-- `refreshpofiles` uses `system()`, whose args have to be checked more
- thoroughly to prevent any security issue (command injection, etc.).
-- `refreshpofiles` and `refreshpot` create new files; this may need
- some checks, e.g. using `IkiWiki::prep_writefile()`
+- Can any sort of directives be put in po files that will
+ cause mischief (ie, include other files, run commands, crash gettext,
+ whatever).
+- Any security issues on running po4a on untrusted content?
+
+gettext/po4a rough corners
+--------------------------
+
+- fix infinite loop when synchronizing two ikiwiki (when checkouts
+ live in different directories): say bla.fr.po has been updated in
+ repo2; pulling repo2 from repo1 seems to trigger a PO update, that
+ changes bla.fr.po in repo1; then pushing repo1 to repo2 triggers
+ a PO update, that changes bla.fr.po in repo2; etc.; fixed in
+ `629968fc89bced6727981c0a1138072631751fee`?
+- new translations created in the web interface must get proper
+ charset/encoding gettext metadata, else the next automatic PO update
+ removes any non-ascii chars; possible solution: put such metadata
+ into the Pot file, and let it propagate; should be fixed in
+ `773de05a7a1ee68d2bed173367cf5e716884945a`, time will tell.
+
+Misc. improvements
+------------------
+
+### page titles
+
+Use nice page titles from meta plugin in links, as inline already
+does. This is actually a duplicate for
+[[bugs/pagetitle_function_does_not_respect_meta_titles]], which might
+be fixed by something like [[todo/using_meta_titles_for_parentlinks]].
+
+### backlinks
+
+`po_link_to = negotiated`: if a given translatable `sourcepage.mdwn`
+links to \[[destpage]], `sourcepage.LL.po` also link to \[[destpage]],
+and the latter has the master page *and* all its translations listed
+in the backlinks.
+
+`po_link_to = current`: seems to work nicely
+
+### parentlinks
+
+When `usedirs` is disabled and the home page is translatable, the
+parent link to the wiki home page is broken (`/index.html`).