| Age | Commit message (Collapse) | Author | Lines |
|
|
|
|
|
AUTHORS now records the upstream developers as the project's history
rather than as maintainers of the fork.
|
|
The log page passed the `id` query parameter to git's revision parser
without resolving it and ahead of the end-of-options marker. A value
like `id=--output=/path` was then parsed as an option, so an
unauthenticated request could create or truncate any file the server
user could write. No valid ref or object name begins with a dash.
|
|
A plain char is undefined in the ctype functions for negative values,
which a high byte produces wherever char is signed.
|
|
The C sources move to source/, the served files to assets/, the bundled
Git submodule to libraries/git and the filter scripts to extensions/.
Everything the build generates now lands in build/, so a clean is a
single remove and the tree stays clean.
|