From 031e02acd8acfc07c08245c724671b1b23d8e087 Mon Sep 17 00:00:00 2001 From: Bryce Kwon Date: Fri, 16 Oct 2026 22:07:04 -1000 Subject: Hash avatar addresses with SHA-256 Gravatar's documentation now describes SHA-256 hashes on gravatar.com alone, and Libravatar has long accepted them beside MD5. --- custom/extensions/email-gravatar.lua | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) (limited to 'custom/extensions/email-gravatar.lua') diff --git a/custom/extensions/email-gravatar.lua b/custom/extensions/email-gravatar.lua index d5c30fc..95f7aae 100644 --- a/custom/extensions/email-gravatar.lua +++ b/custom/extensions/email-gravatar.lua @@ -29,8 +29,8 @@ -- -- Every page view sends the visitor's IP address and a hash of each -- committer's email to a third-party service, so leave this filter off if --- that is not acceptable for your instance. Addresses are hashed with MD5, --- which Gravatar still accepts. +-- that is not acceptable for your instance. Addresses are hashed with +-- SHA-256, the form Gravatar documents. local has_digest, digest = pcall(require, "openssl.digest") @@ -41,7 +41,7 @@ local has_digest, digest = pcall(require, "openssl.digest") -- the icon is not blocked as mixed content on an https page. local avatar_size = 13 local default_image = "retro" -local base_url = "https://www.gravatar.com/avatar/" +local base_url = "https://gravatar.com/avatar/" -- One name reaches this filter as an open, writes and a close, so what the @@ -50,7 +50,7 @@ local buffer = "" local avatar_hash = nil local function hash_hex(input) - local raw = digest.new("md5"):final(input) + local raw = digest.new("sha256"):final(input) local hex = "" for i = 1, #raw do hex = hex .. string.format("%.2x", string.byte(raw, i)) -- cgit