ikiwiki (3.20171002) UNRELEASED; urgency=medium * emailauth: Fix cookie problem when user is on https and the cgiurl uses http, by making the emailed login link use https. * passwordauth: Use https for emailed password reset link when user is on https. * Remove openid provider icons from login selector, since openid providers are increasingly not working. Verisign retired theirs, and aol and yahoo/flickr are not commonly used for openid. Any users who still clicked those icons to login will need to instead enter their openid url. * Updated German basewiki and directives translation from Sebastian Kuhnert. -- Joey Hess Mon, 25 Dec 2017 14:57:27 -0400 ikiwiki (3.20171001) unstable; urgency=medium [ Joey Hess ] * htmlscrubber: Add support for the video tag's loop and muted attributes. Those were not in the original html5 spec, but have been added in the whatwg html living standard and have wide browser support. * emailauth, passwordauth: Avoid leaving cgisess_* files in the system temp directory. [ Simon McVittie ] * core: Don't decode the result of strftime if it is already tagged as UTF-8, as it might be since Perl >= 5.21.1. (Closes: #869240) * img: Strip metadata from resized images when the deterministic config option is set. Thanks, intrigeri * receive: Avoid asprintf() in IkiWiki::Receive, to avoid implicit declaration, potential misbehaviour on 64-bit platforms, and lack of portability to non-GNU platforms * t: Add a regression test for untrusted git push * receive: Fix untrusted git push with git (>= 2.11) by passing through the necessary environment variables to make the quarantine area work * debian: Declare compliance with Debian Policy 4.1.1 [ Amitai Schleier ] * l10n: Fix the build with po4a 0.52, by ensuring that msgstr ends with a newline if and only if msgid does -- Simon McVittie Sun, 01 Oct 2017 16:32:01 +0100 ikiwiki (3.20170622) unstable; urgency=medium * t/git-cgi.t: Wait 1 second before doing a revert that should work. This hopefully fixes a race condition in which the test failed around 6% of the time. (Closes: 862494) * Guard against set-but-empty REMOTE_USER CGI variable on misconfigured nginx servers, and in general treat sessions with a set-but-empty name as if they were not signed in. * When the CGI fails, print the error to stderr, not "Died" * mdwn: Don't mangle