Not much to say about this, just a handful of performance tweaks and bug fixes:
Today I released v0.5.14 of Publ, which has a bunch of improvements:
Progress being made, although not much of it has been in service of my intended v0.6 milestone. At some point I’m going to have to bite the bullet and actually start writing some automated tests.
Release notes:
smartquotes/no_smartquotes API change to entry.titleentry.authAlso, as of now, I run a live version of the Publ integration tests, although it’s currently only manually-updated.
Update: And as if to hammer home the point regarding automated testing, I had to release 0.5.13.1 because, wellp, released with a site-breaking bug in the new card parser… Sigh.
Today I got a fire lit under me and decided to do a bunch of bug fixing and general performance improvements.
Changes since v0.5.11:
markup=False works, making it available from all Markdown/HTML contextsno_smartquotes=True to smartquotes=False (no_smartquotes is retained for template compatibility) (although I missed this on entry.title; I’ve already committed a fix for the next version)Some fresh new versions of things.
Changes to Publ:
category.subcatsconfig.secret_key; now this should be configured on the application object per Flask standardshref and src to contain image renditionsPubl v0.5.10 is now available. The following has changed since v0.5.9:
entry.more (with some caveats), and also get stable permalinks for their references1$ to force it to resolve as an asset (useful for certain JavaScript libraries); see the relevant documentationI’ve also made a bunch of changes to the sample templates.
Publ v0.5.9 is now out. Just a couple of bugfixes in this one:
view.range works correctly again, as does everything else that relied on len() on parameter-optional properties (e.g. view.count)So, both Publ and Authl had a pretty naïve issue with the identity verification step of the IndieAuth flow; it simply accepted whatever the authorization endpoint said the user’s identity was. This made it very simple to spoof one’s identity and log in as anyone on any Publ or Authl site.
Authl 0.3.1 fixes the problem with the IndieAuth login flow, and Publ 0.5.8 fixes the problem with the Bearer token flow.
There is only one feature for this new release of Publ, but it’s a big one – there is (theoretical) support for AutoAuth! That’s right, deploy this version and people should be able to magically log on to your website using unattended IndieAuth providers.
Unfortunately, there aren’t any tools that I know of which actually support this mode of operation; all testing has been manual and In Theory.
Fortunately, if someone does want to test AutoAuth (or IndieAuth Bearer authentication in general), you can test it out on this site! You can use this entry as an individual entry, and this category or this feed to see how well it works with the “partial public” path.
Also, this page will tell you all sorts of useful information about the current user (if any).
And I’d might as well use this opportunity to show off the admin dashboard – just sign in as the user test:admin to see how it looks.
EDIT: It looks like there’s a problem with third-party auth due to the way that Heroku works. I should have anticipated this. Third-party auth is temporarily disabled for now. (But this doesn’t affect AutoAuth at least!)
Oops, I’d been sitting on a bunch of bugfixes for a month, which I didn’t notice until I put in another bugfix tonight.
Changes since v0.5.5:
link_class to image renditionsalt generation for external imagesHowdy y'all! Here’s a new release of Publ for you.
What’s new in this version:
Also the unannounced v0.5.4 release was to fix some stuff that broke due to an upstream Arrow change (specifically dealing with them removing an API that I was using to suppress warnings for a different upstream change that I’d already handled).
I should also mention that I’ve updated the beesbuzz.biz template samples to improve IndieWeb and ActivityPub compatibility. (Publ still doesn’t support ActivityPub itself but these changes make it interoperate with Bridgy Fed a bit better.)
On a meta note, I’ve left the microbiology lab I was at; I hope they continue to use Publ, of course! Over the next little while I’m going to spend some more time working on my own things again (including Publ et al), but I’ve also had some interesting job interviews with one of them seeming very likely to turn into an offer. Wish me luck, if you’re into that sort of thing! (And of course, follow my blog for the primary source of this stuff.)
I’ve released updates to both Publ and Authl.
On the Authl side:
disposition.Error so that can be preserved correctlydisposition.Error.redirrender_login_funcOn the Publ side:
For both:
These changes help to keep sites more secure from eavesdroppers, while also hopefully improving the user experience!
Oh gosh I seem to be on a roll with these updates again. Here’s what changed in Publ:
logout.html template to support that. (Also made the default unauthorized.html use Authl’s default CSS.)entry.authorized available, rather than just documented. Also gave it a better name while I was at it.view.entries can now take an optional argument for inlining unauthorized entries, improving its usage within feeds.view.unauthorized can now take an optional argument for limiting the unauthorized view count, which helps performance and makes it a bit more predictablecategory.subcats(recurse=True) and also added some actual tests for the sort ordering. They pass.And the Authl changes (which were actually released before Publ 0.5.0 but I didn’t bother announcing them until I had them tested “in the wild”):
url_forAnyway, I of course updated the sample beesbuzz.biz templates to reflect the new functionality.
Wow, Publ’s feeling like it’s actually kinda pretty good at stuff now. I hope someone else ever wants to actually, like, use it or something.
I figured there wasn’t really any reason to keep waiting. So here we are.
Changes since v0.4.6:
entry.previous/nextIn other news, over on my main website I have successfully migrated my comments over to Isso, which is a nice self-hosted alternative to Disqus that does a much better job of handling privacy in particular, as well as providing a simpler UX that doesn’t try to get in your face about everything. If you want to read more about how I made that change, read the several blog entries starting with “Moving away from Disqus,” and also look at the sample templates to see the actual implementation.
May your private entries remain exclusive, and your public entries be brilliant.
UPDATE: Someday I’ll learn to use and test rc builds before making an actual public release. Oops.
Updated some packages.
Main things with Publ since the last release:
The only Authl change is that email identities are now given as a full mailto: URL; going forward all identity strings will be full URLs. This simplifies the UX for admin dashboards, in particular, and removes some ambiguity.
I’ve released a mini-update of Publ to fix an authentication problem (the config parser was “helpfully” sanitizing things that didn’t want to be sanitized), and also some refactoring/improvements/bugfixes to Authl.
The big changes to Authl are that the email handler generates shorter/nicer links, and it also puts an anti-abuse timeout into email login attempts to prevent people from spamming themselves or others with spurious email notifications. There’s also a bunch of small bugfixes to Authl’s login flow, and Flask apps can specify that sessions should not be made permanent.
Normally I wouldn’t release a new version just for a single minor bugfix, but this was causing bigger problems. Oops.
Anyway, there was one other minor fix, which allows “cb” to be a valid category name again. It’s minor and fiddly but hey, consistency, right? (And anyway you never know, someone might use Publ for a site that has a CB enthusiasm blog!)
I’ve added private entry stuff to my website (here’s an example post) and in doing so I shook out a few loose ends:
Status: UNLISTED as a synonym for Status: HIDDENAll the auth-related things are now documented here and also demonstrated in the sample templates.
There is not much left for v0.5, incidentally!
Wow, this is a pretty major update: authentication is now a thing!
It isn’t quite complete yet – I still have a few more things I want to add before I consider it done (and therefore release v0.5.0) – but this is at least in a state where it’s ready to be experimented with. Probably. I need to sleep first, before I start adding authentication to my website.
Just another small-ish release to address some bugs and minor interop concerns:
HIDDEN entries now come with headers that opt out of caching and archivalabsolute=True now applies to all links, not just rewritten onesrequest.args per Flask convention)This weekend I’ll be at IndieWeb Summit in Portland, Oregon! I hope to see some of you there.