AgeCommit message (Collapse)AuthorLines
Gate scanned filters with trust-scan-filtersBryce Kwon-22/+13
Apply the mailmap at HEAD to every identBryce Kwon-0/+6
Split trailers out of the commit messageBryce Kwon-2/+14
Clean up the whole treeBryce Kwon-56/+47
Trim the comments and dead code across the treeBryce Kwon-54/+37
Report ignored config keys on stderrBryce Kwon-4/+12
Rename the inconsistent config keysBryce Kwon-23/+25
The old spellings are no longer read. enable-header and enable-plain-email take the opposite value of the noheader and noplainemail they replace.
Fold enable-stats back into max-statsBryce Kwon-6/+0
A max-stats period enables the page again, as it did before v2.2.0, so one key does both jobs.
Use standard HTTP reason phrasesBryce Kwon-5/+5
Resolve submodule links from .gitmodulesBryce Kwon-0/+5
Log scan lock failures that are not contentionBryce Kwon-1/+6
Give up a scan or slot whose lock file was renamedBryce Kwon-0/+13
Let a crashed scan's lock expire with its processBryce Kwon-9/+40
Cache id-pinned pages and snapshots as staticBryce Kwon-3/+27
Keep error pages out of the cacheBryce Kwon-3/+2
Drop the Last-Modified, Expires and ETag headersBryce Kwon-11/+0
Remove the repository homepage featureBryce Kwon-4/+0
Restyle the sources and fix the audit's findingsBryce Kwon-843/+918
Bound the search and cache key a request can askBryce Kwon-1/+8
Gather page output into one bufferBryce Kwon-0/+3
Settle the names, types and layout of the sourcesBryce Kwon-59/+59
Isolate the git environment without a constructorBryce Kwon-8/+13
Update the bundled Git to 2.55.0Bryce Kwon-1/+1
Give empty repositories their own pageBryce Kwon-18/+7
Add enable-relative-dates and date-formatBryce Kwon-0/+6
Drop the help tab and its built-in guideBryce Kwon-3/+0
Swap the browser markdown renderer for a filterBryce Kwon-3/+0
The readme is now escaped plain text unless about-filter points at the new about-render.lua, which renders markdown, man pages and plain text server-side. The enable-markdown setting goes away with the renderer.
Add max-patch-count to bound the patch viewBryce Kwon-0/+3
Gate the stats page and add a language breakdownBryce Kwon-0/+6
The max-stats setting now only bounds the selectable periods and no longer doubles as the enable switch. The tree walk runs before the history walk on purpose. Releasing commit memory while walking history resets each commit slab index, and a commit graph lookup afterwards would read another commit slot and walk the wrong tree. The stats fixture writes a commit graph so the tests cover that path. The history walk bounds the window in process rather than passing a formatted since date to setup_revisions, and parses each commit once.
Remove the owner filter hookBryce Kwon-6/+0
Stat oversized diffs instead of inlining themBryce Kwon-0/+6
Cap and paginate the ref listingsBryce Kwon-0/+3
Add a help page with common workflowsBryce Kwon-0/+3
Point the fork's links and credits at itselfBryce Kwon-2/+2
AUTHORS now records the upstream developers as the project's history rather than as maintainers of the fork.
Drop unused config and query fieldsBryce Kwon-4/+0
Key the cache on scheme and hostBryce Kwon-2/+15
Clone urls and atom links are built from the request scheme and Host, but the cache key left them out, so a request with a spoofed Host could cache a page carrying a bogus clone url and serve it to other visitors.
Bound the authenticate-post length safelyBryce Kwon-3/+4
The POST length was clamped with a signed comparison, so a very large Content-Length could turn negative and slip past the limit into the fixed-size buffer.
Respect the cgitrc order of sectionsBryce Kwon-1/+1
The default sorted the sections and the repositories within them by name, so the order written in the cgitrc file was ignored.
Keep snapshots working under a global git configBryce Kwon-1/+7
cgit unsets HOME to isolate git from the calling user, but git still finds the global config through its getpwuid fallback and then dies expanding a ~ in core.excludesfile. That die happened after the snapshot headers and the gzip filter were already in place, so the error page was compressed into the archive and every snapshot failed to decompress.
Clamp the log offset to bound history walksBryce Kwon-1/+11
A crafted ofs value could send cgit walking most of the history for one request.
Check max-blob-size up front and default to 10 MBBryce Kwon-1/+1
Only the tree view honoured the limit, and only after loading the whole object. The default moves from unlimited to 10 MB so a fresh install never buffers a huge object whole. Zero still turns the limit off.
Render README markdown in the browserBryce Kwon-0/+3
cgit had no markdown support of its own, so a readme was rendered through an external python filter or not at all. Escaping the source and formatting it in cgit.js keeps the work in the browser like the blob highlighter, and the page stays readable as plain text without scripting.
Add enable-tree-group-dirs to list dirs firstBryce Kwon-0/+2
Gate the cache listing behind enable-cache-listBryce Kwon-0/+2
The ls_cache page printed the cache directory path and the urls other visitors had requested, with no gate at all.
Reorganise into source, assets and librariesBryce Kwon-0/+0
Everything the build generates now lands in build/, so a clean is a single remove and the source tree stays free of build output.
cgit: truncate all config values at the newlineJason A. Donenfeld-50/+40
These would be largely invalid anyway (save, I suppose, for Linux file paths that technically can contain new lines). The actual problem is that these get printed back out into cached -- and trusted -- cgitrc files, and if the fields have newlines, the git-config way of less trusted users configuring repos on a shared system can be abused to inject newlines, which then can be used to smuggle global options (including filters, which execute code) into the cached cgitrc. So now, only ever duplicate up to the newline, when dealing with these inputs. Reported-by: Adrian Denkiewicz <adrian@doyensec.com> Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
cgit: use strchrnul instead of open codingJason A. Donenfeld-3/+1
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
cgit: devirtualize repo_configJason A. Donenfeld-10/+9
There's no reason to pass around function pointers. It was never used for anything beyond one function. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
cgit: override die routine globallyJason A. Donenfeld-0/+7
We don't get any return value from compile_grep_patterns calling compile_regexp_failed, causing the default die routine to print to stderr and then for cgit to exit ungracefully. Instead override the default die routine to show a normal error page. Perhaps compile_grep_patterns ought to change upstream to return an error. But this commit here will handle future issues as well, so perhaps not a bad idea to do anyway. Link: https://lists.zx2c4.com/pipermail/cgit/2026-March/004982.html Link: https://lists.zx2c4.com/pipermail/cgit/2026-March/004983.html Reported-by: Adrian C. <anrxc@sysphere.org> Reported-by: Aiden Woodruff <aiden@aidenw.net> Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
ui-log: allow link following to be disabled per-repoJason A. Donenfeld-0/+4
This exists for other CPU heavy operations like blame, but doesn't for the follow functionality. Add it for that. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
Copyright © 2026 Bryce Kwon. All Rights Deprecated.