In 3.1.6.1 the `~` was handled properly (either literally or with
`%E7`). This broke in 3.1.6.2, which used URI encoding in both
cases and didn't escape the `\` before `%E7`. This patch restores
the former behavior: `~` isn't escaped if it isn't escaped in the
original URL, and if it is, a backslash is added before `%`.
Closes#9043.
See #9031 and discussion in #9020. This will give us better
accessibility; when tagging is enabled, the citation can be
linked to the bibliography entry.
This changes some of the details of the layout and the default
template. We now make CSLReferences a special enumitem list
that will contain `\bibitem`s.
Internal links inside citations to ids beginning in `ref-` are
put inside a `\cite` instead of `\hyperref`.
Closes#9031.
+ Use `\phantomsection` and `\label` instead of `\hypertarget`.
+ Use `\hyperref` for LaTeX internal links, `\hyperlink` for
beamer (since `\hyperref` doesn't seem to work).
Closes#9022.
The aim here (see #9020) is to produce more standard and more
portable man pages. To that end:
- We revert the fanciness introduced in #7506, which employs a
custom font name V and a macro that makes this act like boldface
in a terminal and monospace in other formats. Unfortunately,
this code uses a mechanism that is not portable (and does not
work in mandoc).
- Instead of using V for inline code, we simply use CR.
Note that `\f[CR]` is emitted instead of plain `\f[C]`,
because there is no C font in man. (This produces warnings
in recent versions of groff.)
- For code blocks, we now use the `.EX` and `.EE` macros,
together with `.IP` for spacing and indentation. This gives
more standard code that can be better interpreted e.g. by mandoc.
This improves the fix to #9017 in commit
7c4354646b
An alternative would be to avoid backslash escaping `#` and `%`
in URLs, and instead always add `fragile` to the slide environment.
We no longer wrap section headings in a `\hypertarget`.
This is unnecessary (hyperref creates an anchor based on the
label) and it interferes with tagging.
In addition, we now use `\hyperref` rather than `\hyperlink`
for internal links.
Currently `\hypertarget` is still being used for link anchors
not on headings.
Closes#8744. Thanks to @u-fischer.
The docx reader was overzealous in detecting indented
paragraphs as block quotes, leading to list items sometimes
being put in block quotes (especially in docx created by
Google Docs).
Closes#8836.
A number of block elements, like disp-quote, list, and disp-formula, were always treated as inlines if appearing inside paragraphs, even if their usage granted a separate block. The function isElementBlock has been refined to prevent this, and a number of specific parse cases have been added to parseBlock.
Also, some minimal cleanup of the test file, in order for it to pass XML validation against the JATS DTD 1.3 (it was not compliant with the current or any previous versions of JATS).
Closes#8889.
Closes#8991.
Previously we were putting the label at the beginning of
the Div's contents, but according to the documentation such a
label gets attached to the *preceding* element. We now use an
explicit `#block` and add the label at the end.
Previously we used the max. #8634 switched to the min, but this
had bad results. This commit sets the RowHeadColumns to the consensus
value from all rows, or 0 if there is no consensus.
See #8984.
- Ensure that width and height attributes don't get specified
twice is both the img tag and the svg include them.
- Omit unnecessary attributes xmlns, xmlns:xlink, and version on
svg element.
- Use 20 character rather than 40 character hashes for generated IDs.
Closes#8965.
The fix for #8620 caused the mathjax script to be included
when the table of contents but not the body text of a page
contains math. But it broke the case where the table of
contents doesn't contain math but the page does.
This patch fixes the issue.
Closes#8967.
Guilhem Moulin noticed that the fix to CVE-2023-35936 was incomplete.
An attacker could get around it by double-encoding the malicious
extension to create or override arbitrary files.
$ echo '' >b.md
$ .cabal/bin/pandoc b.md --extract-media=bar
<p><img
src="bar/2a0eaa89f43fada3e6c577beea4f2f8f53ab6a1d.lua+%2f%2e%2e%2f%2e%2e%2fb%2elua" /></p>
$ cat b.lua
print "hello"
$ find bar
bar/
bar/2a0eaa89f43fada3e6c577beea4f2f8f53ab6a1d.lua+
This commit adds a test case for this more complex attack and fixes
the vulnerability. (The fix is quite simple: if the URL-unescaped
filename or extension contains a '%', we just use the sha1 hash of the
contents as the canonical name, just as we do if the filename contains
'..'.)
The substantive change here is the `-strue` will now work
instead of being interpreted as `-s -true`.
This is somewhat ad hoc, but I don't think we'll ever have
an output format named `rue`, so it's probably okay.
Previously if you did `pandoc -s -t bbb`, it would give you
an error about the missing bbb template instead of saying that
it's not a supported output format.
In 3.1.5 boolean arguments were allowed an optional argument
(true|false). This created a regression for uses of fused
short arguments, e.g. `-somyfile.html`, which was equivalent
to `-s -omyfile.html`, but now raised an error because
pandoc attempted to parse `o` as a boolean `true` or `false`.
This change adds a preprocessing step on the raw arguments
before they are sent to the option parser. In this preprocessing
step, `-somyfile.html` would be split into two arguments,
`-s` and `-omyfile.html`. The splitting happens when a
short boolean option is followed by another short option.
Closes#8956.
John MacFarlane