Diff options
| author | Bryce Kwon <bryce@brycekwon.com> | |
|---|---|---|
| committer | Bryce Kwon <bryce@brycekwon.com> | |
| commit | ||
| parent | ||
| tree | ||
| download | ||
Gate scanned filters with trust-scan-filters
Diffstat (limited to 'source')
| -rw-r--r-- | source/cgit.c | 35 | |
| -rw-r--r-- | source/cgit.h | 2 | |
| -rw-r--r-- | source/scan-tree.c | 16 |
3 files changed, 28 insertions, 25 deletions
diff --git a/source/cgit.c b/source/cgit.c index 36f3b25..eb13709 100644 --- a/source/cgit.c +++ b/source/cgit.c @@ -539,8 +539,8 @@ static void apply_config(const char *name, const char *value) ctx.cfg.enable_header = atoi(value); else if (!strcmp(name, "snapshots")) ctx.cfg.snapshots = cgit_parse_snapshots_mask(value); - else if (!strcmp(name, "enable-filter-overrides")) - ctx.cfg.enable_filter_overrides = atoi(value); + else if (!strcmp(name, "trust-scan-filters")) + ctx.cfg.trust_scan_filters = atoi(value); else if (!strcmp(name, "enable-follow-links")) ctx.cfg.enable_follow_links = atoi(value); else if (!strcmp(name, "enable-http-clone")) @@ -1215,26 +1215,17 @@ void cgit_repo_config(struct cgit_repo *repo, const char *name, const char *valu repo->hide = atoi(value); else if (!strcmp(name, "ignore")) repo->ignore = atoi(value); - else if ( - !strcmp(name, "about-filter") || - !strcmp(name, "commit-filter") || - !strcmp(name, "source-filter") || - !strcmp(name, "email-filter") || - !strcmp(name, "trailer-filter") - ) { - if (!ctx.cfg.enable_filter_overrides) - fprintf(stderr, "[cgit] Ignoring repo %s: enable-filter-overrides is not set\n", name); - else if (!strcmp(name, "about-filter")) - repo->about_filter = cgit_new_filter(value, ABOUT); - else if (!strcmp(name, "commit-filter")) - repo->commit_filter = cgit_new_filter(value, COMMIT); - else if (!strcmp(name, "source-filter")) - repo->source_filter = cgit_new_filter(value, SOURCE); - else if (!strcmp(name, "email-filter")) - repo->email_filter = cgit_new_filter(value, EMAIL); - else - repo->trailer_filter = cgit_new_filter(value, TRAILER); - } else + else if (!strcmp(name, "about-filter")) + repo->about_filter = cgit_new_filter(value, ABOUT); + else if (!strcmp(name, "commit-filter")) + repo->commit_filter = cgit_new_filter(value, COMMIT); + else if (!strcmp(name, "source-filter")) + repo->source_filter = cgit_new_filter(value, SOURCE); + else if (!strcmp(name, "email-filter")) + repo->email_filter = cgit_new_filter(value, EMAIL); + else if (!strcmp(name, "trailer-filter")) + repo->trailer_filter = cgit_new_filter(value, TRAILER); + else fprintf(stderr, "[cgit] Unknown repo config key: %s\n", name); } diff --git a/source/cgit.h b/source/cgit.h index 5a9e756..72c0844 100644 --- a/source/cgit.h +++ b/source/cgit.h @@ -216,7 +216,7 @@ struct cgit_config { int cache_snapshot_ttl; int case_sensitive_sort; int embedded; - int enable_filter_overrides; + int trust_scan_filters; int enable_follow_links; int enable_gitmodules_links; int enable_header; diff --git a/source/scan-tree.c b/source/scan-tree.c index c46b47d..ba2149a 100644 --- a/source/scan-tree.c +++ b/source/scan-tree.c @@ -48,6 +48,17 @@ static int is_git_dir(const char *path) return 1; } +// A filter is a command cgit runs, and a repository's own files belong to +// whoever can push to it, so their filter keys wait on trust-scan-filters. +static int trusted_key(const char *name) +{ + if (!ends_with(name, "-filter") || ctx.cfg.trust_scan_filters) + return 1; + fprintf(stderr, "[cgit] Ignoring %s in %s: trust-scan-filters is not set\n", name, + current_repo->path); + return 0; +} + static int apply_gitconfig(const char *key, const char *value, const __attribute__((unused)) struct config_context *cfg_ctx, void *cb) { @@ -59,7 +70,7 @@ static int apply_gitconfig(const char *key, const char *value, cgit_repo_config(current_repo, "desc", value); else if (!strcmp(key, "gitweb.category")) cgit_repo_config(current_repo, "section", value); - else if (skip_prefix(key, "cgit.", &name)) + else if (skip_prefix(key, "cgit.", &name) && trusted_key(name)) cgit_repo_config(current_repo, name, value); return 0; @@ -67,7 +78,8 @@ static int apply_gitconfig(const char *key, const char *value, static void apply_cgitrc(const char *name, const char *value) { - cgit_repo_config(current_repo, name, value); + if (trusted_key(name)) + cgit_repo_config(current_repo, name, value); } static char *find_char_back(char *start, char *from, int c) |