cccms/config/initializers, branch master[no description]http://erdgeist.org/gitweb/cccms/atom?h=master2026-08-09T21:31:35ZEscape feed content with Builder rather than by hand2026-08-09T21:31:35Zerdgeisterdgeist@erdgeist.org2026-08-09T21:31:35Zurn:sha1:5690cf4d4e05eafdfd2e270bbdf1a925114d0f76
Builder escapes by default; the three feed templates no longer call
CGI.escapeHTML. This fixes two sites that never escaped at all: the tag
feed's externally supplied :tag segment, interpolated into its title, self
link and id, and dc:creator in the RDF template.
Subscribers see one difference: quotes and apostrophes arrive raw, which is
valid in element text.
config/initializers/xmlparser.rb, which redefined Builder::XmlBase#_escape
as the identity function, is gone. XML::Node#replace_with went with it, no
callers.
Remove the Rails 3.2 duration patch2026-08-09T20:50:08Zerdgeisterdgeist@erdgeist.org2026-08-09T20:50:08Zurn:sha1:6047bd39f7d08a17f679e6c6fc2487c5c2c6b611
It reopened Integer and Float to work around duration arithmetic under Ruby
2.4 and Rails 3.2, and has been shadowing ActiveSupport's own helpers ever
since. Its months were exactly 30 days and its years 365.25, both differing
from ActiveSupport's constants, and it built Duration parts as an array of
pairs rather than a hash, recording weeks as days and hours and minutes as
seconds
Remove the Rails 3.2 create_database patch2026-08-09T20:39:28Zerdgeisterdgeist@erdgeist.org2026-08-09T20:39:28Zurn:sha1:b1d3369d418383bd4e14946b723e4a39c0534a8a
It rewrote the method to work around Enumerable#sum refusing a String seed
under Ruby 2.4, and has been obsolete since Rails 3.2 was left behind. It
kept shadowing the adapter, dropping the collation, ctype, locale and
locale_provider options Rails 8 supports
Tidy up headings on house keeping views2026-08-04T15:13:18Zerdgeisterdgeist@erdgeist.org2026-08-04T15:13:18Zurn:sha1:ac01156d00b24d14225c8e75979fb59bba69640d
- Collapse page headers into one action row with an optional hint
- limit will_paginate to one row
Give the session cookie a lifetime so it survives app switches2026-08-02T16:59:03Zerdgeisterdgeist@erdgeist.org2026-08-02T16:59:03Zurn:sha1:833c59abf109943e857f64e526f6434e095242d6Add a pseudo-locale tripwire for the i18n extraction2026-07-24T20:05:58Zerdgeisterdgeist@erdgeist.org2026-07-24T20:05:58Zurn:sha1:8e1cbe1362059ee02bcc6380be3fb979455da022Give all sessions a uniform absolute lifetime of one week2026-07-24T15:20:41Zerdgeisterdgeist@erdgeist.org2026-07-24T15:20:41Zurn:sha1:d5883869e97244335370d54e21ef46b3f1885899
Enforced at restore via a login-time stamp, written only at genuine
logins so the limit stays absolute rather than sliding. The cookie
name rotation logs everyone out once at deploy. Second-factor users
are deliberately not treated worse than password-only ones.
Polish the OTP flows: autocomplete tokens, button dialect, QR sizing, my-account link2026-07-24T15:20:22Zerdgeisterdgeist@erdgeist.org2026-07-24T15:20:22Zurn:sha1:5f26394947d1150e2656bb22c5858ae5edcdcac7Add TOTP enrollment and verification to User, witnessed in the action log2026-07-24T11:11:51Zerdgeisterdgeist@erdgeist.org2026-07-24T11:11:51Zurn:sha1:02e1aefa24cdd0339995d14431713822f4bf4718Force tags to be lowercase. A script unifies existing tags in both cases2026-07-23T17:58:31Zerdgeisterdgeist@erdgeist.org2026-07-23T17:58:31Zurn:sha1:f0745de7f661a27b4d20d2ba317d1b31bf9a6c4b