Diff options
Diffstat (limited to 'CHANGE.txt')
| -rw-r--r-- | CHANGE.txt | 62 |
1 file changed, 62 insertions, 0 deletions
@@ -5,6 +5,68 @@ Notable changes to this fork, newest release first. History before v2.0.0 belongs to upstream cgit and is not covered here. +v2.12.1 (2026-11-08) +-------------------- + +A testing and hardening release. The test suite now fails a page that breaks +instead of passing anything that does not crash, the mailmap is held to +max-blob-size, and a review of the tests closed the bugs it found, from a +followed diff that took in small.cpp with small.c to clone urls split in two at +a space. Logins now need virtual-root to be a path, so read the upgrade note +under Changed before deploying. + +Added +..... + +* make test runs every script and ends on one summary line for the whole run, + rather than stopping at the first script that fails, and README says how to + run the tests. +* CGIT_TEST_REQUIRE names prerequisites a run must not skip, so a release run + fails where a tool it relies on is missing. +* tools/build-release.sh passes further arguments on to make, so its binary can + be tested as built and a Lua that pkg-config cannot find can be named for it. + +Changed +....... + +* Upgrade note: the auth filters send a visitor back only to a target that + starts with a single slash, so logins need virtual-root to be a path, as it is + by default. +* The tests check the status, the error log and the end of each page they + request, and the tests that could not fail as written now can. +* MANUAL says the message and description limits count bytes and names the notes + and .gitmodules as read whole. + +Fixed +..... + +* The auth filters' redirect check looked at the first two characters alone, so + it accepted https://evil.example/ and javascript:x. That was safe only because + cgit signs no url outside virtual-root. +* A mailmap was read whole on every page, so a pusher could make every page of a + repository read as much as they liked. It is now held to max-blob-size. +* A followed diff took in every path that began with the one asked for, so + following small.c also showed small.cpp. Whatever path was given, its + diffstat header read (limited to ''). +* A repository url with a space in it was listed as two clone urls, and the + links of clone urls and submodules carried spaces and bytes past ASCII + unencoded. +* The plain, snapshot and blob pages sent a download name past ASCII raw, which + a client may read as ISO-8859-1. It now also goes as filename*, + percent-encoded in UTF-8. +* about-render gave a heading such as "Twice 1" the same anchor as the second of + two headings "Twice", so a link to the later one landed on the earlier. +* The index page came out short for a negative offset. +* A directory named as a cgitrc or include was refused only when reading it + failed, which not every system guarantees. +* A max-stats value that names no period turned the statistics page off without + a warning. +* The cache hook left pages asked for with an escaped url, such as + url=foo%2bbar.git/, cached and stale until their ttl ran out. +* The age hook, run by hand from a terminal, waited on a question no one could + see and then kept the old date. + + v2.12.0 (2026-11-07) -------------------- |