v1.3.0

Requires goblog 0.12.0.

What's changed

Signing in with GitHub is goblog's job now. The button is a plain link to /login/github; the theme no longer assembles the authorize URL in an inline script — where window.location went into redirect_uri unescaped — nor handles the ?code= that came back. goblog completes the exchange server-side against a state it minted, so a code obtained for one account can no longer be replayed into another visitor's browser (goblogplatform/GoBlog#631, #637).

The button's own URL comes from the server too, as .github_login_url, rather than being built with a nested template conditional in every theme (goblogplatform/GoBlog#639).

Upgrading

min_goblog_version is now 0.12.0, so the directory offers this only once your goblog is on that release — it will not install a theme whose sign-in button has no URL to point at.

Upgrade goblog first. On 0.12.0 an older version of this theme still signs in, because goblog restarts the flow when a callback arrives with no state (goblogplatform/GoBlog#640), but it gets there via a second round trip to GitHub. Update the theme rather than relying on that.