Diff options
Diffstat (limited to '')
| -rw-r--r-- | custom/extensions/email-gravatar.lua | 8 | |
| -rw-r--r-- | custom/extensions/email-libravatar.lua | 5 |
2 files changed, 7 insertions, 6 deletions
diff --git a/custom/extensions/email-gravatar.lua b/custom/extensions/email-gravatar.lua index d5c30fcb..95f7aae7 100644 --- a/custom/extensions/email-gravatar.lua +++ b/custom/extensions/email-gravatar.lua @@ -29,8 +29,8 @@ -- -- Every page view sends the visitor's IP address and a hash of each -- committer's email to a third-party service, so leave this filter off if --- that is not acceptable for your instance. Addresses are hashed with MD5, --- which Gravatar still accepts. +-- that is not acceptable for your instance. Addresses are hashed with +-- SHA-256, the form Gravatar documents. local has_digest, digest = pcall(require, "openssl.digest") @@ -41,7 +41,7 @@ local has_digest, digest = pcall(require, "openssl.digest") -- the icon is not blocked as mixed content on an https page. local avatar_size = 13 local default_image = "retro" -local base_url = "https://www.gravatar.com/avatar/" +local base_url = "https://gravatar.com/avatar/" -- One name reaches this filter as an open, writes and a close, so what the @@ -50,7 +50,7 @@ local buffer = "" local avatar_hash = nil local function hash_hex(input) - local raw = digest.new("md5"):final(input) + local raw = digest.new("sha256"):final(input) local hex = "" for i = 1, #raw do hex = hex .. string.format("%.2x", string.byte(raw, i)) diff --git a/custom/extensions/email-libravatar.lua b/custom/extensions/email-libravatar.lua index 719be2ed..e04c2c22 100644 --- a/custom/extensions/email-libravatar.lua +++ b/custom/extensions/email-libravatar.lua @@ -28,7 +28,8 @@ -- -- Every page view sends the visitor's IP address and a hash of each -- committer's email to a third-party service, so leave this filter off if --- that is not acceptable for your instance. Addresses are hashed with MD5. +-- that is not acceptable for your instance. Addresses are hashed with +-- SHA-256, which Libravatar accepts alongside MD5. local has_digest, digest = pcall(require, "openssl.digest") @@ -48,7 +49,7 @@ local buffer = "" local avatar_hash = nil local function hash_hex(input) - local raw = digest.new("md5"):final(input) + local raw = digest.new("sha256"):final(input) local hex = "" for i = 1, #raw do hex = hex .. string.format("%.2x", string.byte(raw, i)) |