Gate the cache listing behind `enable-cache-list`

The `ls_cache` page printed the cache directory path and the urls other
visitors had requested, with no gate at all.

1 file changed, 6 insertions, 0 deletions

diff --git a/source/cmd.c b/source/cmd.c
index 0eb75b1..7eb642c 100644
--- a/source/cmd.c
+++ b/source/cmd.c
@@ -107,6 +107,12 @@ static void log_fn(void)
 
 static void ls_cache_fn(void)
 {
+	/* The listing exposes the cache path and the URLs other visitors
+	 * requested, so it stays off unless an admin opts in. */
+	if (!ctx.cfg.enable_cache_list) {
+		cgit_print_error_page(404, "Not found", "Not found");
+		return;
+	}
 	ctx.page.mimetype = "text/plain";
 	ctx.page.filename = "ls-cache.txt";
 	cgit_print_http_headers();