News and updates about Publ
So hey, if you’ve been using webmention.js you should probably update it, as there turned out to be an XSS issue found by Checkmention. Better to be safe than sorry etc. etc.
I’ve released updates to both Publ and Authl.
On the Authl side:
disposition.Error so that can be preserved correctlydisposition.Error.redirrender_login_funcOn the Publ side:
For both:
These changes help to keep sites more secure from eavesdroppers, while also hopefully improving the user experience!
I’ve released v0.2.8 of Pushl, which fixes an issue with Webmention and Pingback where it was over-optimistically setting the link target. It will also warn you if the link target doesn’t match with the actual page, so you can update your links accordingly.
Right now it’s a little spammy (in that it’ll tell you about redirection mismatches for all links, not just ones with a Webmention or Pingback endpoint), but the next version will address that.
I’ve released Authl v0.2.0. Changes since v0.1.8:
And changes from v0.1.7 to v0.1.8 (which I didn’t bother to post an announcement about):
client_secret was leaking but in the context of Mastodon that couldn’t really be used for anything anyway)Around a month ago a bunch of my webmention stuff broke on my site, and I just figured out what was causing it. Pushl was getting confused by the fact that I had multiple feeds which provided the same content, and some of them were in a no-webmentions context. The no-webmentions ones were getting processed first, which was preventing the webmention-context versions from actually being processed.
So, I fixed this bug by making the context part of what dedupes the actions.
Every time I work on Pushl I feel like it could use a major rewrite, incidentally. This is one of those times.
I’ve released Authl v0.1.7, which now adds direct support for IndieAuth (rather than requiring IndieLogin.com as a broker). This means that now folks who have an IndieAuth identity can log in using that; previously I was expecting IndieLogin.com to eventually open up client registrations to make that a useful authentication path, but for various reasons Aaron hasn’t opened it up to the general public.
Part of this update was to also refactor how OAuth is handled, so it’ll be a lot easier for me to add more OAuth-based providers in the future; hopefully I’ll have direct support for Twitter, GitHub, and maybe even Facebook in the near-ish future. But for now, between Mastodon, email, and IndieAuth, I think I have all of my own personal needs taken care of.
Feel free to make suggestions for other identity providers in the Authl issue tracker, though!
Oh gosh I seem to be on a roll with these updates again. Here’s what changed in Publ:
logout.html template to support that. (Also made the default unauthorized.html use Authl’s default CSS.)entry.authorized available, rather than just documented. Also gave it a better name while I was at it.view.entries can now take an optional argument for inlining unauthorized entries, improving its usage within feeds.view.unauthorized can now take an optional argument for limiting the unauthorized view count, which helps performance and makes it a bit more predictablecategory.subcats(recurse=True) and also added some actual tests for the sort ordering. They pass.And the Authl changes (which were actually released before Publ 0.5.0 but I didn’t bother announcing them until I had them tested “in the wild”):
url_forAnyway, I of course updated the sample beesbuzz.biz templates to reflect the new functionality.
Wow, Publ’s feeling like it’s actually kinda pretty good at stuff now. I hope someone else ever wants to actually, like, use it or something.
I figured there wasn’t really any reason to keep waiting. So here we are.
Changes since v0.4.6:
entry.previous/nextIn other news, over on my main website I have successfully migrated my comments over to Isso, which is a nice self-hosted alternative to Disqus that does a much better job of handling privacy in particular, as well as providing a simpler UX that doesn’t try to get in your face about everything. If you want to read more about how I made that change, read the several blog entries starting with “Moving away from Disqus,” and also look at the sample templates to see the actual implementation.
May your private entries remain exclusive, and your public entries be brilliant.
UPDATE: Someday I’ll learn to use and test rc builds before making an actual public release. Oops.
Updated some packages.
Main things with Publ since the last release:
The only Authl change is that email identities are now given as a full mailto: URL; going forward all identity strings will be full URLs. This simplifies the UX for admin dashboards, in particular, and removes some ambiguity.
I’ve released a mini-update of Publ to fix an authentication problem (the config parser was “helpfully” sanitizing things that didn’t want to be sanitized), and also some refactoring/improvements/bugfixes to Authl.
The big changes to Authl are that the email handler generates shorter/nicer links, and it also puts an anti-abuse timeout into email login attempts to prevent people from spamming themselves or others with spurious email notifications. There’s also a bunch of small bugfixes to Authl’s login flow, and Flask apps can specify that sessions should not be made permanent.
Normally I wouldn’t release a new version just for a single minor bugfix, but this was causing bigger problems. Oops.
Anyway, there was one other minor fix, which allows “cb” to be a valid category name again. It’s minor and fiddly but hey, consistency, right? (And anyway you never know, someone might use Publ for a site that has a CB enthusiasm blog!)
I’ve added private entry stuff to my website (here’s an example post) and in doing so I shook out a few loose ends:
Status: UNLISTED as a synonym for Status: HIDDENAll the auth-related things are now documented here and also demonstrated in the sample templates.
There is not much left for v0.5, incidentally!
Wow, this is a pretty major update: authentication is now a thing!
It isn’t quite complete yet – I still have a few more things I want to add before I consider it done (and therefore release v0.5.0) – but this is at least in a state where it’s ready to be experimented with. Probably. I need to sleep first, before I start adding authentication to my website.
I’ve released Authl 0.1.1, which adds support for Mastodon authentication. And the Publ test suite now is up-to-date with that as well.
There’s a few things I want to do on Publ before I release a version for use on my own website, the big one being the ability to provide a better login page, and some refactoring around built-in templates now that built-in templates are becoming a thing.
I also really want to redo how I manage the documentation site, because it’s getting kind of untenable at this point.
Anyway, really soon I’ll have properly-private content on my website again, and hopefully this will be enough of a feature for people to actually be interested in Publ!
I’ve put a bunch more work into Authl, and have released it into PyPI. Of note is that now it has a simplified mechanism for setting it up with a Flask application.
Hey, wait, Publ’s a Flask application!
How about that.
I wrote more about this on my personal blog but to summarize, I finally made some progress on actually working on Authl, which was the missing piece I needed before finally getting started on private posts. No promises on when I’ll actually have that functionality working, but at least I’ve finally gotten over the chicken-and-egg bump of not having any auth system to implement privacy against (and no privacy system to implement auth for).
Anyway, if anyone wants to play with what I have so far, there’s an incredibly basic starting point over yonder.
Just another small-ish release to address some bugs and minor interop concerns:
HIDDEN entries now come with headers that opt out of caching and archivalabsolute=True now applies to all links, not just rewritten onesrequest.args per Flask convention)This weekend I’ll be at IndieWeb Summit in Portland, Oregon! I hope to see some of you there.
Not a whole lot new in this one, because I haven’t had time to work on Publ lately.
This release is mostly to fix a silly bug that was causing apostrophes and quotes to get dropped from plaintext renditions of titles and whatnot, which was caused by some of the refactoring I did in the run up to the 0.4.0 release and didn’t notice until just now.
I also fixed a MathJax test, and did a bunch of refactoring/cleanup of one of the internal API shims. Nothing user-facing.
Oh! And I’ll be attending IndieWeb Summit 2019 in Portland at the end of the month. I look forward to meeting other IndieWeb wonks! I love that RSVPing to it got me to finally fix my site template’s RSVP function.
And in other news I’ve finally been cleaning up the quickstart guide thanks to some feedback from a potential user. If you’ve been wanting to try Publ but were entirely confused or lost or whatever, please give it another look! And of course I am happy to get documentation feedback (or pull requests!) on the site repository.
Oh wow, I finally closed out the Publ 0.4.0 milestone. So, wow, this is a pretty big deal for me.
Changes since 0.3.23:
So that closes out the last three issues before I was ready to consider this usable by a wider audience. Neat.
There’s a lot of stuff I want to do for 1.0 of course, but also more importantly I need to vastly improve the documentation on this site, as well as collect things to make it easier for people to get started with Publ. I would absolutely invite people to make suggestions; have you looked into Publ, and been confused about what exactly to do? Please let me know!
The best ways to do so are to either hop onto my Discord channel or to open issues against the documentation site.
I got an itch today to do a bunch of feature work, and also found and fixed a bunch of bugs that I didn’t catch before.
Changes for this release:
prefix_ attributes now apply correctly to image and imageset style and class attributeshref and src attributes (so for example <audio src="local_file.mp3"> will now work)