| Age | Commit message (Collapse) | Author | Lines |
|
Behind an auth filter every page carries Cache-Control: private and the
login page no-store, so only the missing expiry holds on every site.
|
|
Names keep their own spelling, so the URL trailer and CGIT_REPO_URL
stay in capitals.
|
|
|
|
|
|
Each config listed every header cgit sends, where only its own nosniff
and strict policy on raw bytes bear on the headers set there. The list
also missed Vary, and the Apache one called Apache a proxy.
|
|
The nginx sub-path recipe moved only the stylesheet and the logo, and
left the script and the icon pointing at the domain root.
|
|
Each release named is the one its project's own site listed as current
on 2026-10-29.
|
|
Only the login page carried a Cache-Control, so a page an auth filter
had let a visitor see could be kept by a cache shared with the next
visitor. The page also varies on the cookie that got them in.
|
|
|
|
style-src allowed inline styles only for the diffstat bars, which take
their width from colspan instead. t0004 now checks that the three
configs pin the same policy.
|
|
|
|
|
|
|
|
|