Diff options
| author | Bryce Kwon <bryce@brycekwon.com> | |
|---|---|---|
| committer | Bryce Kwon <bryce@brycekwon.com> | |
| commit | ||
| parent | ||
| tree | ||
| download | ||
Hash avatar addresses with SHA-256
Gravatar's documentation now describes SHA-256 hashes on gravatar.com
alone, and Libravatar has long accepted them beside MD5.
Diffstat (limited to 'custom')
| -rw-r--r-- | custom/extensions/email-gravatar.lua | 8 | |
| -rw-r--r-- | custom/extensions/email-libravatar.lua | 5 |
2 files changed, 7 insertions, 6 deletions
diff --git a/custom/extensions/email-gravatar.lua b/custom/extensions/email-gravatar.lua index d5c30fc..95f7aae 100644 --- a/custom/extensions/email-gravatar.lua +++ b/custom/extensions/email-gravatar.lua @@ -29,8 +29,8 @@ -- -- Every page view sends the visitor's IP address and a hash of each -- committer's email to a third-party service, so leave this filter off if --- that is not acceptable for your instance. Addresses are hashed with MD5, --- which Gravatar still accepts. +-- that is not acceptable for your instance. Addresses are hashed with +-- SHA-256, the form Gravatar documents. local has_digest, digest = pcall(require, "openssl.digest") @@ -41,7 +41,7 @@ local has_digest, digest = pcall(require, "openssl.digest") -- the icon is not blocked as mixed content on an https page. local avatar_size = 13 local default_image = "retro" -local base_url = "https://www.gravatar.com/avatar/" +local base_url = "https://gravatar.com/avatar/" -- One name reaches this filter as an open, writes and a close, so what the @@ -50,7 +50,7 @@ local buffer = "" local avatar_hash = nil local function hash_hex(input) - local raw = digest.new("md5"):final(input) + local raw = digest.new("sha256"):final(input) local hex = "" for i = 1, #raw do hex = hex .. string.format("%.2x", string.byte(raw, i)) diff --git a/custom/extensions/email-libravatar.lua b/custom/extensions/email-libravatar.lua index 719be2e..e04c2c2 100644 --- a/custom/extensions/email-libravatar.lua +++ b/custom/extensions/email-libravatar.lua @@ -28,7 +28,8 @@ -- -- Every page view sends the visitor's IP address and a hash of each -- committer's email to a third-party service, so leave this filter off if --- that is not acceptable for your instance. Addresses are hashed with MD5. +-- that is not acceptable for your instance. Addresses are hashed with +-- SHA-256, which Libravatar accepts alongside MD5. local has_digest, digest = pcall(require, "openssl.digest") @@ -48,7 +49,7 @@ local buffer = "" local avatar_hash = nil local function hash_hex(input) - local raw = digest.new("md5"):final(input) + local raw = digest.new("sha256"):final(input) local hex = "" for i = 1, #raw do hex = hex .. string.format("%.2x", string.byte(raw, i)) |