative URLs test: pass an appropriate PERL5LIB through

We were previously using the system copy of IkiWiki, because the CGI
resets its environment.

6 years agoAdd WAI-ARIA roles to #main, #comments and #footer when in HTML5 mode
Simon McVittie [Sun, 5 Oct 2014 13:34:10 +0000 (14:34 +0100)] 
Add WAI-ARIA roles to #main, #comments and #footer when in HTML5 mode

Based on a patch from Patrick.

6 years agoadd the beginnings of a test for CGI/static URL interactions
Simon McVittie [Sun, 5 Oct 2014 13:29:32 +0000 (14:29 +0100)] 
add the beginnings of a test for CGI/static URL interactions

6 years agoreview
smcv [Sun, 5 Oct 2014 13:23:30 +0000 (09:23 -0400)] 
review

6 years agonew
smcv [Sun, 5 Oct 2014 13:06:20 +0000 (09:06 -0400)] 
new

6 years agoclarify
smcv [Sun, 5 Oct 2014 12:43:03 +0000 (08:43 -0400)] 
clarify

6 years agomix markdown with HTML more correctly
smcv [Sun, 5 Oct 2014 12:41:16 +0000 (08:41 -0400)] 
mix markdown with HTML more correctly

6 years agonew bug report
smcv [Sun, 5 Oct 2014 12:40:27 +0000 (08:40 -0400)] 
new bug report

6 years agoamend comment
Louis [Sat, 4 Oct 2014 10:45:23 +0000 (12:45 +0200)] 
amend comment

6 years agoAdded a comment: Plugin compile
spalax [Sat, 4 Oct 2014 10:37:19 +0000 (06:37 -0400)] 
Added a comment: Plugin compile

6 years agoNew contrib plugin: compile
Louis [Sat, 4 Oct 2014 10:28:02 +0000 (12:28 +0200)] 
New contrib plugin: compile

6 years agod and r aren't even on the same row
http://anastigmatix.net/ [Sat, 4 Oct 2014 05:03:54 +0000 (01:03 -0400)] 
d and r aren't even on the same row

6 years agoGoogle stay of execution no comfort if you're already dead
http://anastigmatix.net/ [Sat, 4 Oct 2014 05:02:38 +0000 (01:02 -0400)] 
Google stay of execution no comfort if you're already dead

6 years agomany people grok "static site generator" nowadays
Amitai Schlair [Fri, 3 Oct 2014 19:24:43 +0000 (15:24 -0400)] 
many people grok "static site generator" nowadays

6 years agotesting the sandbox
https://www.google.com/accounts/o8/id?id=AItOawmBsHp8c_GstgdRN0W3BXo-ALfwpGRfBfk [Thu, 2 Oct 2014 03:23:22 +0000 (23:23 -0400)] 
testing the sandbox

6 years agorecap of yamlfront issue opened on github
http://anastigmatix.net/ [Thu, 2 Oct 2014 00:45:38 +0000 (20:45 -0400)] 
recap of yamlfront issue opened on github

6 years agoSearch $PATH for "validate", since the test does.
Amitai Schlair [Wed, 1 Oct 2014 19:06:24 +0000 (15:06 -0400)] 
Search $PATH for "validate", since the test does.

"validate" is a very generic command name, and it validates against
an old standard, so the value of this test is questionable.

6 years agoI'm not really anti-vowel
http://anastigmatix.net/ [Tue, 30 Sep 2014 20:18:05 +0000 (16:18 -0400)] 
I'm not really anti-vowel

6 years agoa wish for more from pagetemplate
http://anastigmatix.net/ [Tue, 30 Sep 2014 20:16:31 +0000 (16:16 -0400)] 
a wish for more from pagetemplate