aboutsummaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* md2html: use sane_lists extensionJason A. Donenfeld2020-12-291-0/+1
This allows for cleaner nesting semantics and matches github more closely. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* Bump versionv1.2.3Jason A. Donenfeld2020-03-131-1/+1
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* global: use proper accessors for maybe_treeJason A. Donenfeld2020-03-137-19/+29
A previous commit changed ->tree to ->maybe_tree throughout, which may have worked at the time, but wasn't safe, because maybe_tree is loaded lazily. This manifested itself in crashes when using the "follow" log feature. The proper fix is to use the correct contextual accessors everytime we want access to maybe_tree. Thankfully, the commit.cocci script takes care of creating mostly-correct patches that we could then fix up, resulting in this commit here. Fixes: 255b78f ("git: update to v2.18.0") Reviewed-by: Christian Hesse <mail@eworm.de> Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* Bump versionv1.2.2Jason A. Donenfeld2020-01-131-1/+1
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* ui-shared: restrict to 15 levelsJason A. Donenfeld2019-05-201-1/+3
Perhaps a more ideal version of this would be to not print breadcrumbs at all for paths that don't exist in the given repo at the given oid. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com> Reported-by: Fydor Wire Snark <wsnark@tuta.io>
* filters: migrate from luacrypto to luaosslJason A. Donenfeld2019-01-035-44/+83
| | | | | | | luaossl has no upstream anymore and doesn't support OpenSSL 1.1, whereas luaossl is quite active. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* ui-shared: fix broken sizeof in title setting and rewriteJason A. Donenfeld2019-01-021-26/+8
The old algorithm was totally incorrect. While we're at it, use « instead of \, since it makes more sense. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* ui-blame: set repo for sbJason A. Donenfeld2018-11-251-0/+1
| | | | | | | Otherwise recent git complains and crashes with: "BUG: blame.c:1787: repo is NULL". Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* auth-filter: pass url with query string attachedJason A. Donenfeld2018-11-253-3/+37
Otherwise redirections come out wrong. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* Bump version.v1.2.1Jason A. Donenfeld2018-08-031-1/+1
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* clone: fix directory traversalJason A. Donenfeld2018-08-031-4/+19
This was introduced in the initial version of this code, way back when in 2008. $ curl http://127.0.0.1/cgit/repo/objects/?path=../../../../../../../../../etc/passwd root:x:0:0:root:/root:/bin/sh ... Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com> Reported-by: Jann Horn <jannh@google.com>
* auth-filters: add simple file-based authentication schemeJason A. Donenfeld2018-08-031-0/+352
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* auth-filters: use crypt() in simple-authenticationJason A. Donenfeld2018-07-151-13/+6
| | | | | | | There's no use in giving a silly example to folks who will just copy it, so instead try to do something slightly better. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* auth-filters: generate secret securelyJason A. Donenfeld2018-07-152-18/+85
| | | | | | This is much better than having the user generate it themselves. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* auth-filters: do not crash on nil usernameJason A. Donenfeld2018-07-141-1/+1
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* auth-filter: do not write more than we've readJason A. Donenfeld2018-07-141-2/+2
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* auth-filters: do not use HMAC-SHA1Jason A. Donenfeld2018-07-142-4/+4
| | | | | | | Though SHA1 is broken, HMAC-SHA1 is still fine. But let's not push our luck; SHA256 is more sensible anyway. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* Bump version.v1.2Jason A. Donenfeld2018-07-131-1/+1
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* css: use correct size in annotated decorationJason A. Donenfeld2018-07-081-0/+1
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* cgitrc.5: add local tar signature exampleJason A. Donenfeld2018-07-051-4/+15
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* Fix gcc 8.1.1 compiler warningsJason A. Donenfeld2018-07-043-15/+23
| | | | | | | | | | | | | | | | | | | | | | CC ../shared.o ../shared.c: In function ‘expand_macro’: ../shared.c:487:3: warning: ‘strncpy’ specified bound depends on the length of the source argument [-Wstringop-overflow=] strncpy(name, value, len); ^~~~~~~~~~~~~~~~~~~~~~~~~ ../shared.c:484:9: note: length computed here len = strlen(value); ^~~~~~~~~~~~~ ../ui-shared.c: In function ‘cgit_repobasename’: ../ui-shared.c:136:2: warning: ‘strncpy’ specified bound 1024 equals destination size [-Wstringop-truncation] strncpy(rvbuf, reponame, sizeof(rvbuf)); ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ CC ../ui-ssdiff.o ../ui-ssdiff.c: In function ‘replace_tabs’: ../ui-ssdiff.c:142:4: warning: ‘strncat’ output truncated copying between 1 and 8 bytes from a string of length 8 [-Wstringop-truncation] strncat(result, spaces, 8 - (strlen(result) % 8)); ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* cgitrc.5: document new signature notesJason A. Donenfeld2018-07-031-1/+17
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* extra-head-content: introduce another option for meta tagsJason A. Donenfeld2018-07-035-0/+12
This is to support things like go-import meta tags, which are on a per-repo basis. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* cgit: prepare repo before error pagesJason A. Donenfeld2018-02-121-7/+12
This fixes a crash when showing a list of all heads in the <select> box in the header. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* filter: pipe_fh should be localJason A. Donenfeld2017-10-142-7/+7
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* ui-repolist: properly sort by ageJason A. Donenfeld2017-03-301-21/+17
When empty repos exist, comparing them against an existing repo with a good mtime might, with particular qsort implementations, not sort correctly, because of this brokenness: if (get_repo_modtime(r1, &t) && get_repo_modtime(r2, &t)) However, sorting by the age column works as expected, so anyway, to tidy things up, we simply reuse that function. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* syntax-highlighting: replace invalid unicode with ?Jason A. Donenfeld2017-01-221-2/+2
* Bump version.v1.1Jason A. Donenfeld2016-11-232-1/+1
* Makefile: remove extra spaceJason A. Donenfeld2016-10-011-1/+1
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* md2html: use utf-8 and flush output bufferJason A. Donenfeld2016-06-171-6/+11
| | | | | | | | | Otherwise we get the classic Python UTF-8 errors, and the text is all out of order. While we're at it, switch to python3 so we only have to support one set of oddball semantics. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com> Suggested-by: Daniel Campbell <dlcampbell@gmx.com>
* Hosted on HTTPS nowJason A. Donenfeld2016-06-074-5/+5
|
* Bump version.v1.0Jason A. Donenfeld2016-06-071-1/+1
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* ui-diff: action='.' is not correctJason A. Donenfeld2016-05-121-1/+1
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* forms: action should not be emptyJason A. Donenfeld2016-05-122-2/+2
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* ui-shared: redirect should not exit early for cacheJason A. Donenfeld2016-02-261-1/+0
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* about: path_info might not be validJason A. Donenfeld2016-02-261-1/+2
|
* tabs: do not use target=_blankJason A. Donenfeld2016-02-231-1/+1
|
* css: fix indentationJason A. Donenfeld2016-02-231-4/+4
* md2html: Do syntax highlighting tooJason A. Donenfeld2016-02-231-1/+5
* cmd: redirect empty about/ to homepage or summaryJason A. Donenfeld2016-02-221-1/+10
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* ui-shared: add homepage to tabsJason A. Donenfeld2016-02-227-5/+26
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* ui-stats: if we're going to abuse void*, do it safelyJason A. Donenfeld2016-02-081-10/+7
* ui-tree: put reverse path in titleJason A. Donenfeld2016-01-181-0/+34
|
* syntax-highlighting: always use utf-8 to avoid ascii codec issuesJason A. Donenfeld2016-01-181-0/+3
* Bump versionv0.12Jason A. Donenfeld2016-01-141-1/+1
|
* ui-plain: add enable-html-serving flagJason A. Donenfeld2016-01-145-0/+29
| | | | Unrestricts plain/ to contents likely to be executed by browser.
* ui-blob: set CSP just in caseJason A. Donenfeld2016-01-141-0/+3
|
* ui-blob: always use generic mimetypesJason A. Donenfeld2016-01-141-6/+4
|
* ui-blob: Do not accept mimetype from userJason A. Donenfeld2016-01-143-4/+0
|
* ui-shared: prevent malicious filename from injecting headersJason A. Donenfeld2016-01-143-3/+32
|
Copyright © 1996 – 2023 Jason A. Donenfeld. All Rights Reverse Engineered.