Age	Commit message (Collapse)	Author	Lines
21 hours	Accept only a local path as the way back in	Bryce Kwon	-8/+12
	is_safe_redirect looked at the first two characters alone, so it accepted https://evil.example/ and javascript:x. Neither could be signed today only because cgit always signs a url that starts with virtual-root, and nothing tested that. A target now has to start with a single slash, which needs virtual-root to be a path for logins to work, as it is by default.
25 hours	Never give two headings the same anchor	Bryce Kwon	-6/+13
	A repeat's count was keyed on the bare text, so a heading whose text already ended in that count took the same anchor, as "Twice 1" did after two of "Twice", and "About 1" after "About". A link to either then landed on the first. The count now goes on up past any anchor already handed out, the way GitHub's slugger does.
37 hours	Fetch avatar icons without a Referer	Bryce Kwon	-2/+10
	The icons came from Gravatar or Libravatar with the page's url as the Referer, so the service learned which repositories and commits each visitor looked at.
3 days	Say that an about page needs a readme line	Bryce Kwon	-1/+2
	Without one a repository has no about tab and its about url redirects to the summary, so a site that sets only about-filter never sees the renderer run.
3 days	Read the login form table as layout	Bryce Kwon	-2/+2
6 days	Point the install notes at distribution packages	Bryce Kwon	-72/+81
	Debian, Ubuntu, Fedora and Alpine package luaossl, luaposix and lpeg for the Lua versions they ship, which leaves LuaRocks for the rest. Scintillua comes as a release zip whose lexers directory is what the filter looks for, so its steps say where to put that.
6 days	Name a missing Lua module in the error log	Bryce Kwon	-5/+22
6 days	Log failed logins	Bryce Kwon	-0/+14
	The login posts outside any repository, so the log line names the repository by the page its signed way back leads to.
6 days	Say that logging in needs https	Bryce Kwon	-4/+18
	Only HTTPS=on counts, the same test cgit makes before it writes an https link of its own.
6 days	Tell a signed-in visitor they have no access	Bryce Kwon	-0/+12
6 days	Say when logins are unavailable	Bryce Kwon	-12/+38
	The way back was signed part way through the form, so while the secret's directory did not exist, or a library was missing, cgit's error landed inside the hidden input and the page broke off there with no fields.
6 days	Keep counting across a split ordered list	Bryce Kwon	-1/+8
7 days	Say the auth filters match a repository's url	Bryce Kwon	-9/+17
	A list keyed on the name the index shows matched nothing, so the repository it meant to protect stayed public.
7 days	Say where an edited auth filter belongs	Bryce Kwon	-0/+12
	make install copies every filter into the filters directory with mode 0644, so an edited auth-inline.lua there lost its lists on the next install, which turned every protected repository public, and until then showed its password hashes to every local user.
8 days	Find a capitalised extension's lexer again	Bryce Kwon	-2/+4
	Scintillua's detect() matches an extension by its case, and the fallback e227d1f dropped had lowercased it, so MAIN.C and SETUP.PY lost their colour. The fake lexer now answers only for the suffixes it knows, as Scintillua does, which is what lets the check see it.
8 days	Spell url in the Lua comments as the docs do	Bryce Kwon	-16/+16
8 days	Name the pages the highlighter runs on	Bryce Kwon	-1/+1
9 days	Say the highlighter needs Scintillua's detect()	Bryce Kwon	-1/+2
9 days	Catch a lexer's failure in one place	Bryce Kwon	-12/+9
	filter_close already runs highlight under pcall and serves the escaped text when it fails, so the pcalls around detect, load and lex inside it only turned a raise into the same fallback a step earlier.
9 days	Write a session's expiry in whole seconds	Bryce Kwon	-0/+10
	On Lua 5.3 and later a length worked out with a fraction, such as 1.5 * 24 * 60 * 60, is a float, so the signed expiry came out as 1793609024.0, which validate_value refuses, and every login failed. Max-Age took the same .0, which makes a browser ignore it.
9 days	Collect an email filter's writes like the others	Bryce Kwon	-10/+12
9 days	Say what really differs between the auth filters	Bryce Kwon	-6/+8
	The lookups were never the only difference, since the configuration and trim's place differ as well. The configuration is now set off by blank lines, as in the other extensions, instead of a heading.
9 days	Drop auth guards for input cgit never sends	Bryce Kwon	-18/+6
	cgit passes an empty string, never nil, when a request names no repository, so the check that the index stays up proved nothing, and auth-file in fact refuses the index too while its repos file cannot be read. A session_seconds of 0 signs a session that has expired by the time it comes back, so it needs no branch of its own in set_cookie.
9 days	Strip control characters from the location alone	Bryce Kwon	-18/+12
	set_cookie only ever writes an empty value or a token secure_value built from url-encoded text, digits and hex, so stripping it changed nothing.
9 days	Drop the URL helpers' guards that cannot fire	Bryce Kwon	-18/+2
	Every caller hands the helpers a string, and a value with a line break is refused by validate_value whether or not CR LF is folded on the way.
9 days	Keep only the request fields the auth filters read	Bryce Kwon	-42/+10
	Seven of the twelve fields filter_open stored were never read. Naming all twelve parameters keeps the order cgit passes them in on record.
9 days	Take a signed cookie apart with one match	Bryce Kwon	-82/+10
	The loop let a valid cookie through with a field appended, a doubled separator or a zero in front of its expiry. The payload now carries the expiry as written, so only the spelling secure_value issues verifies.
9 days	Drop the highlighter's extension fallback	Bryce Kwon	-47/+8
	The table of extensions and the second lookup served only a Scintillua with no detect(), which now leaves every file uncoloured but escaped. The fake detect() names a lexer after the file's suffix, so every test lexer is reached through it.
9 days	Call string.match like the rest of the highlighter	Bryce Kwon	-1/+1
9 days	Carry a man page's text as plain strings	Bryce Kwon	-23/+16
	lpeg's constant, query and numbered captures already do what the token helpers did, and nothing ever read the tokens of an escape that draws nothing.
9 days	Take a no fill line's plain text from its nodes	Bryce Kwon	-7/+1
9 days	Wrap a man page's font runs as the macros do	Bryce Kwon	-27/+11
9 days	Reuse the digit pattern where it is spelt out	Bryce Kwon	-2/+2
9 days	Build the block start test from the line grammars	Bryce Kwon	-2/+1
9 days	Count a rule among the blocks that end a paragraph	Bryce Kwon	-7/+4
9 days	Inline the list check before indented code	Bryce Kwon	-6/+2
9 days	Read a setext heading's level off its capture	Bryce Kwon	-10/+4
9 days	Build every code block in one place	Bryce Kwon	-17/+11
9 days	Replace a readme's NUL bytes in one substitution	Bryce Kwon	-19/+3
9 days	Let the dispatch serve markdown without lpeg	Bryce Kwon	-5/+0
	Without lpeg both renderers stay nil, and the handler lookup already falls back to plain text for a format it has no renderer for.
9 days	Render markdown and man pages through one function	Bryce Kwon	-28/+18
	Everything that can raise already runs inside the parse and emit pcalls, so the outer one in filter_close could only ever have sent the page a second time.
9 days	Drop three needless forward declarations	Bryce Kwon	-9/+3
9 days	Drop fallbacks for a match that cannot fail	Bryce Kwon	-3/+3
	A table capture of a pattern repeated zero or more times matches every string, the empty one included, so the inline grammars never return nil.
9 days	Drop the readme hooks that nothing reads	Bryce Kwon	-14/+7
	Nothing in assets/ or in README's list of hooks reads a fenced block's data-lang or the manpage class on a man page's wrapper.
12 days	Render the man pages that generators write	Bryce Kwon	-52/+188
	DocBook, pod2man and hand written pages leaked roff onto the page. Font escapes inside no fill blocks, comments, layout escapes such as \% and \c, the colours and half line moves around DocBook's links, and the requests and macro definitions their preambles open with all showed through. Those now draw nothing, the common named characters and strings render, .EX and pod2man's .Vb read as code, a .TP tag takes a line of its own and the alternating font macros switch fonts between their arguments. Anything rarer still falls back to its text.
12 days	Render more of the markdown seen in readmes	Bryce Kwon	-19/+105
	A line of equals signs or dashes under a paragraph now makes a heading of it, as on GitHub, instead of running into its text, and any other rule ends the paragraph. Four spaces or a tab start a code block, and an escaped pipe stays in its table cell. A link opening with two slashes or backslashes in any mix leads to another site, so it renders as text like the plain scheme relative one already did.
12 days	Keep a readme whole past a NUL byte	Bryce Kwon	-2/+20
	cgit takes filter output through a C string sink that stops at the first NUL, so a readme holding one lost everything after it. Each NUL now shows as U+FFFD, as a browser would show it.
2026-10-24	Say when a login fails, and line up the form	Bryce Kwon	-16/+44
	A wrong password sent the reader back to the same empty form, which looked no different from a crash. The redirect now carries a flag the form reads, the same for an unknown user as for a wrong password, and the form leaves the flag out of the way back it signs.
2026-10-24	Colour css properties and pseudo-classes	Bryce Kwon	-14/+17
	Scintillua's css lexer tags them with names the map had no row for, so they came out as plain text.
2026-10-22	Escape the same characters in the highlighter	Bryce Kwon	-6/+39
	A lexer may hand back the bytes of one separator, or the CR and LF of a line ending, in different tokens, so line endings become line feeds before lexing and the separators are escaped once the tokens are joined.