Gate scanned filters with `trust-scan-filters`

1 file changed, 25 insertions, 26 deletions

diff --git a/MANUAL.txt b/MANUAL.txt
index aa581f0..f032512 100644
--- a/MANUAL.txt
+++ b/MANUAL.txt
@@ -167,12 +167,6 @@ enable-commit-graph::
 	history graph to the left of the commit messages in the repository log
 	page. Default value: "0".
 
-enable-filter-overrides::
-	Flag which, when set to "1", allows the filter settings to be set per
-	repository, both as "repo.<filter>" settings in the main cgitrc and
-	inside repository-specific cgitrc files. When unset, such settings are
-	ignored with a warning. Default value: "0".
-
 enable-follow-links::
 	Flag which, when set to "1", allows users to follow a file in the log
 	view. Default value: "0".
@@ -184,8 +178,9 @@ enable-git-config::
 	settings. The keys gitweb.owner, gitweb.category, and gitweb.description
 	will map to the cgit keys repo.owner, repo.section, and repo.desc
 	respectively. All git config keys that begin with "cgit." will be mapped
-	to the corresponding "repo." key in cgit. Default value: "0". See also:
-	scan-path, section-from-path.
+	to the corresponding "repo." key in cgit, with the filter keys among
+	them waiting on "trust-scan-filters". Default value: "0". See also:
+	scan-path, section-from-path, trust-scan-filters.
 
 enable-gitmodules-links::
 	Flag which, when set to "1", makes submodule listings derive a link from
@@ -543,6 +538,15 @@ trailer-filter::
 	URL values ships as custom/extensions/link-trailers.lua. Default value:
 	none. See also: "Filter API".
 
+trust-scan-filters::
+	Flag which, when set to "1", honours the filter settings in a
+	repository's own cgitrc file and git config found by "scan-path". Those
+	files belong to whoever can push to the repository, and a filter is a
+	command cgit runs, so they are ignored with a warning unless the
+	repositories under the scan are trusted. Filter settings in the main
+	cgitrc, the "repo.<filter>" form included, never need this. Default
+	value: "0". See also: "scan-path", "enable-git-config".
+
 virtual-root::
 	Url which, if specified, will be used as root for all cgit links. It
 	will also cause cgit to generate 'virtual urls', i.e. urls like
@@ -554,9 +558,8 @@ Repository settings
 -------------------
 
 repo.about-filter::
-	Override the default about-filter. Only honoured when
-	"enable-filter-overrides" is set. Default value: <about-filter>. See
-	also: "Filter API".
+	Override the default about-filter. Default value: <about-filter>. See
+	also: "Filter API", "trust-scan-filters".
 
 repo.branch-sort::
 	Flag which, when set to "age", enables date ordering in the branch ref
@@ -568,9 +571,8 @@ repo.clone-url::
 	Default value: <clone-url>. See also: "Macro expansion".
 
 repo.commit-filter::
-	Override the default commit-filter. Only honoured when
-	"enable-filter-overrides" is set. Default value: <commit-filter>. See
-	also: "Filter API".
+	Override the default commit-filter. Default value: <commit-filter>. See
+	also: "Filter API", "trust-scan-filters".
 
 repo.commit-sort::
 	Flag which, when set to "date", enables strict date ordering in the
@@ -591,9 +593,8 @@ repo.desc::
 	Default value: "[no description]".
 
 repo.email-filter::
-	Override the default email-filter. Only honoured when
-	"enable-filter-overrides" is set. Default value: <email-filter>. See
-	also: "Filter API".
+	Override the default email-filter. Default value: <email-filter>. See
+	also: "Filter API", "trust-scan-filters".
 
 repo.enable-blame::
 	A flag which can be used to override the global setting "enable-blame".
@@ -722,14 +723,12 @@ repo.snapshots::
 	Default value: <snapshots>.
 
 repo.source-filter::
-	Override the default source-filter. Only honoured when
-	"enable-filter-overrides" is set. Default value: <source-filter>. See
-	also: "Filter API".
+	Override the default source-filter. Default value: <source-filter>. See
+	also: "Filter API", "trust-scan-filters".
 
 repo.trailer-filter::
-	Override the default trailer-filter. Only honoured when
-	"enable-filter-overrides" is set. Default value: <trailer-filter>. See
-	also: "Filter API".
+	Override the default trailer-filter. Default value: <trailer-filter>. See
+	also: "Filter API", "trust-scan-filters".
 
 repo.url::
 	The relative url used to access the repository. This must be the first
@@ -742,9 +741,9 @@ Repository-specific cgitrc file
 When the option "scan-path" is used to auto-discover git repositories, cgit will
 try to parse the file "cgitrc" within any found repository. Such a repo-specific
 config file may contain any of the repo-specific options described above, except
-"repo.url" and "repo.path". Additionally, the "filter" options are only
-acknowledged in repo-specific config files when "enable-filter-overrides" is set
-to "1".
+"repo.url" and "repo.path". The filter options among them are only honoured
+when "trust-scan-filters" is set to "1", since the file belongs to whoever can
+push to the repository.
 
 Note: the "repo." prefix is dropped from the option names in repo-specific
 config files, e.g. "repo.desc" becomes "desc".