AgeCommit message (Collapse)AuthorLines
Show characters a browser breaks at as escapesBryce Kwon-0/+13
The HTML parser turns a carriage return with no line feed after it into a line feed, and WebKit starts a new line at U+2028 and U+2029, while git and the line numbers count line feeds alone, so each one set every later line of the tree and blame pages a line below its number. CSS Text makes vertical tab, form feed and next line forced breaks as well, though no engine honours that yet. The escapes follow gitweb, which shows control characters the same way.
Cut text between characters, never inside oneBryce Kwon-2/+3
The index description was cut at a byte count, which could split a multibyte character and leave an invalid sequence on the page. Commit subjects already backed up to the start of the character, so html_ntxt now does that for every caller.
Encode repository urls and the feed branchBryce Kwon-0/+8
Links built from the repository url, among them the description link on the index and the Atom and refs links, wrote it as configured, so a name holding a space, '#' or '?' broke them. The feed link in the page head did the same with the branch, which turned a '+' into a space.
Keep the error of a request that dies mid captureBryce Kwon-1/+2
The commit and diff pages collect each file's body before printing it, and a die in git while one was collected wrote the error page into that body, which was never sent, so the visitor got a page cut off mid table.
Keep the query string across the about redirectsBryce Kwon-0/+1
The hop to the trailing-slash form of the about page, and the hop back to the summary of a repository without a readme, were built from the path alone, so a request for the about page of another branch landed on the default one. The query goes into the Location line as the client sent it, with any byte a header cannot carry percent-encoded.
Harden the request path, scan and error recoveryBryce Kwon-4/+8
Clean up the whole treeBryce Kwon-7/+3
Trim the comments and dead code across the treeBryce Kwon-2/+2
Restyle the sources and fix the audit's findingsBryce Kwon-20/+50
Render each diff body while its file is openBryce Kwon-0/+5
Gather page output into one bufferBryce Kwon-0/+4
Emit generated runs in batches, not a write eachBryce Kwon-0/+7
Reorganize into source, assets and librariesBryce Kwon-0/+0
The C sources move to source/, the served files to assets/, the bundled Git submodule to libraries/git and the filter scripts to extensions/. Everything the build generates now lands in build/, so a clean is a single remove and the tree stays clean.
html: html_ntxt with no ellipsisJeff Smith-1/+1
For implementing a ui-blame page, there is need for a function that outputs a selection from a block of text, transformed for HTML output, but with no further modifications or additions. Signed-off-by: Jeff Smith <whydoubt@gmail.com> Reviewed-by: John Keeping <john@keeping.me.uk>
Simplify http_parse_querystring()Lukas Fleischer-1/+1
Instead of reimplementing URL parameter parsing from scratch, use url_decode_parameter_name() and url_decode_parameter_value() which are already provided by Git. Also, change the return type of http_parse_querystring() to void since its only caller already ignores the return value. Signed-off-by: Lukas Fleischer <lfleischer@lfos.de>
ui-shared: prevent malicious filename from injecting headersJason A. Donenfeld-0/+1
html: remove html_status()John Keeping-1/+0
This is now unused. Signed-off-by: John Keeping <john@keeping.me.uk>
html.c: add various strbuf and varadic helpersJohn Keeping-1/+10
This adds the fmtalloc helper, html_txtf, html_vtxtf, and html_attrf. These takes a printf style format string like htmlf but escapes the resulting string. The html_vtxtf variant takes a va_list whereas html_txtf is variadic. Signed-off-by: John Keeping <john@keeping.me.uk>
Always #include corresponding .h in .c filesJohn Keeping-1/+1
While doing this, remove declarations from header files where the corresponding definition is declared "static" in order to avoid build errors. Also re-order existing headers in ui-*.c so that the file-specific header always comes immediately after "cgit.h", helping with future consistency. Signed-off-by: John Keeping <john@keeping.me.uk>
html.c: add html_intoption()Lars Hjemli-0/+1
This is similar to html_option, but for int values. Signed-off-by: Lars Hjemli <hjemli@gmail.com>
use __attribute__ to catch printf format mistakesMark Lodato-0/+3
Use "__attribute__((format (printf,N,M)))", as is done in git, do catch mistakes in printf-style format strings. Signed-off-by: Mark Lodato <lodatom@gmail.com>
html: make all strings 'const char *'Mark Lodato-9/+9
None of the html_* functions modify their argument, so they can all be 'const char *' instead of a simple 'char *'. This removes the need to cast (or copy) when trying to print a const string. Signed-off-by: Mark Lodato <lodatom@gmail.com>
html.c: add html_url_pathLars Hjemli-0/+1
This function can be used to generate properly escaped path-components for links. Signed-off-by: Lars Hjemli <hjemli@gmail.com>
html.c: add html_url_argLars Hjemli-0/+1
This function can be used to properly escape querystring parameter values. Signed-off-by: Lars Hjemli <hjemli@gmail.com>
Supply status description to html_status()Lars Hjemli-1/+1
Signed-off-by: Lars Hjemli <hjemli@gmail.com>
Implement plain viewLars Hjemli-0/+1
This implements a way to access plain blobs by path (similar to the tree view) instead of by sha1. Signed-off-by: Lars Hjemli <hjemli@gmail.com>
Add support for cloning over httpLars Hjemli-0/+1
This patch implements basic support for cloning over http, based on the work on git-http-backend by Shawn O. Pearce. Signed-off-by: Lars Hjemli <hjemli@gmail.com>
Move cgit_parse_query() from parsing.c to html.c as http_parse_querystring()Lars Hjemli-0/+2
This is a generic http-function. Signed-off-by: Lars Hjemli <hjemli@gmail.com>
Introduce html.hLars Hjemli-0/+18
All html-functions can be quite easily separated from the rest of cgit, so lets do it; the only issue was html_filemode which uses some git-defined macros so the function is moved into ui-shared.c::cgit_print_filemode(). Signed-off-by: Lars Hjemli <hjemli@gmail.com>