We use POSIX advisory record locks to control access to cache slots, but
these have an unhelpful behaviour in that they are released when any
file descriptor referencing the file is closed by this process.
Mostly this is okay, since we know we won't be opening the lock file
anywhere else, but there is one place that it does matter: when we
restore stdout we dup2() over a file descriptor referring to the file,
thus closing that descriptor.
Since we restore stdout before unlocking the slot, this creates a window
during which the slot content can be overwritten. The fix is reasonably
straightforward: simply restore stdout after unlocking the slot, but the
diff is a bit bigger because this requires us to move the temporary
stdout FD into struct cache_slot.
Signed-off-by: John Keeping <john@keeping.me.uk>
Reviewed-by: Christian Hesse <mail@eworm.de>
Read signatures from the notes refs refs/notes/signatures/$FORMAT where
FORMAT is one of our archive formats ("tar", "tar.gz", ...). The note
is expected to simply contain the signature content to be returned when
the snapshot "${filename}.asc" is requested, so the signature for
cgit-1.1.tar.xz can be stored against the v1.1 tag with:
git notes --ref=refs/notes/signatures/tar.xz add -C "$(
gpg --output - --armor --detach-sign cgit-1.1.tar.xz |
git hash-object -w --stdin
)" v1.1
and then downloaded by simply appending ".asc" to the archive URL.
Signed-off-by: John Keeping <john@keeping.me.uk>
Reviewed-by: Christian Hesse <mail@eworm.de>
cgit_compose_snapshot_prefix() is identical to print_tag_downloads(), so
remove the latter and use the function from ui-shared.c instead.
Signed-off-by: John Keeping <john@keeping.me.uk>
Reviewed-by: Christian Hesse <mail@eworm.de>
cgit_print_snapshot_links() is almost identical to
print_tag_downloads(), so let's extract the difference to a parameter in
preparation for removing print_tag_downloads() in the next commit.
Signed-off-by: John Keeping <john@keeping.me.uk>
Reviewed-by: Christian Hesse <mail@eworm.de>
Make snapshot links in the commit UI use the same prefix algorithm as
those in the summary UI, so that refs starting with the snapshot prefix
are used as-is rather than composed with the prefix repeated.
Signed-off-by: John Keeping <john@keeping.me.uk>
Reviewed-by: Christian Hesse <mail@eworm.de>
This is expected to be a ref not a hex object ID, so name it more
appropriately.
Signed-off-by: John Keeping <john@keeping.me.uk>
Reviewed-by: Christian Hesse <mail@eworm.de>
The "head" parameter to cgit_print_snapshot_links() is never used, so
remove it.
Signed-off-by: John Keeping <john@keeping.me.uk>
Reviewed-by: Christian Hesse <mail@eworm.de>
There is no way for refinfo::refname to be null, and Git will prevent
zero-length refs so this check is unnecessary.
Signed-off-by: John Keeping <john@keeping.me.uk>
Reviewed-by: Christian Hesse <mail@eworm.de>
Currently the snapshots configuration option only filters which links
are displayed, not which snapshots may be generated and downloaded.
Apply the filter also to requests to ensure that the system policy is
enforced.
Signed-off-by: John Keeping <john@keeping.me.uk>
Reviewed-by: Christian Hesse <mail@eworm.de>
Allow using a user-specified value for the prefix in snapshot files
instead of the repository basename. For example, files downloaded from
the linux-stable.git repository should be named linux-$VERSION and not
linux-stable-$VERSION, which can be achieved by setting:
repo.snapshot-prefix=linux
Signed-off-by: John Keeping <john@keeping.me.uk>
Reviewed-by: Christian Hesse <mail@eworm.de>
Both call sites of cgit_print_snapshot_links() use the same values for
the snapshot mask and repository name, which are derived from the
cgit_repo structure so let's pass in the structure and access the fields
directly.
Signed-off-by: John Keeping <john@keeping.me.uk>
Reviewed-by: Christian Hesse <mail@eworm.de>
This is mostly taken from Git's doc/Makefile, although simplified for
our use. The output now uses Asciidoc's default CSS which I think looks
a bit nicer than the Docbook formatting; as a result of this we no
longer need our custom .css file.
A side effect of this change is that temporary files generated from the
HTML output no longer conflict with the manpage output format (because
any temporary HTML output files use names derived from the output
filename which includes .html).
Signed-off-by: John Keeping <john@keeping.me.uk>
Since commit c699866 (parsing: clear query path before starting,
2017-02-19), we clear the "page" variable simply by calling
cgit_parse_url() even if the URL is empty. This breaks a URL like:
.../cgit?p=about
which is generated when using the "root-readme" configuration option.
This happens because "page" is set to "about" when parsing the query
string before we handle the path (which is empty, but non-null).
It turns out that this is not the only case which is broken, but
specifying repository and page via query options has been broken since
before the commit mentioned above, for example:
.../cgit?r=git&p=log
Fix both of these by allowing the previous state to persist if PATH_INFO
is empty, falling back to the query parameters if no path has been
requested.
Reported-by: Tom Ryder <tom@sanctum.geek.nz>
Signed-off-by: John Keeping <john@keeping.me.uk>
As described in commit 2efb59e (ui-patch: Flush stdout after outputting
data, 2014-06-11), we need to ensure that stdout is flushed before
restoring the file descriptor when writing to the cache. It turns out
that it's not just ui-patch that is affected by this but also raw diff
which writes to stdout internally.
Let's avoid risking more places doing this by ensuring that stdout is
flushed after writing in fill_slot().
Signed-off-by: John Keeping <john@keeping.me.uk>
We currently ignore symlinks in ui-plain, leading to a 404. In ui-tree
we print the content of the blob (that is, the path to the target of the
link), so it makes sense to do the same here.
Signed-off-by: John Keeping <john@keeping.me.uk>
After the previous two patches, this can be classified as a tidy up
rather than a bug fix, but I think it makes sense to group all of the
tests together before setting up the environment for the command to
execute.
Signed-off-by: John Keeping <john@keeping.me.uk>
By specifying the "url" query parameter multiple times it is possible to
end up with ctx.qry.vpath set while ctx.repo is null, which triggers an
invalid code path from cgit_print_pageheader() while printing path
crumbs, resulting in a null dereference.
The previous patch fixed this segfault, but it makes no sense for us to
clear ctx.repo while leaving ctx.qry.path set to the previous value, so
let's just clear it here so that the last "url" parameter given takes
full effect rather than partially overriding the effect of the previous
value.
Signed-off-by: John Keeping <john@keeping.me.uk>
cgit_print_path_crumbs() can call repolink() which assumes that ctx.repo
is non-null. Currently we don't have any commands that set want_vpath
without also setting want_repo so it shouldn't be possible to fail this
test, but the check in cgit.c is in the wrong order so it is possible to
specify a query string like "?p=log&path=foo/bar" to end up here without
a valid repository.
This was found by American fuzzy lop [0].
[0] http://lcamtuf.coredump.cx/afl/
Signed-off-by: John Keeping <john@keeping.me.uk>
If the delimiter here is '&' then it needs to be escaped for inclusion
in an attribute. Use html_attrf() to ensure that this happens (we know
that hex won't need escaping, but this makes it clearer what's
happening.
Signed-off-by: John Keeping <john@keeping.me.uk>
The submodule was accidentally downgraded in commit 8e9ddd21 (Bump
version, 2016-11-23). Restore v2.10.2 so it matches the makefile again.
Signed-off-by: John Keeping <john@keeping.me.uk>
This was originally applied added in commit eac1b67 (ui-patch: Apply
path limit to generated patch, 2010-06-10) but the ability to limit
patches to particular paths was lost in commit 455b598 (ui-patch.c: Use
log_tree_commit() to generate diffs, 2013-08-20).
The new output is slightly different from the original because Git's
diff infrastructure doesn't give us a way to insert an annotation
immediately after the "---" separator, so the commit has moved below the
diff stat.
Signed-off-by: John Keeping <john@keeping.me.uk>
As libgit.a moves away from using fixed size buffers, there is no
guarantee that PATH_MAX is sufficient for all of the paths in a Git
tree, so we should use a dynamically sized buffer here.
Coverity-Id: 141884
Signed-off-by: John Keeping <john@keeping.me.uk>
Free the taginfo when we're done with it. Also reduce the scope of a
couple of variables so that it's clear that this is the only path that
uses the taginfo structure.
Coverity-Id: 141883
Signed-off-by: John Keeping <john@keeping.me.uk>
If we have only a single element in a directory (for example in Java
package paths), display multiple directories in one go so that it is
possible to navigate directly to the first directory that contains
either files or multiple directories.
Signed-off-by: John Keeping <john@keeping.me.uk>
git.git's coding style avoids decl-after-statement and we generally try
to follow it but a few warnings have crept in recently. Fix the one in
ui-ssdiff.c
Signed-off-by: John Keeping <john@keeping.me.uk>
git.git's coding style avoids decl-after-statement and we generally try
to follow it but a few warnings have crept in recently. Fix the ones in
ui-shared.c
Signed-off-by: John Keeping <john@keeping.me.uk>
Currently we can end up passing EOF to isspace(), which is in fact
libgit's sane_isspace which does:
((sane_ctype[(unsigned char)(x)] & (GIT_SPACE)) != 0)
It is very unlikely that EOF cast to "unsigned char" will end up in a
character that has the GIT_SPACE bit set, but the standard only requires
that EOF be a negative integer, so it could access any value in the
sane_ctype array.
If it does end up returning true for isspace() then this loop will never
terminate, so handle EOF as a special value in the same way as the other
loops in this function.
Signed-off-by: John Keeping <john@keeping.me.uk>
Git's DATE_STRFTIME ignores the timezone argument and just uses the
local timezone regardless of whether the "local" flag is set.
Since Atom accepts ISO8601 dates [1], we can use Git's
DATE_ISO8601_STRICT instead, which does get this right. Additionally,
we never use the local timezone here so we can use the
date_mode_from_type() wrapper to simplify the code a bit.
[1] https://tools.ietf.org/html/rfc4287#section-3.3
Signed-off-by: John Keeping <john@keeping.me.uk>
Git's DATE_STRFTIME ignores the timezone argument and just uses the
local timezone regardless of whether the "local" flag is set.
Since our existing FMT_LONGDATE and FMT_SHORTDATE are pretty-much
perfect matches to DATE_ISO8601 and DATE_SHORT, switch to taking a
date_mode_type directly in cgit_date_mode().
Signed-off-by: John Keeping <john@keeping.me.uk>
We abuse the "void *util" field as a counter and recently started to
cast it to a uintptr_t to avoid risking nasal demons by performing
arithmetic on a void pointer.
However, compilers are also known to do "interesting" things if they
know that a pointer is or isn't NULL. Make this safer by checking if
the counter (after casting) is non-zero rather than checking if the
pointer is non-null.
Signed-off-by: John Keeping <john@keeping.me.uk>
This affects the tooltip showing the full time and the case when a date
is sufficiently old to be shown in full rather than as an offset.
Signed-off-by: John Keeping <john@keeping.me.uk>
This returns the correct mode value for use with Git's show_date() based
on the current CGit configuration and will be used in the following
patches.
Signed-off-by: John Keeping <john@keeping.me.uk>
This will allow us to mimic Git's behaviour of showing times in the
originator's timezone when displaying commits and tags.
Signed-off-by: John Keeping <john@keeping.me.uk>
We call open_slot() from cache_ls() without a key since we simply want
to read the path out of the header. Should the file happen to contain
an empty key then we end up calling memcmp() with NULL and a non-zero
length. Fix this by assigning slot->match only if a key is set, which
is always will be in the code paths where we use slot->match.
Coverity-id: 13807
Signed-off-by: John Keeping <john@keeping.me.uk>
If parse_commit() fails, none of the fields in the commit structure will
have been populated so we will dereference NULL when accessing
item->tree.
There isn't much we can do about the error at this point, but if we
return true then we'll try parsing the commit again from print_commit()
and we can report an error to the user at that point.
Coverity-id: 13801
Signed-off-by: John Keeping <john@keeping.me.uk>
findstring is defined as $(findstring FIND,IN) so if multiple flags are
set these tests do the wrong thing unless $(MAKEFLAGS) is the second
argument.
Signed-off-by: John Keeping <john@keeping.me.uk>
We have already called strlen() on "path" by the time we get here, so we
know it can't be null.
Coverity-id: 13954
Signed-off-by: John Keeping <john@keeping.me.uk>
parse_configfile() takes a "const char *" and doesn't hold any
references to it after it returns; there is no reason to pass it a
duplicate.
Coverity-id: 13941
Signed-off-by: John Keeping <john@keeping.me.uk>
Everywhere else in this function we do not check whether the value is
null and parse_configfile() never passes a null value to this callback.
Coverity-id: 13846
Signed-off-by: John Keeping <john@keeping.me.uk>
The previous commit removed the "pre" field from "struct cgit_cmd" but
forgot to update this macro.
Signed-off-by: John Keeping <john@keeping.me.uk>
Reviewed-by: Christian Hesse <mail@eworm.de>
Most errors we generate are (potentially) transient, such as
non-existent object IDs so we don't want them to be cached forever.
Signed-off-by: John Keeping <john@keeping.me.uk>
This also allows us to return proper HTTP error codes when the requested
tree is not found and display an error message in one case (invalid path
inside valid commit) where we previously just displayed an empty page.
Signed-off-by: John Keeping <john@keeping.me.uk>
The existing "show_ctrls" flag is used to control whether we are running
in an existing page or control the page ourselves.
Signed-off-by: John Keeping <john@keeping.me.uk>
This allows us to return a proper HTTP status code when an object is not
found by switching from cgit_print_error() to cgit_print_error_page().
Signed-off-by: John Keeping <john@keeping.me.uk>
These will avoid needing to call three functions to start page layout in
subsequent patches when we move the layout setup into each individual
page.
Signed-off-by: John Keeping <john@keeping.me.uk>
cgit_print_error_page() has the advantage that it sets a suitable HTTP
status code for the response. Note that setting "mimetype" is redundant
here since it cannot have changed since being initialized in
cgit.c::prepare_context(), so we do not need to worry that
cgit_print_error_page() does not set it.
Signed-off-by: John Keeping <john@keeping.me.uk>
This is a bugfix as well as an improvement to the HTTP status code
handling since previously we would not print HTTP headers on any of
these code paths.
Signed-off-by: John Keeping <john@keeping.me.uk>
This is a bugfix as well as an improvement to the HTTP status code
handling since previously we would not print HTTP headers on any of
these code paths.
Signed-off-by: John Keeping <john@keeping.me.uk>
These are more-or-less one-to-one translations but in the final hunk we
gain an HTTP error code where we used to send "200 OK", which is an
improvement.
Signed-off-by: John Keeping <john@keeping.me.uk>
This will allow us to generate error responses with the correct HTTP
response code without needing all of the layout boilerplate.
Signed-off-by: John Keeping <john@keeping.me.uk>
If we haven't got a "git" directory, it should still be possible to run
"make get-git", so we cannot include this file unconditionally.
Signed-off-by: John Keeping <john@keeping.me.uk>
Commit caed6cb (ui-shared: show absolute time in tooltip for relative
dates, 2014-12-20) added a toolip when we show a relative time.
However, in some cases we show a short date (that is, the date but not
the time) if an event was sufficiently far in the past and that commit
did not update that case to add the same tooltip.
Signed-off-by: John Keeping <john@keeping.me.uk>
We only need to hook write() if Lua filter's are in use. If support has
been disabled, remove the dependency on dlsym().
Signed-off-by: John Keeping <john@keeping.me.uk>
Git's git-compat-util.h defines a "sane ctype" that does not use locale
information and works with signed chars, but it does not include
isgraph() so we have included ctype.h ourselves.
However, this means we have to include a system header before
git-compat-util.h which may lead to the system defining some macros
(e.g. _FILE_OFFSET_BITS on Solaris) before git-compat-util.h redefines
them with a different value. We cannot include ctype.h after
git-compat-util.h because we have defined many of its functions as
macros which causes a stream of compilation errors.
Defining our own "sane" isgraph() using Git's sane isprint() and
isspace() avoids all of these problems.
Signed-off-by: John Keeping <john@keeping.me.uk>
git-compat-util.h may define values that affect how system headers are
interpreted, so move sys/sendfile.h after cgit.h (which includes
git-compat-util.h).
Signed-off-by: John Keeping <john@keeping.me.uk>
git-compat-util.h may define various values that affect the
interpretation of system headers. In most places we include cgit.h
first, which pulls in git-compat-util.h, but this file does not depend
on anything else in CGit, so use git-compat-util.h directly.
Signed-off-by: John Keeping <john@keeping.me.uk>
On some systems (e.g. Solaris), /bin/sh is not a POSIX shell. Git
already provides suitable overrides in its config.mak.uname file and we
provide cgit.conf to allow the user to further change this.
The code for this is taken from Git's t/Makefile, meaning that we now
invoke the tests in the same way that Git does.
Signed-off-by: John Keeping <john@keeping.me.uk>
Teach the "log" UI to behave in the same way as "git log --follow", when
given a suitable instruction by the user. The default behaviour remains
to show the log without following renames, but the follow behaviour can
be activated by following a link in the page header.
Follow is not the default because outputting merges in follow mode is
tricky ("git log --follow" will not show merges). We also disable the
graph in follow mode because the commit graph is not simplified so we
end up with frequent gaps in the graph and many lines that do not
connect with any commits we're actually showing.
We also teach the "diff" and "commit" UIs to respect the follow flag on
URLs, causing the single-file version of these UIs to detect renames.
This feature is needed only for commits that rename the path we're
interested in.
For commits before the file has been renamed (i.e. that appear later in
the log list) we change the file path in the links from the log to point
to the old name; this means that links to commits always limit by the
path known to that commit. If we didn't do this we would need to walk
down the log diff'ing every commit whenever we want to show a commit.
The drawback is that the "Log" link in the top bar of such a page links
to the log limited by the old name, so it will only show pre-rename
commits. I consider this a reasonable trade-off since the "Back" button
still works and the log matches the path displayed in the top bar.
Since following renames requires running diff on every commit we
consider, I've added a knob to the configuration file to globally
enable/disable this feature. Note that we may consider a large number
of commits the revision walking machinery no longer performs any path
limitation so we have to examine every commit until we find a page full
of commits that affect the target path or something related to it.
Suggested-by: René Neumann <necoro@necoro.eu>
Signed-off-by: John Keeping <john@keeping.me.uk>
This will allow us to use this nice wrapper function elsewhere, avoiding
dealing with the diff queue when we only need to inspect a filepair.
Signed-off-by: John Keeping <john@keeping.me.uk>
One of the most frequent questions on the mailing list relates to the
idle time in the repository list. The answer to this is to use the
"agefile" feature to calculate the time of the last change whenever the
repository receives changes.
Add a sample post-receive hook in a new "contrib" directory so that we
can just point people at the repository in the future.
Signed-off-by: John Keeping <john@keeping.me.uk>
Sparse complains about this table because we use the integer zero as the
NULL pointer. Use this as an opportunity to reformat the table so that
it always contains 8 elements per row, making it easier to see which
values are being set and which are not.
Signed-off-by: John Keeping <john@keeping.me.uk>
Sparse complains that we are using a plain integer as a NULL pointer
here, but in fact we do not have to specify a value for this variable at
all since it has static storage duration and thus will be initialized to
NULL by the compiler.
Signed-off-by: John Keeping <john@keeping.me.uk>
John Keeping