forked from arpitjain11/ikiwiki
-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy pathCHANGELOG
5391 lines (4624 loc) · 255 KB
/
CHANGELOG
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
ikiwiki (3.20200202.4) UNRELEASED; urgency=medium
* aggregate: When a feed has an enclosure that is an image, audio, or
video, include the enclosure in the generated page.
-- Joey Hess <id@joeyh.name> Sat, 25 Dec 2021 12:41:34 -0400
ikiwiki (3.20200202.3) upstream; urgency=medium
[ Amitai Schleier ]
* highlight: Adapt to API change in highlight >= 3.51
* mdwn: Fix inverted footnote configuration when MultiMarkdown is
enabled. Thanks, Giuseppe Bilotta
[ Joey Hess ]
* Updated German basewiki and directives translation from
Sebastian Kuhnert.
* Updated German program translation from
Sebastian Kuhnert.
-- Joey Hess <id@joeyh.name> Sun, 02 Feb 2020 00:00:00 -0400
ikiwiki (3.20190228) upstream; urgency=medium
* aggregate: Use LWPx::ParanoidAgent if available.
Previously blogspam, openid and pinger used this module if available,
but aggregate did not. This prevents server-side request forgery or
local file disclosure, and mitigates denial of service when slow
"tarpit" URLs are accessed.
(CVE-2019-9187)
* blogspam, openid, pinger: Use a HTTP proxy if configured, even if
LWPx::ParanoidAgent is installed.
Previously, only aggregate would obey proxy configuration. If a proxy
is used, the proxy (not ikiwiki) is responsible for preventing attacks
like CVE-2019-9187.
* aggregate, blogspam, openid, pinger: Do not access non-http, non-https
URLs.
Previously, these plugins would have allowed non-HTTP-based requests if
LWPx::ParanoidAgent was not installed. Preventing file URIs avoids local
file disclosure, and preventing other rarely-used URI schemes like
gopher mitigates request forgery attacks.
* aggregate, openid, pinger: Document LWPx::ParanoidAgent as strongly
recommended.
These plugins can request attacker-controlled URLs in some site
configurations.
* blogspam: Document LWPx::ParanoidAgent as desirable.
This plugin doesn't request attacker-controlled URLs, so it's
non-critical here.
* blogspam, openid, pinger: Consistently use cookiejar if configured.
Previously, these plugins would only obey this configuration if
LWPx::ParanoidAgent was not installed, but this appears to have been
unintended.
* po: Always filter .po files.
The po plugin in previous ikiwiki releases made the second and
subsequent filter call per (page, destpage) pair into a no-op,
apparently in an attempt to prevent *recursive* filtering (which as
far as we can tell can't happen anyway), with the undesired effect
of interpreting the raw .po file as page content (e.g. Markdown)
if it was inlined into the same page twice, which is apparently
something that tails.org does. Simplify this by deleting the code
that prevented repeated filtering. Thanks, intrigeri
(Closes: #911356)
-- Simon McVittie <smcv@debian.org> Tue, 26 Feb 2019 21:05:49 +0000
ikiwiki (3.20190207) upstream; urgency=medium
[ Amitai Schleier ]
* graph: Add an optional "file" parameter
* emailauth: When email can't be sent, show the error message
* osm: Don't raise errors if tags don't have attached icons
* cgi: Avoid C compiler warnings for waitpid() on NetBSD
[ Simon McVittie ]
* Hide popup template content from documentation (Closes: #898836)
* meta: Make [[!meta date]] show an error if dates are invalid or
Date::Parse can't be loaded
* inline: Cope with non-ASCII `rootpage` parameter.
Thanks, Feng Shu
* table: Cope with non-ASCII content in CSV format tables.
Thanks, Feng Shu
* trail: Allow unescaped punctuation in `pagenames` parameter
* comments: Hide "add comment" link from print stylesheet.
Thanks, Antoine Beaupré
* recentchangesdiff, relativedate, toggle:
Import JavaScript at the end of the page content, not the beginning,
so that the browser can render content as soon as possible.
Thanks, Antoine Beaupré
* debian: Allow Breezy as an alternative to bzr
Thanks, Jelmer Vernooij
* inline: Add basic test coverage for [[!inline rootpage]]
* table: Add basic test coverage
* po: Add enough test coverage to reproduce Debian #911356
* comments: Improve test coverage
* tests: Exercise Unicode more
[ Joey Hess ]
* aggregate: Fix aggregation of posts without a title.
Thanks, Alexandre Oliva
* poll: Added postlink and posttrail options for better multi-page polls.
* Fix permalink to comments.
-- Simon McVittie <smcv@debian.org> Thu, 07 Feb 2019 11:07:44 +0000
ikiwiki (3.20180311) upstream; urgency=medium
[ Amitai Schleier ]
* Avoid unexpected full paths from find(1)
[ thm.id.fedoraproject.org ]
* rst test: Probe for docutils Python 3 module, not Python 2
[ Simon McVittie ]
* mdwn: Automatically detect which Discount flags to use, fixing
regressions in 3.20180228 when using Discount < 2.2
* Add a test asserting that no plugin is an empty file, to confirm
that the build fixes in 3.20180228 were successful
-- Simon McVittie <smcv@debian.org> Sun, 11 Mar 2018 15:53:34 +0000
ikiwiki (3.20180228) upstream; urgency=medium
* core: Don't send relative redirect URLs when behind a reverse proxy
* core: Escape backticks etc. in directive error messages as HTML
entities so that the error message is not subsequently parsed as
Markdown
* mdwn: Enable fenced code blocks, PHP Markdown Extra-style definition
lists and GitHub-style extensions to HTML tag syntax when used with
Discount >= 2.2.0 (Closes: #888055)
* img: Fix auto-detection of image format (if enabled, which is
strongly discouraged) with ImageMagick >= 6.9.8-3
* rst: Use Python 3 instead of Python 2
* build: `set -e` before each `for` loop, so that errors are reliably
trapped
* build: Use if/then instead of `||` so that the `-e` flag works
* build: Ensure that pm_to_blib finishes before rewriting shebang lines
* t: Make the img test pass with ImageMagick >= 6.9.8-3
(Closes: #891647)
* debian: Remove unused Lintian overrides for duplicate word false positives
* debian: Declare compliance with Debian Policy 4.1.3
-- Simon McVittie <smcv@debian.org> Wed, 28 Feb 2018 10:38:19 +0000
ikiwiki (3.20180105) upstream; urgency=medium
* emailauth: Fix cookie problem when user is on https and the cgiurl
uses http, by making the emailed login link use https.
* passwordauth: Use https for emailed password reset link when user
is on https.
* Remove openid provider icons from login selector, since openid providers
are increasingly not working. Verisign retired theirs, and aol and
yahoo/flickr are not commonly used for openid. Any users who still
clicked those icons to login will need to instead enter their openid url.
* Updated German basewiki and directives translation from
Sebastian Kuhnert.
-- Joey Hess <id@joeyh.name> Fri, 05 Jan 2018 13:41:20 -0400
ikiwiki (3.20171001) upstream; urgency=medium
[ Joey Hess ]
* htmlscrubber: Add support for the video tag's loop and muted
attributes. Those were not in the original html5 spec, but have been
added in the whatwg html living standard and have wide browser support.
* emailauth, passwordauth: Avoid leaving cgisess_* files in the
system temp directory.
[ Simon McVittie ]
* core: Don't decode the result of strftime if it is already tagged as
UTF-8, as it might be since Perl >= 5.21.1. (Closes: #869240)
* img: Strip metadata from resized images when the deterministic config
option is set. Thanks, intrigeri
* receive: Avoid asprintf() in IkiWiki::Receive, to avoid implicit
declaration, potential misbehaviour on 64-bit platforms, and lack
of portability to non-GNU platforms
* t: Add a regression test for untrusted git push
* receive: Fix untrusted git push with git (>= 2.11) by passing through
the necessary environment variables to make the quarantine area work
* debian: Declare compliance with Debian Policy 4.1.1
[ Amitai Schleier ]
* l10n: Fix the build with po4a 0.52, by ensuring that msgstr ends
with a newline if and only if msgid does
-- Simon McVittie <smcv@debian.org> Sun, 01 Oct 2017 16:32:01 +0100
ikiwiki (3.20170622) unstable; urgency=medium
* t/git-cgi.t: Wait 1 second before doing a revert that should work.
This hopefully fixes a race condition in which the test failed
around 6% of the time. (Closes: 862494)
* Guard against set-but-empty REMOTE_USER CGI variable on
misconfigured nginx servers, and in general treat sessions with
a set-but-empty name as if they were not signed in.
* When the CGI fails, print the error to stderr, not "Died"
* mdwn: Don't mangle <style> into <elyts> under some circumstances
* mdwn: Enable footnotes by default when using the default Discount
implementation. A new mdwn_footnotes option can be used to disable
footnotes in MultiMarkdown and Discount.
* mdwn: Don't enable alphabetically labelled ordered lists by
default when using the default Discount implementation. A new
mdwn_alpha_list option can be used to restore the old
interpretation.
* osm: Convert savestate hook into a changes hook. savestate is not
the right place to write wiki content, and in particular this
breaks websetup if osm's dependencies are not installed, even
if the osm plugin is not actually enabled. (Closes: #719913)
* toc: if the heading is of the form <h1 id="...">, use that for
the link in the table of contents (but continue to generate
<a name="index42"></a> in case someone was relying on it).
Thanks, Antoine Beaupré
* color: Do not leak markup into contexts that take only the plain
text, such as toc
* meta: Document [[!meta name="foo" content="bar"]]
* debian: Use preferred https URL for Format of debian/copyright
* debian: Declare compliance with Debian Policy 4.0.0
-- Simon McVittie <smcv@debian.org> Thu, 22 Jun 2017 09:24:57 +0100
ikiwiki (3.20170111) unstable; urgency=high
* passwordauth: prevent authentication bypass via multiple name
parameters (CVE-2017-0356, OVE-20170111-0001)
* passwordauth: avoid userinfo forgery via repeated email parameter
(also in the scope of CVE-2017-0356)
* CGI, attachment, passwordauth: harden against repeated parameters
(not believed to have been a vulnerability)
* remove: make it clearer that repeated page parameter is OK here
* t/passwordauth.t: new automated test for passwordauth
-- Simon McVittie <smcv@debian.org> Wed, 11 Jan 2017 18:16:53 +0000
ikiwiki (3.20170110) unstable; urgency=medium
[ Amitai Schleier ]
* wrappers: Correctly escape quotes in git_wrapper_background_command
[ Simon McVittie ]
* git: use an explicit function parameter for the directory to work
in. Previously, we used global state that was not restored correctly
on catching exceptions, causing an unintended log message
"cannot chdir to .../ikiwiki-temp-working: No such file or directory"
with versions >= 3.20161229 when an attempt to revert a change fails
or is disallowed
* git: don't run "git rev-list ... -- -- ..." which would select the
wrong commits if a file named literally "--" is present in the
repository
* check_canchange: log "bad file name whatever", not literal string
"bad file name %s"
* t/git-cgi.t: fix a race condition that made the test fail
intermittently
* t/git-cgi.t: be more careful to provide a syntactically valid
author/committer name and email, hopefully fixing this test on
ci.debian.net
* templates, comments, passwordauth: use rel=nofollow microformat
for dynamic URLs
* templates: use rel=nofollow microformat for comment authors
* news: use Debian security tracker instead of MITRE for security
references. Thanks, anarcat
* Set package format to 3.0 (native)
* d/copyright: re-order to put more specific stanzas later, to get the
intended interpretation
* d/source/lintian-overrides: override obsolete-url-in-packaging for
OpenID Selector, which does not seem to have any more current URL
(and in any case our version is a fork)
* docwiki.setup: exclude TourBusStop from offline documentation.
It does not make much sense there.
* d/ikiwiki.lintian-overrides: override script-not-executable warnings
* d/ikiwiki.lintian-overrides: silence false positive spelling warning
for Moin Moin
* d/ikiwiki.doc-base: register the documentation with doc-base
* d/control: set libmagickcore-6.q16-3-extra as preferred
build-dependency, with virtual package libmagickcore-extra as an
alternative, to help autopkgtest to do the right thing
-- Simon McVittie <smcv@debian.org> Tue, 10 Jan 2017 13:22:01 +0000
ikiwiki (3.20161229.1) unstable; urgency=medium
* git: Attribute reverts to the user doing the revert, not the wiki
itself.
* git: Do not disable the commit hook while preparing a revert.
-- Simon McVittie <smcv@debian.org> Thu, 29 Dec 2016 20:46:24 +0000
ikiwiki (3.20161229) unstable; urgency=medium
* Security: force CGI::FormBuilder->field to scalar context where
necessary, avoiding unintended function argument injection
analogous to CVE-2014-1572. In ikiwiki this could be used to
forge commit metadata, but thankfully nothing more serious.
(CVE-2016-9646)
* Security: try revert operations in a temporary working tree before
approving them. Previously, automatic rename detection could result in
a revert writing outside the wiki srcdir or altering a file that the
reverting user should not be able to alter, an authorization bypass.
(CVE-2016-10026 represents the original vulnerability.)
The incomplete fix released in 3.20161219 was not effective for git
versions prior to 2.8.0rc0.
(CVE-2016-9645 represents that incomplete solution.)
* Add CVE references for CVE-2016-10026
* Add automated test for using the CGI with git, including
CVE-2016-10026
- Build-depend on libipc-run-perl for better build-time test coverage
* Add missing ikiwiki.setup for the manual test for CVE-2016-10026
* git: don't issue a warning if the rcsinfo CGI parameter is undefined
* git: do not fail to commit changes with a recent git version
and an anonymous committer
-- Simon McVittie <smcv@debian.org> Thu, 29 Dec 2016 17:36:15 +0000
ikiwiki (3.20161219) unstable; urgency=medium
[ Joey Hess ]
* inline: Prevent creating a file named ".mdwn" when the
postform is submitted with an empty title.
[ Simon McVittie ]
* Security: tell `git revert` not to follow renames. If it does, then
renaming a file can result in a revert writing outside the wiki srcdir
or altering a file that the reverting user should not be able to alter,
an authorization bypass. Thanks, intrigeri. (CVE-2016-10026)
* cgitemplate: remove some dead code. Thanks, blipvert
* Restrict CSS matches against header class to not break
Pandoc tables with header rows. Thanks, karsk
* Make pagestats output more deterministic. Thanks, intrigeri
-- Simon McVittie <smcv@debian.org> Mon, 19 Dec 2016 20:34:23 +0000
ikiwiki (3.20160905) unstable; urgency=medium
[ Joey Hess ]
* Fix installation when prefix includes a string metacharacter.
Thanks, Sam Hathaway.
[ Simon McVittie ]
* Use git log --no-renames to generate recentchanges, fixing the git
test-case with git 2.9 (Closes: #835612)
-- Simon McVittie <smcv@debian.org> Mon, 05 Sep 2016 21:26:19 +0100
ikiwiki (3.20160728) unstable; urgency=medium
* Explicitly remove current working directory from Perl's library
search path, mitigating CVE-2016-1238 (see #588017)
* wrappers: allocate new environment dynamically, so we won't overrun
the array if third-party plugins add multiple environment variables.
* Standards-Version: 3.9.8 (no changes required)
-- Simon McVittie <smcv@debian.org> Thu, 28 Jul 2016 10:41:56 +0100
ikiwiki (3.20160509) unstable; urgency=high
[ Amitai Schlair ]
* img: ignore the case of the extension when detecting image format,
fixing the regression that *.JPG etc. would not be displayed
since 3.20160506
[ Simon McVittie ]
* img: parse img_allowed_formats case-insensitively, as was done in
3.20141016.3
* inline: restore backwards compat for show=-1 syntax, which
worked before 3.20160121
* Remove a spurious changelog entry from 3.20160506 (the relevant
change was already in 3.20150614)
* Add CVE-2016-4561 reference to 3.20160506 changelog
* Set high urgency to get the CVE-2016-4561 fix and CVE-2016-3714
mitigation into testing
-- Simon McVittie <smcv@debian.org> Mon, 09 May 2016 21:57:09 +0100
ikiwiki (3.20160506) unstable; urgency=medium
[ Simon McVittie ]
* HTML-escape error messages, in one case avoiding potential cross-site
scripting (CVE-2016-4561, OVE-20160505-0012)
* Mitigate ImageMagick vulnerabilities such as CVE-2016-3714:
- img: force common Web formats to be interpreted according to extension,
so that "allowed_attachments: '*.jpg'" does what one might expect
- img: restrict to JPEG, PNG and GIF images by default, again mitigating
CVE-2016-3714 and similar vulnerabilities
- img: check that the magic number matches what we would expect from
the extension before giving common formats to ImageMagick
* d/control: use https for Homepage
* d/control: add Vcs-Browser
[ Joey Hess ]
* img: Add back support for SVG images, bypassing ImageMagick and
simply passing the SVG through to the browser, which is supported by all
commonly used browsers these days.
SVG scaling by img directives has subtly changed; where before
size=wxh would preserve aspect ratio, this cannot be done when passing
them through and so specifying both a width and height can change
the SVG's aspect ratio.
* loginselector: When only openid and emailauth are enabled, but
passwordauth is not, avoid showing a "Other" box which opens an
empty form.
[ Amitai Schlair ]
* mdwn: Process .md like .mdwn, but disallow web creation.
[ Florian Wagner ]
* git: Correctly handle filenames starting with a dash in add/rm/mv.
-- Simon McVittie <smcv@debian.org> Fri, 06 May 2016 07:54:26 +0100
ikiwiki (3.20160121) unstable; urgency=medium
[ Amitai Schlair ]
* meta: Fix [[!meta name=foo]] by closing the open quote.
* Avoid unescaped "{" in regular expressions
* meta test: Add tests for many behaviors of the directive.
* img test: Bail gracefully when ImageMagick is not present.
[ Joey Hess ]
* emailauth: Added emailauth_sender config.
* Modified page.tmpl to to set html lang= and dir= when
values have been specified for them, which the po plugin does.
* Specifically license the javascript underlay under the permissive
basewiki license.
[ Simon McVittie ]
* git: if no committer identity is known, set it to
"IkiWiki <ikiwiki.info>" in .git/config. This resolves commit errors
in versions of git that require a non-trivial committer identity.
* inline, trail: rename show, feedshow parameters to limit, feedlimit
(with backwards compatibility)
* pagestats: add "show" option to show meta fields. Thanks, Louis
* inline: force RSS <comments> to be a fully absolute URL as required
by the W3C validator. Please use Atom feeds if relative URLs are
desirable on your site.
* inline: add <atom:link rel="self"> to RSS feeds as recommended by
the W3C validator
* inline: do not produce links containing /./ or /../
* syslog: accept and encode UTF-8 messages
* syslog: don't fail to log if the wiki name contains %s
* Change dependencies from transitional package perlmagick
to libimage-magick-perl (Closes: #789221)
* debian/copyright: update for the rename of openid-selector to
login-selector
* d/control: remove leading article from Description
(lintian: description-synopsis-starts-with-article)
* d/control: Standards-Version: 3.9.6, no changes required
* Wrap and sort control files (wrap-and-sort -abst)
* Silence "used only once: possible typo" warnings for variables
that are part of modules' APIs
* Run autopkgtest tests using autodep8 and the pkg-perl team's
infrastructure
* Add enough build-dependencies to run all tests, except for
non-git VCSs
* tests: consistently use done_testing instead of no_plan
* t/img.t: do not spuriously skip
* img test: skip testing PDFs if unsupported
* img test: use the right filenames when testing that deletion occurs
-- Simon McVittie <smcv@debian.org> Thu, 21 Jan 2016 09:53:07 +0000
ikiwiki (3.20150614) unstable; urgency=medium
* inline: change default sort order from age to "age title" for
determinism, partially fixing deterministic build for git-annex,
ikiwiki-hosting etc. (Closes: #785757)
* img: avoid ImageMagick misinterpreting filenames containing a colon
* img test: set old timestamp on source file that will change, so that
the test will pass even if it takes less than 1 second
-- Simon McVittie <smcv@debian.org> Sun, 14 Jun 2015 18:13:23 +0100
ikiwiki (3.20150610) unstable; urgency=low
[ Joey Hess ]
* New emailauth plugin lets users log in, without any registration,
by simply clicking on a link in an email.
* Re-remove google from openid selector; their openid provider is
gone for good.
* Make the openid selector display "Password" instead of "Other"
when appropriate, so users are more likely to click on it when
they don't have an openid.
* Converted openid-selector into a more generic loginselector helper
plugin.
* passwordauth: Don't allow registering accounts that look like openids.
* Make cgiurl output deterministic, not hash order. Closes: #785738
Thanks, Daniel Kahn Gillmor
[ Simon McVittie ]
* Do not enable emailauth by default, to avoid surprises on httpauth-only
sites. Enable it by default in openid instead, since it is essentially
a replacement for OpenIDs.
* Make the attachment plugin work with CGI.pm 4.x (Closes: #786586;
workaround for #786587 in libcgi-pm-perl)
* Add a public-domain email icon from tango-icon-theme
* Populate pagectime from either mtime or inode change time,
whichever is older, again for more reproducible builds
* debian: build the docwiki with LC_ALL=C.UTF-8 and TZ=UTC
* debian/copyright: consolidate permissive licenses
* debian/copyright: turn comments on provenance into Comment
* brokenlinks: sort the pages that link to the missing page, for
better reproducibility
* Add [[!meta date]] to news items and tips, since the git checkout
and build process can leave the checkout date in the tarball
release, leading to unstable sorting
* Sort backlinks deterministically, by falling back to sorting by href
if the link text is identical
* Add a $config{deterministic} option and use it for the docwiki
* haiku: if deterministic build is requested, return a hard-coded haiku
* polygen: if deterministic build is requested, use a well-known random seed
-- Simon McVittie <smcv@debian.org> Wed, 10 Jun 2015 21:56:36 +0100
ikiwiki (3.20150329) experimental; urgency=high
[ Joey Hess ]
* Fix NULL ptr deref on ENOMEM in wrapper. (Thanks, igli)
[ Simon McVittie ]
* Really don't double-decode CGI submissions, even on Perl versions that
bundle an old enough Encode.pm for that not to be a problem: the
system might have a newer Encode.pm installed separately, like Fedora 20.
(Closes: #776181; thanks, Anders Kaseorg)
* If neither timezone nor TZ is set, set both to :/etc/localtime if
we're on a GNU system and that file exists, or GMT otherwise
* t/inline.t: accept translations of "Add a new post titled:"
(Closes: #779365)
* Consistently document command-line options as e.g. --refresh, not -refresh
[ Amitai Schlair ]
* In VCS-committed anonymous comments, link to url.
[ Joey Hess ]
* Fix XSS in openid selector. Thanks, Raghav Bisht. (Closes: #781483)
-- Simon McVittie <smcv@debian.org> Sun, 29 Mar 2015 21:48:24 +0100
ikiwiki (3.20150107) experimental; urgency=medium
[ Joey Hess ]
* Added ikiwiki-comment program.
* Add missing build-depends on libcgi-formbuilder-perl, needed for
t/relativity.t
* openid: Stop suppressing the email field on the Preferences page.
* Set Debian package maintainer to Simon McVittie as I'm retiring from
Debian.
[ Simon McVittie ]
* calendar: add calendar_autocreate option, with which "ikiwiki --refresh"
can mostly supersede the ikiwiki-calendar command.
Thanks, Louis Paternault
* search: add more classes as a hook for CSS. Thanks, sajolida
* core: generate HTML5 by default, but keep avoiding new elements
like <section> that require specific browser support unless html5 is
set to 1.
* Tell mobile browsers to draw our pages in a device-sized viewport,
not an 800-1000px viewport designed to emulate a desktop/laptop browser.
* Add new responsive_layout option which can be set to 0 if your custom
CSS only works in a large viewport.
* style.css, actiontabs, blueview, goldtype, monochrome: adjust layout
below 600px ("responsive layout") so that horizontal scrolling is not
needed on smartphone browsers or other small viewports.
* core: new libdirs option alongside libdir. Thanks, Louis Paternault
[ Amitai Schlair ]
* core: log a debug message before waiting for the lock.
Thanks, Mark Jason Dominus
* build: in po/Makefile, use the same $(MAKE) as the rest of the build.
Thanks, ttw
* blogspam: use the 2.0 JSON API (the 1.0 XML-RPC API has been EOL'd).
Closes: #774441
[ Joey Hess ]
* po: If msgmerge falls over on a problem po file, print a warning
message, but don't let this problem crash ikiwiki entirely.
-- Simon McVittie <smcv@debian.org> Wed, 07 Jan 2015 09:13:58 +0000
ikiwiki (3.20141016) unstable; urgency=medium
[ Joey Hess ]
* Fix crash that can occur when only_committed_changes is set and a
file is deleted from the underlay.
[ Simon McVittie ]
* core: avoid dangerous use of CGI->param in list context, which led
to a security flaw in Bugzilla; as far as we can tell, ikiwiki
is not vulnerable to a similar attack, but it's best to be safe
* core: new reverse_proxy option prevents ikiwiki from trying to detect
how to make self-referential URLs by using the CGI environment variables,
for instance when it's deployed behind a HTTP reverse proxy
(Closes: #745759)
* core: the default User-Agent is now "ikiwiki/$version" to work around
ModSecurity rules assuming that only malware uses libwww-perl
* core: use protocol-relative URLs (e.g. //www.example.com/wiki) so that
https stays on https and http stays on http, particularly if the
html5 option is enabled
* core: avoid mixed content when a https cgiurl links to http static pages
on the same server (the static pages are assumed to be accessible via
https too)
* core: force the correct top URL in w3mmode
* google plugin: Use search form
* docwiki: replace Paypal and Flattr buttons with text links
* comments: don't record the IP address in the wiki if the user is
logged in via passwordauth or httpauth
* templates: add ARIA roles to some page elements, if html5 is enabled.
Thanks, Patrick
* debian: build-depend on libmagickcore-6.q16-2-extra | libmagickcore-extra
so we can thumbnail SVGs in the docwiki
* debian: explicitly depend and build-depend on libcgi-pm-perl
* debian: drop unused python-support dependency
* debian: rename debian/link to debian/links so the intended symlinks appear
* debian: fix some wrong paths in the copyright file
-- Simon McVittie <smcv@debian.org> Thu, 16 Oct 2014 23:28:26 +0100
ikiwiki (3.20140916) unstable; urgency=low
* Don't double-decode CGI submissions with Encode.pm >= 2.53,
fixing "Error: Cannot decode string with wide characters".
Thanks, Antoine Beaupré
* Avoid making trails depend on everything in the wiki by giving them
a better way to sort the pages
* Don't let users post comments that won't be displayed
* Fix encoding of Unicode strings in Python plugins.
Thanks, chrysn
* Improve performance and correctness of the [[!if]] directive
* Let [[!inline rootpage=foo postform=no]] disable the posting form
* Switch default [[!man]] shortcut to manpages.debian.org. Closes: #700322
* Add UUID and TIME variables to edittemplate. Closes: #752827
Thanks, Jonathon Anderson
* Display pages in linkmaps as their pagetitle (no underscore escapes).
Thanks, chrysn
* Fix aspect ratio when scaling small images, and add support for
converting SVG and PDF graphics to PNG.
Thanks, chrysn
- suggest ghostscript (required for PDF-to-PNG thumbnailing)
and libmagickcore-extra (required for SVG-to-PNG thumbnailing)
- build-depend on ghostscript so the test for scalable images can be run
* In the CGI wrapper, incorporate $config{ENV} into the environment
before executing Perl code, so that PERL5LIB can point to a
non-system-wide installation of IkiWiki.
Thanks, Lafayette Chamber Singers Webmaster
* filecheck: accept MIME types not containing ';'
* autoindex: index files in underlays if the resulting pages aren't
going to be committed. Closes: #611068
* Add [[!templatebody]] directive so template pages don't have to be
simultaneously a valid template and valid HTML
* Add myself to Uploaders and release to Debian
-- Simon McVittie <smcv@debian.org> Fri, 12 Sep 2014 21:23:58 +0100
ikiwiki (3.20140831) unstable; urgency=medium
* Make --no-gettime work in initial build. Closes: #755075
-- Joey Hess <joeyh@debian.org> Sun, 31 Aug 2014 14:17:24 -0700
ikiwiki (3.20140815) unstable; urgency=medium
* Add google back to openid selector. Apparently this has gotten a stay
of execution until April 2015. (It may continue to work until 2017.)
* highlight: Add compatibility with highlight 3.18, while still supporting
3.9+. Closes: #757679
Thanks, David Bremner
* highlight: Add support for multiple language definition directories
Closes: #757680
Thanks, David Bremner
-- Joey Hess <joeyh@debian.org> Fri, 15 Aug 2014 12:58:08 -0400
ikiwiki (3.20140613) unstable; urgency=medium
* only_committed_changes could fail in a git repository merged
with git merge -s ours.
* Remove google from openid selector, per http://xkcd.com/1361/
-- Joey Hess <joeyh@debian.org> Fri, 13 Jun 2014 10:09:10 -0400
ikiwiki (3.20140227) unstable; urgency=medium
* Added useragent config setting. Closes: #737121
Thanks, Tuomas Jormola
* po: Add html_lang_code and html_lang_dir template variables
for the language code and direction of text.
Thanks, Mesar Hameed
* Allow up to 8 levels of nested directives, rather than previous 3
in directive infinite loop guard.
* git diffurl: Do not escape / in paths to changed files, in order to
interoperate with cgit (gitweb works either way)
Thanks, intrigeri.
* git: Explicity push master branch, as will be needed by git 2.0's
change to push.default=matching by default.
Thanks, smcv
* Deal with nasty issue with gettext clobbering $@ while printing
error message containing it.
Thanks, smcv
* Cleanup of the openid login widget, including replacing of hotlinked
images from openid providers with embedded, freely licensed artwork.
Thanks, smcv
* Improve templates testing.
Thanks, smcv
* python proxy: Avoid utf-8 related crash.
Thanks, Antoine Beaupré
* Special thanks to Simon McVittie for being the patchmeister for this
release.
-- Joey Hess <joeyh@debian.org> Thu, 27 Feb 2014 11:55:35 -0400
ikiwiki (3.20140125) unstable; urgency=medium
* inline: Allow overriding the title of the feed. Closes: #735123
Thanks, Christophe Rhodes
* osm: Escape name parameter. Closes: #731797
-- Joey Hess <joeyh@debian.org> Sat, 25 Jan 2014 16:40:32 -0400
ikiwiki (3.20140102) unstable; urgency=low
* aggregate: Improve display of post author.
* poll: Fix behavior of poll buttons when inlined.
* Fixed unncessary tight loop hash copy in saveindex where a pointer
can be used instead. Can speed up refreshes by nearly 50% in some
circumstances.
* Optimized loadindex by caching the page name in the index.
* Added only_committed_changes config setting, which speeds up wiki
refresh by querying git to find the files that were changed, rather
than looking at the work tree. Not enabled by default as it can
break some setups where not all files get committed to git.
* comments: Write pending moderation comments to the transient underlay
to avoid conflict with only_committed_changes.
* search: Added google_search option, which makes it search google
rather than using the internal xapain database.
(googlesearch plugin is too hard to turn on when xapain databases
corrupt themselves, which happens all too frequently).
* osm: Remove invalid use of charset on embedded javascript tags.
Closes: #731197
* style.css: Add compatibility definitions for more block-level
html5 elements. Closes: #731199
* aggregrate: Fix several bugs in handling of empty and colliding
titles when generating filenames.
-- Joey Hess <joeyh@debian.org> Thu, 02 Jan 2014 12:22:22 -0400
ikiwiki (3.20130904.1) unstable; urgency=low
* Fix cookiejar default setting.
-- Joey Hess <joeyh@debian.org> Wed, 04 Sep 2013 10:15:37 -0400
ikiwiki (3.20130904) unstable; urgency=low
* calendar: Display the popup mouseover when there is only 1 page for a
given day, for better UI consistency.
* meta: Can now be used to add an enclosure to a page, which is a fancier
way to do podcasting than just inlining the media files directly;
this way you can write a post about the podcast episode with show notes,
author information, etc.
(schmonz)
* aggregate: Show author in addition to feedname, if different.
(schmonz)
* Consistently configure LWP::UserAgent to allow use of http_proxy
and no_proxy environment variables, as well as ~/.ikiwiki/cookies
(schmonz)
* Fix test suite to work with perl 5.18. Closes: #719969
-- Joey Hess <joeyh@debian.org> Wed, 04 Sep 2013 08:54:31 -0400
ikiwiki (3.20130711) unstable; urgency=low
* Deal with git behavior change in 1.7.2 and newer that broke support
for commits with an empty commit message.
* Pass --no-edit when used with git 1.7.8 and newer.
-- Joey Hess <joeyh@debian.org> Wed, 10 Jul 2013 21:49:23 -0400
ikiwiki (3.20130710) unstable; urgency=low
* blogspam: Fix encoding issue in RPC::XML call.
Thanks, Changaco
* comments: The formats allowed to be used in comments can be configured
using comments_allowformats.
Thanks, Michal Sojka
* calendar: When there are multiple pages for a given day, they're
displayed in a popup on mouseover.
Thanks, Louis
* osm: Remove trailing slash from KML maps icon.
* page.tmpl: omit searchform, trails, sidebar and most metadata in CGI
(smcv)
* openid: Automatically upgrade openid_realm to https when
accessed via https.
* The ip() pagespec can now contain glob characters to match eg, a subnet
full of spammers.
* Fix crash that could occur when a needsbuild hook returned a file
that does not exist.
* Fix python proxy to not crash when fed unicode data in getstate
and setstate.
Thanks, chrysn
* Fix committing attachments when using svn.
-- Joey Hess <joeyh@debian.org> Wed, 10 Jul 2013 17:45:40 -0400
ikiwiki (3.20130518) unstable; urgency=low
* Fix test suite to not fail when XML::Twig is not installed.
Closes: #707436
* theme: Now <TMPL_IF THEME_$NAME> can be used in all templates when
a theme is enabled.
* notifyemail: Fix bug that caused duplicate emails to be sent when
site was rebuilt.
* bzr: bzr rm no longer has a --force option, remove
-- Joey Hess <joeyh@debian.org> Sat, 18 May 2013 16:28:21 -0400
ikiwiki (3.20130504) unstable; urgency=low
* Allow dots in directive parameter names. (tango)
* Add missing plugin section, and deal with missing sections with a warning.
* Detect plugins with a broken getsetup and warn.
* map: Correct reversion introduced in version 3.20110225 that could
generate invalid html. (smcv)
* Makefile.PL: overwrite theme style.css instead of appending
(Thanks, Mikko Rapeli)
* meta: Fix anchors used to link to the page's license and copyright.
Closes: #706437
-- Joey Hess <joeyh@debian.org> Sat, 04 May 2013 23:47:21 -0400
ikiwiki (3.20130212) unstable; urgency=low
* htmlscrubber: Allow the bitcoin URI scheme.
* htmlscrubber: Allow the URI schemes of major VCS's.
* aggregate: When run with --aggregate, if an aggregation is already
running, don't go on and --refresh.
* trail: Avoid excess dependencies between pages in the trail
and the page defining the trail. Thanks, smcv.
* opendiscussion: Don't allow editing discussion pages if discussion pages
are disabled. (smcv)
* poll: Add expandable option to allow users to easily add new choices to
a poll.
* trail: Avoid massive slowdown caused by pagetemplate hook when displaying
dynamic cgi pages, which cannot use trail anyway.
* Deal with empty diffurl in configuration.
* cvs: Various fixes. (schmonz)
* highlight: Now adds a span with class highlight-<extension> around
highlighted content, allowing for language-specific css styling.
-- Joey Hess <joeyh@debian.org> Tue, 12 Feb 2013 21:48:02 -0400
ikiwiki (3.20121212) unstable; urgency=low
* filecheck: Fix bug that prevented File::MimeInfo::Magic from ever
being used.
* openid: Display openid in Preferences page as a comment, so it can be
selected in all browsers.
-- Joey Hess <joeyh@debian.org> Tue, 11 Dec 2012 12:12:12 -0400
ikiwiki (3.20121017) unstable; urgency=low
* recentchangesdiff: fix further breakage to the template from 3.20120725
-- Joey Hess <joeyh@debian.org> Tue, 16 Oct 2012 20:49:27 -0400
ikiwiki (3.20121016) unstable; urgency=low
* monochrome: New theme, contributed by Jon Dowland.
* rst: Ported to python 3, while still also being valid python 2.
Thanks, W. Trevor King
* Try to avoid a situation in which so many ikiwiki cgi wrapper programs
are running, all waiting on some long-running thing like a site rebuild,
that it prevents the web server from doing anything else. The current
approach only avoids this problem for GET requests; if multiple cgi's
run GETs on a site at the same time, one will display a "please wait"
page for a configurable number of seconds, which then redirects to retry.
To enable this protection, set cgi_overload_delay to the number of
seconds to wait. This is not enabled by default.
* Add back a 1em margin between archivepage divs.
* recentchangesdiff: Correct broken template that resulted in duplicate
diff icons being displayed, and bloated the recentchanges page with
inline diffs when the configuration should have not allowed them.
-- Joey Hess <joeyh@debian.org> Tue, 16 Oct 2012 15:14:19 -0400
ikiwiki (3.20120725) unstable; urgency=low
* recentchangesdiff: When diffurl is not set, provide inline diffs
in the recentchanges page, with visibility toggleable via javascript.
Thanks, Antoine Beaupré
* Split CFLAGS into words when building wrapper. Closes: #682237
* osm: Avoid calling urlto before generated files are registered.
Thanks, Philippe Gauthier and Antoine Beaupré
* osm: Add osm_openlayers_url configuration setting.
Thanks, Genevieve
* osm: osm_layers can be used to configured the layers displayed on the map.
Thanks, Antoine Beaupré
* comments: Remove ipv6 address specific code.
-- Joey Hess <joeyh@debian.org> Sat, 25 Aug 2012 10:58:42 -0400
ikiwiki (3.20120629) unstable; urgency=low
* mirrorlist: Add mirrorlist_use_cgi setting that avoids usedirs or
other config differences by linking to the mirror's CGI. (intrigeri)
-- Joey Hess <joeyh@debian.org> Fri, 29 Jun 2012 10:16:08 -0400
ikiwiki (3.20120516) unstable; urgency=high
* meta: Security fix; add missing sanitization of author and authorurl.
CVE-2012-0220 Thanks, Raúl Benencia
-- Joey Hess <joeyh@debian.org> Wed, 16 May 2012 19:51:27 -0400
ikiwiki (3.20120419) unstable; urgency=low
* Remove dead link from plugins/teximg. Closes: #664885
* inline: When the pagenames list includes pages that do not exist, skip
them.
* meta: Export author information in html <meta> tag. Closes: #664779
Thanks, Martin Michlmayr
* notifyemail: New plugin, sends email notifications about new and
changed pages, and allows subscribing to comments.
* Added a "changes" hook. Renamed the "change" hook to "rendered", but
the old hook name is called for now for back-compat.
* meta: Support keywords header. Closes: #664780
Thanks, Martin Michlmayr
* passwordauth: Fix url in password recovery email to be absolute.
* httpauth: When it's the only auth method, avoid a pointless and
confusing signin form, and go right to the httpauthurl.
* rename: Allow rename to be started not from the edit page; return to
the renamed page in this case.
* remove: Support removing of pages in the transient underlay. (smcv)
* inline, trail: The pagenames parameter is now a list of absolute
pagenames, not relative wikilink type names. This is necessary to fix
a bug, and makes pagenames more consistent with the pagespec used
in the pages parameter. (smcv)
* link: Fix renaming wikilinks that contain embedded urls.
* graphviz: Handle self-links.
* trail: Improve CSS, also display trail links at bottom of page,
and a bug fix. (smcv)
-- Joey Hess <joeyh@debian.org> Thu, 19 Apr 2012 15:32:07 -0400
ikiwiki (3.20120319) unstable; urgency=low
* osm: New plugin to embed an OpenStreetMap into a wiki page.
Supports waypoints, tags, and can even draw paths matching
wikilinks between pages containing waypoints.
Thanks to Blars Blarson and Antoine Beaupré, as well as the worldwide
OpenStreetMap community for this utter awesomeness.
* trail: New plugin to add navigation trails through pages via Next and
Previous links. Trails can easily be added to existing inlines by setting
trail=yes in the inline.
Thanks to Simon McVittie for his persistance developing this feature.
* Fix a snail mail address. Closes: #659158
* openid-jquery.js: Update URL of Wordpress favicon. Closes: #660549
* Drop the version attribute on the generator tag in Atom feeds
to make builds more reproducible. Closes: #661569 (Paul Wise)
* shortcut: Support Wikipedia's form of url-encoding for unicode
characters, which involves mojibake. Closes: #661198
* Add a few missing jquery UI icons to attachment upload widget underlay.
* URI escape filename when generating the diffurl.
* Add build-affected hook. Used by trail.
-- Joey Hess <joeyh@debian.org> Mon, 19 Mar 2012 14:24:43 -0400
ikiwiki (3.20120202) unstable; urgency=low
* mdwn: Added nodiscount setting, which can be used to avoid using the
markdown discount engine, when maximum compatability is needed.
* Switch to YAML::XS to work around insanity in YAML::Mo. Closes: #657533
* cvs: Ensure text files are added in non-binary mode. (Amitai Schlair)
* cvs: Various cleanups and testing. (Amitai Schlair)
* calendar: Fix strftime encoding bug.
* shortcuts: Fixed a broken shortcut to wikipedia (accidentially
made into a shortcut to wikiMedia).
* Various portability improvements. (Amitai Schlair)
-- Joey Hess <joeyh@debian.org> Thu, 02 Feb 2012 21:42:40 -0400
ikiwiki (3.20120115) unstable; urgency=low
* Make backlink(.) work. Thanks, Giuseppe Bilotta.
* mdwn: Workaround discount's eliding of <style> blocks.
* attachment: Fix utf-8 display bug.
-- Joey Hess <joeyh@debian.org> Sun, 15 Jan 2012 16:19:25 -0400
ikiwiki (3.20120109) unstable; urgency=low
* mdwn: Can use the discount markdown library, via the
Text::Markdown::Discount perl module. This is preferred if available
since it's the fastest currently supported markdown library, speeding up
ikiwiki's markdown rendering by a factor of 40.
(However, when multimarkdown is enabled, Text::Markdown::Multimarkdown
is still used.)
* On Debian, depend on libtext-markdown-discount.
-- Joey Hess <joeyh@debian.org> Mon, 09 Jan 2012 11:49:14 -0400
ikiwiki (3.20111229) unstable; urgency=low
* Consume all stdin when rcs_receive short-circuits,