Age	Commit message (Collapse)	Author	Lines
19 hours	Replace a read-only age file without asking	Bryce Kwon	-1/+1
	mv asks before replacing a file it cannot write when stdin is a terminal, and the age hook sends the question to /dev/null. git always gives a hook a pipe, but a hook run by hand from a terminal waited on an answer no one could see and then kept the old date.
20 hours	Drop cached pages asked for with an escaped url	Bryce Kwon	-3/+7
	README tells a visitor to write a plus in the query form as %2b, and cgit caches such a page under the raw query, but the hook compared that query with the url as it stands. A push to foo+bar.git left its pages under url=foo%2bbar.git/ and r=foo%2Bbar.git cached and stale until their ttl ran out. Decoding in sh would take more than the hook is worth, so a query with a % or a + now counts as stale, which costs another repository's page at most a refill.
21 hours	Say what the age hook does with a read-only file	Bryce Kwon	-3/+4
	The header said a file the pusher cannot write stays as it was, but the hook replaces it through mv, which needs only the directory, and with stdin not a terminal mv does so without asking. That is the useful behaviour, so the header now says so, and a test holds the hook to it. Only a directory the pusher cannot write keeps the old file, which was the one case tested.
21 hours	Accept only a local path as the way back in	Bryce Kwon	-8/+12
	is_safe_redirect looked at the first two characters alone, so it accepted https://evil.example/ and javascript:x. Neither could be signed today only because cgit always signs a url that starts with virtual-root, and nothing tested that. A target now has to start with a single slash, which needs virtual-root to be a path for logins to work, as it is by default.
25 hours	Never give two headings the same anchor	Bryce Kwon	-6/+13
	A repeat's count was keyed on the bare text, so a heading whose text already ended in that count took the same anchor, as "Twice 1" did after two of "Twice", and "About 1" after "About". A link to either then landed on the first. The count now goes on up past any anchor already handed out, the way GitHub's slugger does.
37 hours	Fetch avatar icons without a Referer	Bryce Kwon	-2/+10
	The icons came from Gravatar or Libravatar with the page's url as the Referer, so the service learned which repositories and commits each visitor looked at.
38 hours	Cut the lighttpd config down to a generic drop-in	Bryce Kwon	-155/+61
	The old file was a complete lighttpd.conf with its own user, modules and MIME table. As a snippet it takes those from the distribution and loads only the three modules it uses, which lighttpd skips when the main config loads them already. It takes the nginx config's header and commented examples. The host block matches on every socket, so HTTPS needs only the socket, and the redirect is a condition on the scheme inside it. The stock lighttpd.conf on Debian, Alpine and Fedora refuses urls ending in ~ or .inc, so a repository's config.inc answered 403 until the host block cleared the list. git-http-backend's cgi.assign sits outside the url condition because lighttpd checks it after splitting the path, when that condition no longer matches, and inside it the program itself was served as a file.
39 hours	Cut the Apache config down to a generic drop-in	Bryce Kwon	-270/+54
	The old file was a complete httpd.conf that named RHEL's paths and user and loaded its own modules, so on Debian it had to be rewritten before Apache would start. As a virtual host it leaves all of that to the distribution, and it takes the nginx config's header and commented examples. For HTTPS the one virtual host moves to port 443 rather than a second host repeating its routing, and a small host on port 80 sends plain HTTP on to it.
39 hours	Cut the nginx config down to a generic drop-in	Bryce Kwon	-310/+68
	The old file was a complete nginx.conf with TLS, compression, catch-all hosts and security headers, and it had to be taken apart before it ran beside a distribution's own nginx.conf. A server block included from the http block leaves the user, the MIME types and the logs to the distribution. Its header gives one default path per thing, adjusted where a system differs, which leaves packagers a plain base to adapt rather than a table for each distribution. HTTPS and git-http-backend are commented examples, so the file serves plain HTTP as shipped. The backend takes only the three smart HTTP paths at cgit's own repository urls, so every page still reaches cgit. git refuses a repository another user owns, which failed every clone until safe.directory was set for the backend, and a 3 MB push got 413 until the location lifted nginx's body limit. The split empties SCRIPT_NAME because a second SCRIPT_NAME after the include reaches fcgiwrap as well, and cgit reads the first one, which put every link under the request path. cgit sends nosniff and a locked policy on raw output itself, so the configs no longer carry one. The t0004 check that all three agree goes here, with the first of them to drop it.
3 days	Say where the commit-filter applies	Bryce Kwon	-1/+2
3 days	Say that an about page needs a readme line	Bryce Kwon	-3/+5
	Without one a repository has no about tab and its about url redirects to the summary, so a site that sets only about-filter never sees the renderer run.
3 days	Read the login form table as layout	Bryce Kwon	-2/+2
4 days	Say which trailers the shipped filter links	Bryce Kwon	-2/+3
	link-trailers.lua has shipped its Closes and Bug rules commented out since b4e780a, as they need a tracker address, but both docs still promised those links.
5 days	Say to run the cache hook as the web server	Bryce Kwon	-4/+8
	The header asked for write access for the pushing user, but MANUAL.txt keeps the cache root at mode 0700 for the web server and cgit writes its slots at 0600, so a pusher could at best drop every page rather than only its own.
5 days	Suggest a Markdown file for root-readme	Bryce Kwon	-3/+4
5 days	Warn that a repository listed twice shows twice	Bryce Kwon	-0/+2
5 days	Say strict-export applies only to a scan	Bryce Kwon	-1/+1
5 days	State once that cgitrc is read in order	Bryce Kwon	-0/+4
	The rule was written down only under scan-path, so a setting such as enable-blame=1 added at the end of cgitrc silently did nothing.
5 days	List a theme after cgit.css	Bryce Kwon	-3/+5
	Any css or js line replaces the default rather than adding to it, so a theme set with a single css line, as the README implied, left every page unstyled.
6 days	Point the install notes at distribution packages	Bryce Kwon	-72/+81
	Debian, Ubuntu, Fedora and Alpine package luaossl, luaposix and lpeg for the Lua versions they ship, which leaves LuaRocks for the rest. Scintillua comes as a release zip whose lexers directory is what the filter looks for, so its steps say where to put that.
6 days	Name a missing Lua module in the error log	Bryce Kwon	-5/+22
6 days	Log failed logins	Bryce Kwon	-0/+14
	The login posts outside any repository, so the log line names the repository by the page its signed way back leads to.
6 days	Say that logging in needs https	Bryce Kwon	-4/+18
	Only HTTPS=on counts, the same test cgit makes before it writes an https link of its own.
6 days	Tell a signed-in visitor they have no access	Bryce Kwon	-0/+12
6 days	Say when logins are unavailable	Bryce Kwon	-12/+38
	The way back was signed part way through the form, so while the secret's directory did not exist, or a library was missing, cgit's error landed inside the hidden input and the page broke off there with no fields.
6 days	Keep counting across a split ordered list	Bryce Kwon	-1/+8
7 days	Say the auth filters match a repository's url	Bryce Kwon	-13/+22
	A list keyed on the name the index shows matched nothing, so the repository it meant to protect stayed public.
7 days	Say where an edited auth filter belongs	Bryce Kwon	-2/+17
	make install copies every filter into the filters directory with mode 0644, so an edited auth-inline.lua there lost its lists on the next install, which turned every protected repository public, and until then showed its password hashes to every local user.
8 days	Find a capitalised extension's lexer again	Bryce Kwon	-2/+4
	Scintillua's detect() matches an extension by its case, and the fallback e227d1f dropped had lowercased it, so MAIN.C and SETUP.PY lost their colour. The fake lexer now answers only for the suffixes it knows, as Scintillua does, which is what lets the check see it.
8 days	Describe a negative section-from-path in cgitrc	Bryce Kwon	-2/+3
8 days	Spell url in the Lua comments as the docs do	Bryce Kwon	-16/+16
8 days	Say cgit pages carry no expiry, not no headers	Bryce Kwon	-3/+3
	Behind an auth filter every page carries Cache-Control: private and the login page no-store, so only the missing expiry holds on every site.
8 days	Correct two fallbacks the sample config states	Bryce Kwon	-3/+3
	cgit_snapshot_prefix falls back to the basename of the repository url, and print_object sends a binary blob as application/octet-stream.
8 days	Name the pages the highlighter runs on	Bryce Kwon	-1/+1
8 days	Point the source-filter sample at its notes	Bryce Kwon	-3/+2
8 days	Write five compound terms one way in the docs	Bryce Kwon	-2/+2
	Each takes the form its option name or most of the prose already uses, as in case-sensitive-sort and side-by-side-diffs.
8 days	Spell HTML in capitals as most of the docs do	Bryce Kwon	-1/+1
	The head section loses its capitals too, since HEAD elsewhere in the manual is git's.
8 days	Spell url the way the tree mostly does	Bryce Kwon	-14/+14
	Names keep their own spelling, so the URL trailer and CGIT_REPO_URL stay in capitals.
9 days	Spell non-zero the way the tree does	Bryce Kwon	-3/+3
9 days	Say the highlighter needs Scintillua's detect()	Bryce Kwon	-1/+2
9 days	Catch a lexer's failure in one place	Bryce Kwon	-12/+9
	filter_close already runs highlight under pcall and serves the escaped text when it fails, so the pcalls around detect, load and lex inside it only turned a raise into the same fallback a step earlier.
9 days	Write a session's expiry in whole seconds	Bryce Kwon	-0/+10
	On Lua 5.3 and later a length worked out with a fraction, such as 1.5 * 24 * 60 * 60, is a float, so the signed expiry came out as 1793609024.0, which validate_value refuses, and every login failed. Max-Age took the same .0, which makes a browser ignore it.
9 days	Collect an email filter's writes like the others	Bryce Kwon	-10/+12
9 days	Say what really differs between the auth filters	Bryce Kwon	-6/+8
	The lookups were never the only difference, since the configuration and trim's place differ as well. The configuration is now set off by blank lines, as in the other extensions, instead of a heading.
9 days	Drop auth guards for input cgit never sends	Bryce Kwon	-18/+6
	cgit passes an empty string, never nil, when a request names no repository, so the check that the index stays up proved nothing, and auth-file in fact refuses the index too while its repos file cannot be read. A session_seconds of 0 signs a session that has expired by the time it comes back, so it needs no branch of its own in set_cookie.
9 days	Strip control characters from the location alone	Bryce Kwon	-18/+12
	set_cookie only ever writes an empty value or a token secure_value built from url-encoded text, digits and hex, so stripping it changed nothing.
9 days	Drop the URL helpers' guards that cannot fire	Bryce Kwon	-18/+2
	Every caller hands the helpers a string, and a value with a line break is refused by validate_value whether or not CR LF is folded on the way.
9 days	Keep only the request fields the auth filters read	Bryce Kwon	-42/+10
	Seven of the twelve fields filter_open stored were never read. Naming all twelve parameters keeps the order cgit passes them in on record.
9 days	Take a signed cookie apart with one match	Bryce Kwon	-82/+10
	The loop let a valid cookie through with a field appended, a doubled separator or a zero in front of its expiry. The payload now carries the expiry as written, so only the spelling secure_value issues verifies.
9 days	Drop the highlighter's extension fallback	Bryce Kwon	-47/+8
	The table of extensions and the second lookup served only a Scintillua with no detect(), which now leaves every file uncoloured but escaped. The fake detect() names a lexer after the file's suffix, so every test lexer is reached through it.