\u8981\u6FC0\u6D3B\u4F60\u7684Roller\u8D26\u6237[{1}]\uFF0C\u8BF7\u70B9\u51FB\u4EE5\u4E0B\u94FE\u63A5\uFF1A
+
+
:
-
+
+ value="#safeCommentUrl" escapeHtml="true"/>
+
+
+ :
+
+
+
:
diff --git a/app/src/main/webapp/WEB-INF/velocity/weblog.vm b/app/src/main/webapp/WEB-INF/velocity/weblog.vm
index 212f376562..b80804dac4 100644
--- a/app/src/main/webapp/WEB-INF/velocity/weblog.vm
+++ b/app/src/main/webapp/WEB-INF/velocity/weblog.vm
@@ -22,7 +22,6 @@ These are the documented macros in order defined in this file:
#includeTemplate($weblog $pageName)
#showAutodiscoveryLinks($weblog)
- #showTrackbackAutodiscovery($entry)
#showMetaDescription()
#showAnalyticsTrackingCode($weblog)
@@ -115,29 +114,12 @@ Show RSS, Atom and RSD auto-discovery links as HTML link elements.
#**
- * Display a trackback auto-discovery RDF comment for a WeblogEntry, but only
- * if trackbacks are enabled and comments are allowed for the entry.
- **#
-#macro( showTrackbackAutodiscovery $entry )
-#if($config.trackbacksEnabled && $model.weblog.allowComments && $entry.commentsStillAllowed)
-
-#end
+Deprecated no-op retained temporarily for custom template compatibility.
+*#
+#macro(showTrackbackAutodiscovery $entry)
#end
+
#**
Adds a meta description tag, suitable for use in HTML header sections. This tag is frequently used by
search engines to provide a short description for links returned. The description value will set to the
@@ -1041,5 +1023,3 @@ Include Javascript code needed for expanding folder macros (undocumented).
#end
-
-
diff --git a/app/src/main/webapp/WEB-INF/web.xml b/app/src/main/webapp/WEB-INF/web.xml
index 0418832da1..9117f74bf5 100644
--- a/app/src/main/webapp/WEB-INF/web.xml
+++ b/app/src/main/webapp/WEB-INF/web.xml
@@ -95,12 +95,11 @@
FORWARD
-
IPBanFilter
/roller-ui/rendering/comment/*
- /roller-ui/rendering/trackback/*
FORWARD
@@ -229,12 +228,6 @@
7
-
- TrackbackServlet
- org.apache.roller.weblogger.ui.rendering.servlets.TrackbackServlet
- 7
-
-
RSDServlet
org.apache.roller.weblogger.ui.rendering.servlets.RSDServlet
@@ -368,11 +361,6 @@
/roller-ui/rendering/comment/*
-
- TrackbackServlet
- /roller-ui/rendering/trackback/*
-
-
RSDServlet
/roller-ui/rendering/rsd/*
diff --git a/app/src/main/webapp/robots.txt b/app/src/main/webapp/robots.txt
index 1d9bb7ccc0..b442054874 100644
--- a/app/src/main/webapp/robots.txt
+++ b/app/src/main/webapp/robots.txt
@@ -4,6 +4,5 @@ Disallow: /roller-
Disallow: /theme
Disallow: /language
Disallow: /resources
-Disallow: /trackback
Disallow: /comment
-Disallow: /main.do
\ No newline at end of file
+Disallow: /main.do
diff --git a/app/src/main/webapp/themes/base.css b/app/src/main/webapp/themes/base.css
index 7f5f104b42..ce424ec29d 100644
--- a/app/src/main/webapp/themes/base.css
+++ b/app/src/main/webapp/themes/base.css
@@ -212,7 +212,7 @@ div#searchAgain {
border: 1px solid #999;
font-size: 1em;
}
-#nextEntry {
+#nextEntry {
text-align: right;
}
#previousEntry {
diff --git a/app/src/main/webapp/themes/basic/_day.vm b/app/src/main/webapp/themes/basic/_day.vm
index 8d3a75612d..a798ccdbd0 100644
--- a/app/src/main/webapp/themes/basic/_day.vm
+++ b/app/src/main/webapp/themes/basic/_day.vm
@@ -30,7 +30,6 @@
#end
- #showTrackbackAutodiscovery($entry)
#end
diff --git a/app/src/main/webapp/themes/basicmobile/_day.vm b/app/src/main/webapp/themes/basicmobile/_day.vm
index 8d3a75612d..a798ccdbd0 100644
--- a/app/src/main/webapp/themes/basicmobile/_day.vm
+++ b/app/src/main/webapp/themes/basicmobile/_day.vm
@@ -30,7 +30,6 @@
#end
- #showTrackbackAutodiscovery($entry)
#end
diff --git a/app/src/test/java/org/apache/roller/weblogger/pojos/wrapper/WeblogEntryCommentWrapperTest.java b/app/src/test/java/org/apache/roller/weblogger/pojos/wrapper/WeblogEntryCommentWrapperTest.java
new file mode 100644
index 0000000000..fe8a1f77ed
--- /dev/null
+++ b/app/src/test/java/org/apache/roller/weblogger/pojos/wrapper/WeblogEntryCommentWrapperTest.java
@@ -0,0 +1,72 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.roller.weblogger.pojos.wrapper;
+
+import org.apache.roller.weblogger.pojos.WeblogEntryComment;
+import org.apache.roller.weblogger.util.CommentAuthorUrl;
+import org.junit.jupiter.api.Test;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNull;
+
+class WeblogEntryCommentWrapperTest {
+
+ @Test
+ void exposesEscapedHttpAndHttpsAuthorUrls() {
+ WeblogEntryComment comment = new WeblogEntryComment();
+ comment.setUrl(" https://example.org/profile?a=1&b=2 ");
+
+ WeblogEntryCommentWrapper wrapper = WeblogEntryCommentWrapper.wrap(comment, null);
+
+ assertEquals("https://example.org/profile?a=1&b=2", wrapper.getUrl());
+ assertEquals("https://example.org/profile?a=1&b=2", comment.getSafeUrl());
+ }
+
+ @Test
+ void acceptsLocalAndInternationalizedAuthorUrls() {
+ assertEquals("http://localhost:8080/profile",
+ CommentAuthorUrl.normalize("http://localhost:8080/profile"));
+ assertEquals("https://intranet/profile",
+ CommentAuthorUrl.normalize("https://intranet/profile"));
+ assertEquals("http://my_host.example.com/profile",
+ CommentAuthorUrl.normalize("http://my_host.example.com/profile"));
+ assertEquals("https://例え.テスト/profile",
+ CommentAuthorUrl.normalize("https://例え.テスト/profile"));
+ assertEquals("http://Example.org/CaseSensitive",
+ CommentAuthorUrl.normalizeInput("Example.org/CaseSensitive"));
+ }
+
+ @Test
+ void omitsUnsupportedOrMalformedAuthorUrls() {
+ WeblogEntryComment comment = new WeblogEntryComment();
+ comment.setUrl("javascript:alert(1)");
+ assertEquals("", WeblogEntryCommentWrapper.wrap(comment, null).getUrl());
+ assertNull(comment.getSafeUrl());
+
+ comment.setUrl("//example.org/profile");
+ assertEquals("", WeblogEntryCommentWrapper.wrap(comment, null).getUrl());
+
+ comment.setUrl("not a url");
+ assertEquals("", WeblogEntryCommentWrapper.wrap(comment, null).getUrl());
+
+ comment.setUrl(" ");
+ assertEquals("", WeblogEntryCommentWrapper.wrap(comment, null).getUrl());
+
+ assertNull(CommentAuthorUrl.normalize("https://user@example.org/profile"));
+ assertNull(CommentAuthorUrl.normalize("https://example.org:99999/profile"));
+ }
+}
diff --git a/app/src/test/java/org/apache/roller/weblogger/ui/rendering/IncomingTrackbackRemovalTest.java b/app/src/test/java/org/apache/roller/weblogger/ui/rendering/IncomingTrackbackRemovalTest.java
new file mode 100644
index 0000000000..a7491fc3c8
--- /dev/null
+++ b/app/src/test/java/org/apache/roller/weblogger/ui/rendering/IncomingTrackbackRemovalTest.java
@@ -0,0 +1,101 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.roller.weblogger.ui.rendering;
+
+import java.io.InputStream;
+import java.nio.charset.StandardCharsets;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import org.apache.roller.util.RollerConstants;
+import org.apache.roller.weblogger.ui.rendering.model.ConfigModel;
+import org.apache.roller.weblogger.ui.rendering.model.URLModel;
+import org.apache.roller.weblogger.ui.rendering.plugins.comments.TrackbackLinkbackCommentValidator;
+import org.apache.roller.weblogger.util.BannedwordslistChecker;
+import org.junit.jupiter.api.Test;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertThrows;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+class IncomingTrackbackRemovalTest {
+
+ @Test
+ void incomingTrackbackEndpointsAndSettingsAreRemoved() {
+ assertThrows(ClassNotFoundException.class, () -> Class.forName(
+ "org.apache.roller.weblogger.ui.rendering.servlets.TrackbackServlet"));
+ assertThrows(ClassNotFoundException.class, () -> Class.forName(
+ "org.apache.roller.weblogger.ui.rendering.util.WeblogTrackbackRequest"));
+ assertThrows(NoSuchMethodException.class,
+ () -> ConfigModel.class.getMethod("getTrackbacksEnabled"));
+ assertThrows(NoSuchMethodException.class,
+ () -> BannedwordslistChecker.class.getMethod(
+ "checkTrackback",
+ org.apache.roller.weblogger.pojos.WeblogEntryComment.class));
+ }
+
+ @Test
+ @SuppressWarnings("removal")
+ void legacyExtensionPointsRemainHarmlessForOneRelease() throws Exception {
+ assertEquals("", new URLModel().trackback("entry"));
+ assertEquals(RollerConstants.PERCENT_100,
+ new TrackbackLinkbackCommentValidator().validate(null, null));
+ assertFileContains(
+ "src/main/webapp/WEB-INF/velocity/weblog.vm",
+ "#macro(showTrackbackAutodiscovery $entry)\n#end");
+ }
+
+ @Test
+ void deploymentAndRuntimeConfigurationDoNotExposeTrackbacks() throws Exception {
+ assertFileDoesNotContain("src/main/webapp/WEB-INF/web.xml", "trackback");
+ assertResourceDoesNotContain(
+ "org/apache/roller/weblogger/config/runtimeConfigDefs.xml", "trackback");
+ assertFileDoesNotContain("../docs/roller-user-guide.adoc", "trackback");
+ assertFileDoesNotContain("../docs/roller-template-guide.adoc", "trackback");
+ }
+
+ private void assertFileDoesNotContain(String path, String value) throws Exception {
+ String content = Files.readString(resolveAppPath(path), StandardCharsets.UTF_8);
+ assertFalse(content.toLowerCase().contains(value), path);
+ }
+
+ private void assertFileContains(String path, String value) throws Exception {
+ String content = Files.readString(resolveAppPath(path), StandardCharsets.UTF_8);
+ assertTrue(content.contains(value), path);
+ }
+
+ private Path resolveAppPath(String path) throws Exception {
+ Path current = Path.of(getClass().getProtectionDomain()
+ .getCodeSource().getLocation().toURI()).toAbsolutePath();
+ while (current != null) {
+ if (Files.isDirectory(current.resolve("src/main"))) {
+ return current.resolve(path).normalize();
+ }
+ current = current.getParent();
+ }
+ throw new IllegalStateException("Unable to locate the app module");
+ }
+
+ private void assertResourceDoesNotContain(String path, String value) throws Exception {
+ try (InputStream input = getClass().getClassLoader().getResourceAsStream(path)) {
+ assertNotNull(input, path);
+ String content = new String(input.readAllBytes(), StandardCharsets.UTF_8);
+ assertFalse(content.toLowerCase().contains(value), path);
+ }
+ }
+}
diff --git a/app/src/test/java/org/apache/roller/weblogger/util/LinkbackExtractorTest.java b/app/src/test/java/org/apache/roller/weblogger/util/LinkbackExtractorTest.java
deleted file mode 100644
index 8153864b74..0000000000
--- a/app/src/test/java/org/apache/roller/weblogger/util/LinkbackExtractorTest.java
+++ /dev/null
@@ -1,52 +0,0 @@
-/*
- * Licensed to the Apache Software Foundation (ASF) under one or more
- * contributor license agreements. The ASF licenses this file to You
- * under the Apache License, Version 2.0 (the "License"); you may not
- * use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License. For additional information regarding
- * copyright in this work, please see the NOTICE file in the top level
- * directory of this distribution.
- */
-
-package org.apache.roller.weblogger.util;
-
-import static org.junit.jupiter.api.Assertions.assertEquals;
-
-/**
- * Test linkback extractor.
- */
-public class LinkbackExtractorTest {
-
- public void testLinkbackExtractor() throws Exception {
- String[][] testrefs = new String[][]
- {
- // Second URL contains a link to the first
- {
- "http://cassandra.apache.org/",
- "https://rollerweblogger.org/roller/entry/composite_keys_in_cassandra"
- },
- {
- "http://roller.apache.org/downloads/downloads.html",
- "https://rollerweblogger.org/project/date/20140627"
- }
- };
-
- LinkbackExtractor le = new LinkbackExtractor(testrefs[0][0],testrefs[0][1]);
- assertEquals("Apache Cassandra", le.getTitle());
-
- le = new LinkbackExtractor(testrefs[1][0],testrefs[1][1]);
- assertEquals("Apache Roller", le.getTitle());
-
- // todo: le.getPermalink() and le.getExcerpt() working
- }
-
-
-}
diff --git a/docs/examples/configs/tomcat/mod_jk.conf b/docs/examples/configs/tomcat/mod_jk.conf
index b2dfe973c6..6f6572a5d7 100644
--- a/docs/examples/configs/tomcat/mod_jk.conf
+++ b/docs/examples/configs/tomcat/mod_jk.conf
@@ -7,7 +7,6 @@ JkMount /roller/xmlrpc ajp13
JkMount /roller/page/* ajp13
JkMount /roller/comments/* ajp13
JkMount /roller/preview/* ajp13
-JkMount /roller/trackback/* ajp13
JkMount /roller/ExportServlet ajp13
JkMount /roller/auth/* ajp13
JkMount /roller/rss/* ajp13
diff --git a/docs/roller-template-guide.adoc b/docs/roller-template-guide.adoc
index b121dd0c77..4caeeeb246 100644
--- a/docs/roller-template-guide.adoc
+++ b/docs/roller-template-guide.adoc
@@ -843,9 +843,6 @@ Every possible type of Roller URL is supported:
|String
|Absolute URL of a resource within a Roller theme.
-|$url.trackback(String anchor)
-|String
-|Trackback URL for entry specified by anchor.
|===
=== $utils
@@ -1858,21 +1855,6 @@ Generated HTML and CSS classes used
No style-able markup is produced.
-`#showTrackbackAutodiscovery($entry)`
-
-Arguments:
-
-*$entry:* WeblogEntry object
-
-Synopsis:
-
-Show trackback autodiscovery code for a specified weblog entry, suitable
-for use within a day template.
-
-Generated HTML and CSS classes used
-
-No style-able markup is produced.
-
`#showAtomFeedsList($weblog)`
Arguments:
diff --git a/docs/roller-user-guide.adoc b/docs/roller-user-guide.adoc
index e047748c91..050b4ce1a7 100644
--- a/docs/roller-user-guide.adoc
+++ b/docs/roller-user-guide.adoc
@@ -54,8 +54,6 @@ comments are allowed.
* *Comment*. A comment posted by a visitor to a weblog and regarding one
specific weblog post. A comment has an email address, a publication
timestamp and some content.
-* *Trackback*. A comment posted by a remote weblog regarding one
-specific weblog post. Trackbacks are stored as comments by Roller.
* *Templates*. Each Roller weblog is defined by a set of HTML and CSS
templates that provide the layout and styles for the weblog. Normally
templates are authored using Velocity template language, but other
@@ -611,13 +609,10 @@ URL is _http://jroller.com/fredsblog_), then your parameters would be:
* *BlogID*: fredsblog
* *URL*: http://jroller.com/roller-services/xmlrpc
-== Working with comments and trackbacks
+== Working with comments
-Roller supports weblog comments and _trackbacks_, which provide a way
-for other bloggers to add comments to your blog remotely. By default
-comments and trackbacks are enabled, but you can turn them off on your
-weblog’s Weblog Settings page of your weblog. Note that turning off
-comments will disable both comments and trackbacks.
+Roller supports weblog comments, which are enabled by default. You can
+turn them off on your weblog’s Weblog Settings page.
=== Comment notification via email
@@ -705,21 +700,20 @@ available in the context of a weblog.
=== *Preventing weblog spam*
-There are two forms of comment spam that can affect your weblog:
+Comment spam can affect your weblog:
** _Comment spam_: spam that arrives via the comment form on your
weblog. Sometimes spam comments are added by a human and sometimes by a
computer program known as a _spambot._
-** _Trackback spam_: spam that arrives via trackbacks sent by a spambot.
-Fortunately, there are counter-measures for each type of spam. Here are
+Fortunately, there are counter-measures. Here are
Roller’s built in spam prevention measures:
* _Pluggable comment authentication_. By default, Roller asks each
commenter a simple math question to ensure that they are a person and
not a spam robot. Your site administrator can turn this off or replace
it with another form of authentication.
-* _Pluggable comment validation_. Roller includes five comment
+* _Pluggable comment validation_. Roller includes four comment
validators below. Your site administrator can adjust the settings for
these validators and can enable/disable them as needed by overriding
Roller’s configuration properties (see the Installation Guide for more
@@ -730,8 +724,6 @@ as spam (default: on)
characters as spam (default: on)
** Bannedwordslist validator marks comments containing any of your site’s
designated bad words as spam (default: on)
-** Trackback verification validator will check incoming trackbacks to
-ensure that they link to you.
** Akismet validator allows you to use the Akismet.com spam prevention
service.
* _Comment throttling_. If your site is being abused by a spam robot
@@ -747,11 +739,11 @@ comments on your weblog. None of the measures are 100% effective. If you
are really concerned about displaying offensive content on your weblog
even for a short time, then enable comment moderation on your weblog.
-Roller uses a _bannedwordslist_, a lists of words which are used to check
-incoming comments, trackbacks and requestors for spam URLs. If the name,
-URL or content of a comment or trackback includes one of the bannedwordslist
-words or matches one of the expressions then that comment or trackback
-is marked as spam and is not displayed on your weblog, unless you use
+Roller uses a _bannedwordslist_, a list of words used to check incoming
+comments and requestors for spam URLs. If the name, URL or content of a
+comment includes one of the bannedwordslist words or matches one of the
+expressions, then that comment is marked as spam and is not displayed on your
+weblog, unless you use
the comment management page to unmark it.
Actually, there are three levels of bannedwordslist:
@@ -764,8 +756,8 @@ edited by a global administrator via the Server Admin page.
** Level 3 bannedwordslist: Weblog specific bannedwordslist, which you control in
the Weblog Settings page of your weblog.
-Incoming comments and trackbacks are checked against all three levels of
-bannedwordslist. Incoming web page requests, however, are only checked against
+Incoming comments are checked against all three levels of bannedwordslist.
+Incoming web page requests, however, are only checked against
the levels 2 and 3 bannedwordslist and will receive a 403 (forbidden) message
if found.
@@ -936,7 +928,7 @@ enabled by default on a new weblog entry.
image::user-guide-spam.png[]
* **Ignore incoming URLs that contain any of these words - **you can use
-this to filter out what commentors, trackbacks, and referrers (web page
+this to filter out what commenters and referrers (web page
requestors) are accepted. See Section
[link:#5.5.Preventing%20weblog%20spam%20%7Coutline[5.5]]for more
information on spam prevention.
@@ -1254,8 +1246,6 @@ users.
* *Allow weblog comments*: By un-setting this you can turn off weblog
comments on all weblogs in the system.
-* *Allow trackbacks*: By un-setting this you can turn off incoming
-trackbacks on all weblogs in the system.
* *Autoformat comments*: If this is on, Roller will auto-format comments
by adding in line-breaks where appropriate.
* *Escape comment HTML*: By setting this, you can disallow HTML in
@@ -1265,11 +1255,6 @@ some forms of cross-site scripting.
notification of new comments. This won’t work unless you configured
Roller properly for sending email as described in the Roller
installation guide.
-* *Enable verification of trackback links*: Trackback verification
-checks each incoming trackback to verify that the site sending the
-trackback actually links to the specific weblog entry that is the target
-of the trackback.
-
image::user-guide-28-feed.png[]
* *Default number of entries*: default number of entries to appear in