3 files changed, 28 insertions, 25 deletions

diff --git a/source/cgit.c b/source/cgit.c
index 36f3b25..eb13709 100644
--- a/source/cgit.c
+++ b/source/cgit.c
@@ -539,8 +539,8 @@ static void apply_config(const char *name, const char *value)
 		ctx.cfg.enable_header = atoi(value);
 	else if (!strcmp(name, "snapshots"))
 		ctx.cfg.snapshots = cgit_parse_snapshots_mask(value);
-	else if (!strcmp(name, "enable-filter-overrides"))
-		ctx.cfg.enable_filter_overrides = atoi(value);
+	else if (!strcmp(name, "trust-scan-filters"))
+		ctx.cfg.trust_scan_filters = atoi(value);
 	else if (!strcmp(name, "enable-follow-links"))
 		ctx.cfg.enable_follow_links = atoi(value);
 	else if (!strcmp(name, "enable-http-clone"))
@@ -1215,26 +1215,17 @@ void cgit_repo_config(struct cgit_repo *repo, const char *name, const char *valu
 		repo->hide = atoi(value);
 	else if (!strcmp(name, "ignore"))
 		repo->ignore = atoi(value);
-	else if (
-		!strcmp(name, "about-filter")	||
-		!strcmp(name, "commit-filter")	||
-		!strcmp(name, "source-filter")	||
-		!strcmp(name, "email-filter")	||
-		!strcmp(name, "trailer-filter")
-	) {
-		if (!ctx.cfg.enable_filter_overrides)
-			fprintf(stderr, "[cgit] Ignoring repo %s: enable-filter-overrides is not set\n", name);
-		else if (!strcmp(name, "about-filter"))
-			repo->about_filter = cgit_new_filter(value, ABOUT);
-		else if (!strcmp(name, "commit-filter"))
-			repo->commit_filter = cgit_new_filter(value, COMMIT);
-		else if (!strcmp(name, "source-filter"))
-			repo->source_filter = cgit_new_filter(value, SOURCE);
-		else if (!strcmp(name, "email-filter"))
-			repo->email_filter = cgit_new_filter(value, EMAIL);
-		else
-			repo->trailer_filter = cgit_new_filter(value, TRAILER);
-	} else
+	else if (!strcmp(name, "about-filter"))
+		repo->about_filter = cgit_new_filter(value, ABOUT);
+	else if (!strcmp(name, "commit-filter"))
+		repo->commit_filter = cgit_new_filter(value, COMMIT);
+	else if (!strcmp(name, "source-filter"))
+		repo->source_filter = cgit_new_filter(value, SOURCE);
+	else if (!strcmp(name, "email-filter"))
+		repo->email_filter = cgit_new_filter(value, EMAIL);
+	else if (!strcmp(name, "trailer-filter"))
+		repo->trailer_filter = cgit_new_filter(value, TRAILER);
+	else
 		fprintf(stderr, "[cgit] Unknown repo config key: %s\n", name);
 }
 
diff --git a/source/cgit.h b/source/cgit.h
index 5a9e756..72c0844 100644
--- a/source/cgit.h
+++ b/source/cgit.h
@@ -216,7 +216,7 @@ struct cgit_config {
 	int cache_snapshot_ttl;
 	int case_sensitive_sort;
 	int embedded;
-	int enable_filter_overrides;
+	int trust_scan_filters;
 	int enable_follow_links;
 	int enable_gitmodules_links;
 	int enable_header;
diff --git a/source/scan-tree.c b/source/scan-tree.c
index c46b47d..ba2149a 100644
--- a/source/scan-tree.c
+++ b/source/scan-tree.c
@@ -48,6 +48,17 @@ static int is_git_dir(const char *path)
 	return 1;
 }
 
+// A filter is a command cgit runs, and a repository's own files belong to
+// whoever can push to it, so their filter keys wait on trust-scan-filters.
+static int trusted_key(const char *name)
+{
+	if (!ends_with(name, "-filter") || ctx.cfg.trust_scan_filters)
+		return 1;
+	fprintf(stderr, "[cgit] Ignoring %s in %s: trust-scan-filters is not set\n", name,
+		current_repo->path);
+	return 0;
+}
+
 static int apply_gitconfig(const char *key, const char *value,
 		const __attribute__((unused)) struct config_context *cfg_ctx, void *cb)
 {
@@ -59,7 +70,7 @@ static int apply_gitconfig(const char *key, const char *value,
 		cgit_repo_config(current_repo, "desc", value);
 	else if (!strcmp(key, "gitweb.category"))
 		cgit_repo_config(current_repo, "section", value);
-	else if (skip_prefix(key, "cgit.", &name))
+	else if (skip_prefix(key, "cgit.", &name) && trusted_key(name))
 		cgit_repo_config(current_repo, name, value);
 
 	return 0;
@@ -67,7 +78,8 @@ static int apply_gitconfig(const char *key, const char *value,
 
 static void apply_cgitrc(const char *name, const char *value)
 {
-	cgit_repo_config(current_repo, name, value);
+	if (trusted_key(name))
+		cgit_repo_config(current_repo, name, value);
 }
 
 static char *find_char_back(char *start, char *from, int c)