Age	Commit message (Collapse)	Author	Lines
2026-07-31	Reorganise the tree into vendor/ and custom/	Bryce Kwon	-528/+0
2026-07-24	Harden and reorganise the auth filters	Bryce Kwon	-147/+322
2026-07-16	Harden the auth filter headers and session cookie	Bryce Kwon	-5/+31
	The filters signed the request url and later wrote it into a Location header, and the signing step re-encoded a newline that the verifying step decoded back, so a crafted url could smuggle CR and LF into the response. The cookie HMAC was also checked with a short-circuiting comparison, and the cookie carried no SameSite attribute.
2026-07-16	Prune and rename the filter extensions	Bryce Kwon	-2/+15
	The Gentoo LDAP filter is distro specific, the owner example only restates what cgit already renders, and the about converters are superseded by the built-in markdown rendering. The two auth filters do the same job and differ only in where their accounts live, so they become auth-inline for accounts kept in the script and auth-file for accounts kept on disk.