Write Freely

Recent Commits

• Matt Baer(15 Aug 26)

  Merge pull request #1729 from writefreely/fedi-image-description Include image alt text in fediverse attachment data

• Matt Baer(11 Aug 26)

  Merge pull request #1712 from writefreely/dependabot/github_actions/docker/login-action-4.6.0 Bump docker/login-action from 4.3.0 to 4.6.0

• Matt Baer(11 Aug 26)

  Merge pull request #1714 from writefreely/dependabot/go_modules/github.com/writeas/web-core-1.8.0 Bump github.com/writeas/web-core from 1.7.0 to 1.8.0

• Matt Baer(11 Aug 26)

  Add tests for Markdown alt text extraction

• Matt Baer(11 Aug 26)

  Include image alt text in fediverse attachment data This parses out any alt text found in Markdown images included in a post, and adds the text as the image attachment's `name` property, so it shows up across the fediverse, as well. Fixes #698

• Matt Baer(10 Aug 26)

  Merge commit from fork Ensure users can only un/pin a post that belongs to a collection they own

• Matt Baer(10 Aug 26)

  Merge commit from fork Always sanitize slugs on post creation

• Matt Baer(10 Aug 26)

  Ensure only blog owner can pin a blog's posts This fixes GHSA-hwfg-mg9c-cvgf

• Matt Baer(10 Aug 26)

  Merge commit from fork Fix CSRF vulnerability (GHSA-mp2f-3fq8-r9vj) on /me endpoints

• Matt Baer(10 Aug 26)

  Merge branch 'develop' into advisory-fix-1

• Matt Baer(10 Aug 26)

  Fix CSRF vulnerability (GHSA-mp2f-3fq8-r9vj) on /me endpoints - Adds a csrfProtectForm dual-mode helper (form/cookie vs. JSON/bearer-token) for /api/me/self - Adds CSRFField to /me/import and /me/invites - Fixes two additional bugs: - The _gorilla_csrf cookie had no explicit Path, so it defaulted to the issuing page's directory (/me/) and wasn't sent to /api/... routes. Added csrf.Path("/") everywhere csrf.Protect is used (including the pre-existing /me/delete and /reset routes, for consistency). - The hidden CSRF field broke gorilla/schema's strict form decoding for updateSettings. Now we set IgnoreUnknownKeys(true) on the shared form decoder.

• Matt Baer(10 Aug 26)

  Merge pull request #1725 from writefreely/add-tests Add tests for signup, templates, and mailer

• Matt Baer(10 Aug 26)

  Merge pull request #1726 from writefreely/fix-icons Fix Material icons in Safari

• Matt Baer(10 Aug 26)

  Bump version to 0.17.2

• Matt Baer(10 Aug 26)

  Remove unused Material Icon font files Ref T930

• Matt Baer(10 Aug 26)

  Fix icons for Safari and small icons in Chrome Ref T930

• Matt Baer(09 Aug 26)

  Remove outdated goreportcard.com badge from README

• Matt Baer(09 Aug 26)

  Add template rendering tests for /me pages Tests across configurations: single-user, plus multi-user with `chorus` on or off.

• Matt Baer(09 Aug 26)

  Add tests for the mailer pkg

• Matt Baer(09 Aug 26)

  Add tests around signing up

• Matt Baer(09 Aug 26)

  Merge pull request #1720 from writefreely/fix-post-signature-dupe ActivityPub: Fix duplicated post signature and potential HTML entities in the title

• Matt Baer(09 Aug 26)

  Merge pull request #1721 from writefreely/fix-smtp-sending Fix unquoted From address and phantom recipient in mailer

• Matt Baer(09 Aug 26)

  Merge pull request #1724 from writefreely/fix-unvalidated-invite-signups Validate invite codes on /auth/signup with closed registrations

• Matt Baer(09 Aug 26)

  Return applicable error for expired invite links on /auth/signup The clanker didn't fully mirror the invite code check in viewOauthCallback(). Now this does, returning a 404 and "expired invite" message when applicable on the /auth/signup endpoint.

• Matt Baer(09 Aug 26)

  Merge pull request #1719 from writefreely/fix-chorus-post-page Fix collection / post rendering in Chorus mode

• sNullp(08 Aug 26)

  Validate invite codes on /auth/signup with closed registrations The closed-registration check added in 5996c93 only requires invite_code to be non-empty -- the code itself is never validated. Because signupWithRegistration() creates and commits the user before calling CreateInvitedUser(), and usersinvited.invite_id carries no foreign key, posting an arbitrary string as invite_code creates a full account on an instance that has registrations closed: curl -d 'alias=x&pass=y&invite_code=z' https://example.com/auth/signup Look the invite up and confirm it's still active before continuing, the same way viewOauthCallback() already does for OAuth registrations. An empty code matches no rows, so signups without an invite are still refused exactly as before. Co-Authored-By: Claude Opus 5 <[email protected]>

• Matt Baer(07 Aug 26)

  Fix unquoted From address and phantom recipient in mailer Blog names containing commas or other RFC 5322 special characters broke the SMTP "From" header, silently discarding the recipient too and preventing any email from sending. This adds mailer.FormatAddress to properly quote/escape display names. Also fix mailer.NewMessage pre-allocating a phantom empty-address recipient alongside every single-recipient send, which caused a spurious "No recipient specified" error to be logged on every password reset, login link, and subscription confirmation email. (#1545, #1552) Fixes #1551

• Matt Baer(07 Aug 26)

  Strip HTML from post titles in `Post.PlainDisplayTitle` This ensures HTML entities won't show up in places we don't want them, like RSS feeds and ActivityStreams data. Fixes #1675

• Matt Baer(07 Aug 26)

  Ensure posts never duplicate signature in ActivityPub data Previously, this was caused by multiple calls to `Post.augmentContent`. This fixes that by making the call idempotent. Fixes #1675

• Matt Baer(07 Aug 26)

  Fix collection / post rendering in Chorus mode Previously, page rendering failed on blogs and post pages when an instance was configured with our experimental Chorus mode enabled (`chorus = true`). This fixes that by adding UserPage methods to `CollectionPage` and `CollectionPostPage` to provide the fields expected by the shared `user-navigation` template included on all "/me" path pages. Fixes #1718