Mysaa/cgit
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
1,568 Commits 1 Branch 0 Tags
fe99c76ee477f91d6d983486491603109c7b2599
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Jason A. Donenfeld 55fa25adb0 Bump version 
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
 2020-03-13 17:49:52 -06:00
Jason A. Donenfeld 6a8d6d4b50 global: use proper accessors for maybe_tree 
A previous commit changed ->tree to ->maybe_tree throughout, which may
have worked at the time, but wasn't safe, because maybe_tree is loaded
lazily. This manifested itself in crashes when using the "follow" log
feature. The proper fix is to use the correct contextual accessors
everytime we want access to maybe_tree. Thankfully, the commit.cocci
script takes care of creating mostly-correct patches that we could then
fix up, resulting in this commit here.

Fixes: 255b78f ("git: update to v2.18.0")
Reviewed-by: Christian Hesse <mail@eworm.de>
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
 2020-03-13 17:48:34 -06:00
Jason A. Donenfeld fa146ccabd Bump version 
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
 2020-01-13 15:04:14 -05:00
Jason A. Donenfeld 54c407a74a ui-shared: restrict to 15 levels 
Perhaps a more ideal version of this would be to not print breadcrumbs
at all for paths that don't exist in the given repo at the given oid.

Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
Reported-by: Fydor Wire Snark <wsnark@tuta.io>
 2019-05-20 21:53:16 +02:00
Jason A. Donenfeld 7d87cd3a21 filters: migrate from luacrypto to luaossl 
luaossl has no upstream anymore and doesn't support OpenSSL 1.1,
whereas luaossl is quite active.

Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
 2019-01-03 02:12:16 +01:00
Jason A. Donenfeld e23f63461f ui-shared: fix broken sizeof in title setting and rewrite 
The old algorithm was totally incorrect. While we're at it, use «
instead of \, since it makes more sense.

Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
 2019-01-02 16:13:57 +01:00
Jason A. Donenfeld 441dac1d74 ui-blame: set repo for sb 
Otherwise recent git complains and crashes with: "BUG: blame.c:1787:
repo is NULL".

Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
 2018-11-25 06:01:34 +01:00
Jason A. Donenfeld 898b9e19e0 auth-filter: pass url with query string attached 
Otherwise redirections come out wrong.

Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
 2018-11-25 06:01:34 +01:00
Jason A. Donenfeld 824138e591 Bump version. 
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
 2018-08-03 17:04:03 +02:00
Jason A. Donenfeld 53efaf30b5 clone: fix directory traversal 
This was introduced in the initial version of this code, way back when
in 2008.

$ curl http://127.0.0.1/cgit/repo/objects/?path=../../../../../../../../../etc/passwd
root:x:0:0:root:/root:/bin/sh
...

Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
Reported-by: Jann Horn <jannh@google.com>
 2018-08-03 17:04:03 +02:00
Jason A. Donenfeld 77b6f83344 auth-filters: add simple file-based authentication scheme 
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
 2018-08-03 16:12:21 +02:00
Jason A. Donenfeld 82856923bf auth-filters: use crypt() in simple-authentication 
There's no use in giving a silly example to folks who will just copy it,
so instead try to do something slightly better.

Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
 2018-07-15 04:18:03 +02:00
Jason A. Donenfeld b73df8098f auth-filters: generate secret securely 
This is much better than having the user generate it themselves.

Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
 2018-07-15 03:30:57 +02:00
Jason A. Donenfeld c4d23d02ec auth-filters: do not crash on nil username 
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
 2018-07-14 05:10:28 +02:00
Jason A. Donenfeld 93a2c33051 auth-filter: do not write more than we've read 
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
 2018-07-14 05:09:27 +02:00
Jason A. Donenfeld c3b5b5f648 auth-filters: do not use HMAC-SHA1 
Though SHA1 is broken, HMAC-SHA1 is still fine. But let's not push our
luck; SHA256 is more sensible anyway.

Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
 2018-07-14 03:33:56 +02:00
Jason A. Donenfeld c132ef2462 Bump version. 
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
 2018-07-13 22:40:42 +02:00
Jason A. Donenfeld 089b29a7e1 css: use correct size in annotated decoration 
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
 2018-07-08 19:14:51 +02:00
Jason A. Donenfeld 22583c4992 cgitrc.5: add local tar signature example 
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
 2018-07-05 02:40:48 +02:00
Jason A. Donenfeld 08a2b1b8f8 Fix gcc 8.1.1 compiler warnings 
CC ../shared.o
../shared.c: In function ‘expand_macro’:
../shared.c:487:3: warning: ‘strncpy’ specified bound depends on the length of the source argument [-Wstringop-overflow=]
   strncpy(name, value, len);
   ^~~~~~~~~~~~~~~~~~~~~~~~~
../shared.c:484:9: note: length computed here
   len = strlen(value);
         ^~~~~~~~~~~~~
../ui-shared.c: In function ‘cgit_repobasename’:
../ui-shared.c:136:2: warning: ‘strncpy’ specified bound 1024 equals destination size [-Wstringop-truncation]
  strncpy(rvbuf, reponame, sizeof(rvbuf));
  ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    CC ../ui-ssdiff.o
../ui-ssdiff.c: In function ‘replace_tabs’:
../ui-ssdiff.c:142:4: warning: ‘strncat’ output truncated copying between 1 and 8 bytes from a string of length 8 [-Wstringop-truncation]
    strncat(result, spaces, 8 - (strlen(result) % 8));
    ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
 2018-07-04 03:13:41 +02:00
Jason A. Donenfeld c4167cbd65 cgitrc.5: document new signature notes 
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
 2018-07-03 20:44:25 +02:00
Jason A. Donenfeld b522a302c9 extra-head-content: introduce another option for meta tags 
This is to support things like go-import meta tags, which are on a
per-repo basis.

Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
 2018-07-03 20:37:00 +02:00
Jason A. Donenfeld 03f6e34bb9 cgit: prepare repo before error pages 
This fixes a crash when showing a list of all heads in the <select> box
in the header.

Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
 2018-02-12 23:25:29 +01:00
Jason A. Donenfeld fd069b4ca0 filter: pipe_fh should be local 
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
 2017-10-14 16:13:07 +02:00
Jason A. Donenfeld 87c47488d0 ui-repolist: properly sort by age 
When empty repos exist, comparing them against an existing repo with a
good mtime might, with particular qsort implementations, not sort
correctly, because of this brokenness:

   if (get_repo_modtime(r1, &t) && get_repo_modtime(r2, &t))

However, sorting by the age column works as expected, so anyway, to tidy
things up, we simply reuse that function.

Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
 2017-03-30 13:19:54 +02:00
Jason A. Donenfeld 5564a5d066 syntax-highlighting: replace invalid unicode with ? 2017-01-22 12:44:44 +01:00
Jason A. Donenfeld 8e9ddd21a5 Bump version. 2016-11-23 05:24:36 +01:00
Jason A. Donenfeld ef3108656b Makefile: remove extra space 
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
 2016-10-01 23:35:04 +02:00
Jason A. Donenfeld 7d51120440 md2html: use utf-8 and flush output buffer 
Otherwise we get the classic Python UTF-8 errors, and the text is all
out of order. While we're at it, switch to python3 so we only have to
support one set of oddball semantics.

Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
Suggested-by: Daniel Campbell <dlcampbell@gmx.com>
 2016-06-17 12:28:03 +02:00
Jason A. Donenfeld d88ec849c4 Hosted on HTTPS now 2016-06-07 14:49:35 +02:00
Jason A. Donenfeld a6572ce176 Bump version. 
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
 2016-06-07 14:45:04 +02:00
Jason A. Donenfeld 21bf30b043 ui-diff: action='.' is not correct 
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
 2016-05-12 21:39:06 +02:00
Jason A. Donenfeld c34e28835b forms: action should not be empty 
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
 2016-05-12 21:29:49 +02:00
Jason A. Donenfeld e9cbdf6463 ui-shared: redirect should not exit early for cache 
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
 2016-02-26 13:24:35 +01:00
Jason A. Donenfeld 09a3aa5ae7 about: path_info might not be valid 2016-02-26 13:14:52 +01:00
Jason A. Donenfeld c424b5cb02 tabs: do not use target=_blank 2016-02-23 15:35:32 +01:00
Jason A. Donenfeld 46ff6e1993 css: fix indentation 2016-02-23 15:15:57 +01:00
Jason A. Donenfeld 1892cd9a60 md2html: Do syntax highlighting too 2016-02-23 15:00:05 +01:00
Jason A. Donenfeld 94c02bbf73 cmd: redirect empty about/ to homepage or summary 
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
 2016-02-22 18:40:15 +01:00
Jason A. Donenfeld 5f2664f13c ui-shared: add homepage to tabs 
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
 2016-02-22 18:40:13 +01:00
Jason A. Donenfeld a8b9ef8c1c ui-stats: if we're going to abuse void*, do it safely 2016-02-08 14:35:47 +01:00
Jason A. Donenfeld 23f7dadaab ui-tree: put reverse path in title 2016-01-18 16:13:29 +01:00
Jason A. Donenfeld d3756bd7b0 syntax-highlighting: always use utf-8 to avoid ascii codec issues 2016-01-18 11:14:06 +01:00
Jason A. Donenfeld e64d5e04c3 Bump version 2016-01-14 15:43:54 +01:00
Jason A. Donenfeld c326f3eb02 ui-plain: add enable-html-serving flag 
Unrestricts plain/ to contents likely to be executed by browser.
 2016-01-14 15:42:56 +01:00
Jason A. Donenfeld 9ca2566972 ui-blob: set CSP just in case 2016-01-14 14:43:43 +01:00
Jason A. Donenfeld 92996ac2a6 ui-blob: always use generic mimetypes 2016-01-14 14:31:53 +01:00
Jason A. Donenfeld 1c581a0726 ui-blob: Do not accept mimetype from user 2016-01-14 14:31:13 +01:00
Jason A. Donenfeld 513b3863d9 ui-shared: prevent malicious filename from injecting headers 2016-01-14 14:28:37 +01:00
Jason A. Donenfeld 4291453ec3 ui-shared: Avoid new line injection into redirect header 2016-01-14 14:18:17 +01:00
Jason A. Donenfeld 4458abf641 filter: avoid integer overflow in authenticate_post 
ctx.env.content_length is an unsigned int, coming from the
CONTENT_LENGTH environment variable, which is parsed by strtoul. The
HTTP/1.1 spec says that "any Content-Length greater than or equal to
zero is a valid value." By storing this into an int, we potentially
overflow it, resulting in the following bounding check failing, leading
to a buffer overflow.

Reported-by: Erik Cabetas <Erik@cabetas.com>
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
 2015-11-24 11:31:43 +01:00
Jason A. Donenfeld ffe09621f2 about-formatting.sh: comment text out of date 2015-11-12 04:44:32 +01:00
Jason A. Donenfeld 3f9e14ada1 md2html: the default of stdin works fine 
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
 2015-10-12 18:33:46 +02:00
Jason A. Donenfeld c301899112 filters: misc cleanups 
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
 2015-10-12 16:47:47 +02:00
Jason A. Donenfeld ccb4254104 md2html: use pure python 
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
 2015-10-12 16:42:54 +02:00
Jason A. Donenfeld 525c815cc4 filters: Simplify converters 
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
 2015-10-09 15:13:35 +02:00
Jason A. Donenfeld ad006918a5 Avoid use of non-reentrant functions 
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
 2015-10-09 11:01:04 +02:00
Jason A. Donenfeld 73f199be3f mime: rewrite detection function 
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
 2015-08-17 14:49:28 +02:00
Jason A. Donenfeld 03de473354 cmd: no need for pre function hook now 
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
 2015-08-14 15:54:32 +02:00
Jason A. Donenfeld c0b5982303 redirect: cleanliness 2015-08-13 11:39:23 +02:00
Jason A. Donenfeld 622e64d5f2 redirect: be more careful for different cgi setups 2015-08-13 11:39:20 +02:00
Jason A. Donenfeld 2d386e227e t0110: Chain together using && 2015-08-12 15:16:05 +02:00
Jason A. Donenfeld d7034806a4 about: always ensure page has a trailing slash 
Otherwise we can't easily embed links to other /about/ pages.

Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
 2015-08-12 15:03:32 +02:00
Jason A. Donenfeld cadbb69990 Bump version 2015-03-13 16:22:11 +01:00
Jason A. Donenfeld 7511f4b4df filters: Add sample gentoo script 2015-03-13 14:51:22 +01:00
Jason A. Donenfeld f3ab1f178f cgit: remember to set up env vars before empty clone path 2015-03-09 17:42:12 +01:00
Jason A. Donenfeld 8eef4589d0 ui-shared: currenturl should take into account leading slash 2015-03-09 17:42:02 +01:00
Jason A. Donenfeld 198d84a9e3 Bump version 2015-03-05 15:58:28 +01:00
Jason A. Donenfeld ecd6b7230c simple-authentication.lua: tie secure cookies to field names 2015-03-05 15:51:22 +01:00
Jason A. Donenfeld bd24832cd7 cgit: show clone URLs for empty repo 2015-03-05 02:32:13 +01:00
Jason A. Donenfeld 2e4a41e840 Make root handling sane again. 2015-03-03 17:33:34 +01:00
Jason A. Donenfeld 6bcda2f73d ui-shared: Add current url helper function. 2015-03-03 17:18:42 +01:00
Jason A. Donenfeld db4b735464 ui-shared: keep filter repolist page in pagination 2015-03-03 17:13:52 +01:00
Jason A. Donenfeld c3473e8a5d ui-repolist: use ctx.qry.url instead of rooturl, in case we're filtering 2015-03-03 17:06:48 +01:00
Jason A. Donenfeld e14eee9ea5 ui-repolist: use correct owner query link 2015-03-03 16:53:11 +01:00
Jason A. Donenfeld 5e3e665d60 Bump verison 2015-02-15 22:12:12 +01:00
Jason A. Donenfeld 6e498de213 ui-clone.c: Fix off-by-one error in pack path 
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
 2015-02-09 12:29:57 +01:00
Jason A. Donenfeld b122730014 Revert "git: use xz compressed archive for download" 
This reverts commit a87c9d8a97.

We want to make OpenBSD people happy.
 2014-12-24 12:50:11 +01:00
Jason A. Donenfeld 2159414a39 footer: link back to cgit home page 
The footer has always been overrideable using the footer= in cgitrc, so
this won't anger anybody who cares about their footer.
 2014-12-23 19:40:14 -07:00
Jason A. Donenfeld efa2879ad7 cgitrc.5: we mean a cgi response, not request 2014-08-01 17:37:27 +02:00
Jason A. Donenfeld eeaffc3343 Bump version. 2014-06-30 15:15:35 +02:00
Jason A. Donenfeld 88b9311323 Makefile: use more reliable git tarball mirror 2014-03-20 11:20:01 -06:00
Jason A. Donenfeld f2fa9c56e2 Bump version. 2014-02-28 00:12:08 +01:00
Jason A. Donenfeld 4930611026 ui-refs: simplify cmp_age logic 
The check in parse_user that eventually makes it into committer_date and
tagger_date is:

else if (mode == 3 && isdigit(*p)) {
    *date = atol(p);
    mode++;
}

Since isdigit('-') is always false, date will never be negative. Thus
the sign of this function:

static int cmp_age(int age1, int age2)
{
    if (age1 != 0 && age2 != 0)
        return age2 - age1;

    if (age1 == 0 && age2 == 0)
        return 0;

    if (age1 == 0)
        return +1;

    return -1;
}

Will always be the same as the sign of this function:

static inline int cmp_age(int age1, int age2)
{
    return age2 - age1;
}

Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
Idea-by: Lukas Fleischer <cgit@cryptocrack.de>
 2014-02-26 16:57:15 +01:00
Jason A. Donenfeld 2e8e9af1d4 Clean up cache documentation. 
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
 2014-02-21 01:36:20 +01:00
Jason A. Donenfeld 8acfa51a8b Makefile: suppress pkg-config error 
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
 2014-02-20 20:06:29 +01:00
Jason A. Donenfeld 7e1c0ed2aa diffstat: do not rely on uninitialized data 
Right now if you visit:
<http://git.zx2c4.com/systemd/diff/src/udev/udev-builtin-input_id.c?id=bcfce235>
you'll see that if you reload the page a few times, a bunch of times the
diffstat comes out with no lines being shown or changed. I'm not
currently sure what the cause of this is, but I suspect it might have to
do with this uninitialized data.

Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
 2014-02-20 19:48:24 +01:00
Jason A. Donenfeld aa6d5b105d simple-authentication: style 
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
 2014-01-23 00:58:07 +01:00
Jason A. Donenfeld f759cc0f08 tests: only do lua tests if lua is compiled-in 
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
 2014-01-20 13:11:10 +01:00
Jason A. Donenfeld 6a1563343c cgit: add --version argument for printing info 
We need this to do runtime tests for make test.

Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
 2014-01-20 13:05:08 +01:00
Jason A. Donenfeld ea7210bef3 README: document pkg-config for luajit 
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
 2014-01-19 15:07:56 +01:00
Jason A. Donenfeld 6952f164c1 makefile: bump version 
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
 2014-01-17 16:09:16 +01:00
Jason A. Donenfeld bdbe03af61 mailmap: source before lighttpd 
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
 2014-01-17 16:04:27 +01:00
Jason A. Donenfeld bb3cc0d966 ui-shared: do not allow negative minutes 
Do to timestamp differences, sometimes cgit would should "-0 min", which
doesn't make any sense.

Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
 2014-01-17 15:41:41 +01:00
Jason A. Donenfeld 9dde6d38e9 auth: document tweakables in lua script 
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
 2014-01-17 15:34:44 +01:00
Jason A. Donenfeld a2b6b37175 repolist: make owner clickable to search 
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
 2014-01-17 14:01:27 +01:00
Jason A. Donenfeld 3cbbb8ea39 ui-shared: move about tab all the way to the left 
There were no objections (at the time of committing this):
   http://lists.zx2c4.com/pipermail/cgit/2013-May/001393.html
   http://lists.zx2c4.com/pipermail/cgit/2014-January/001904.html

Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
 2014-01-17 13:53:37 +01:00
Jason A. Donenfeld 9786f4613d filter: don't forget to reap the auth filter 
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
 2014-01-17 13:53:02 +01:00
Jason A. Donenfeld 9999b0a3e9 cgit.c: free tmp variable 
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
 2014-01-17 00:48:17 +01:00
Jason A. Donenfeld a431326e8f auth: have cgit calculate login address 
This way we're sure to use virtual root, or any other strangeness
encountered.

Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
 2014-01-16 23:21:54 +01:00