AgeCommit message (Collapse)AuthorLines
Keep the version numbers off the pagesHEADmainBryce Kwon-7/+3
The generator meta, the footer and the patch signature named the exact cgit and git versions on every response, which only helps someone matching a site against an advisory. The shipped server configs already hide the server's own version for the same reason, and `cgit --version` still answers on the host.
Mark a page behind an auth filter privateBryce Kwon-0/+5
Only the login page carried a Cache-Control, so a page an auth filter had let a visitor see could be kept by a cache shared with the next visitor. The page also varies on the cookie that got them in.
Send a charset only with a text typeBryce Kwon-1/+12
Archives, packs and the HEAD file went out as octet-stream or gzip with a UTF-8 charset on the end, since only the blob page cleared it. The headers now decide from the type itself, so the two places that cleared the charset by hand no longer need to.
Leave a branch spelled like an option out of the switcherBryce Kwon-0/+4
Such a name is refused as a head before git could read it as an option, and the fallback branch already skips it, so the switcher offered a choice that led only to an error page.
Keep the query string across the about redirectsBryce Kwon-6/+15
The hop to the trailing-slash form of the about page, and the hop back to the summary of a repository without a readme, were built from the path alone, so a request for the about page of another branch landed on the default one. The query goes into the Location line as the client sent it, with any byte a header cannot carry percent-encoded.
Add stable markup hooks for site themesBryce Kwon-14/+37
Align with spaces instead of tabsBryce Kwon-3/+3
Harden the page renderersBryce Kwon-65/+122
Name the tagged object under its full idBryce Kwon-5/+9
Settle the snapshot v-prefix from the tag listBryce Kwon-8/+35
`compose_snapshot_prefix` dropped the leading v of a tag only when just one of the names 1.2, v1.2 and V1.2 resolved as a tag, so that the shorter snapshot name could always be traced back to one tag. Those probes went through ref lookups, and on a case-insensitive filesystem a lookup for V1.2 finds the loose file of v1.2, so every freshly made tag counted as ambiguous and kept its v. Once git packed the refs the lookups became exact and the same tag quietly changed its snapshot names. The claimants on a stripped name are now counted over the tag list itself with exact string comparison, so the answer no longer depends on how a ref is stored or on the filesystem underneath. Two tags that really differ only by the letter's case still both keep it.
Clean up the whole treeBryce Kwon-198/+120
Trim the comments and dead code across the treeBryce Kwon-17/+19
Remove the auto-submitting selectsBryce Kwon-1/+1
Remove the theme toggleBryce Kwon-2/+0
Rename the inconsistent config keysBryce Kwon-3/+3
noplainemail enable-plain-email noheader enable-header cache-root-ttl cache-index-ttl cache-repo-ttl cache-summary-ttl cache-scanrc-ttl cache-scan-ttl agefile age-file renamelimit rename-limit extra-head-content head-content
Fold `enable-stats` back into `max-stats`Bryce Kwon-1/+1
A `max-stats` period enables the page again, as it did before v2.2.0, so one key does both jobs.
Point clone rows at a url a browser can followBryce Kwon-0/+69
Keep a detached head in the branch switcherBryce Kwon-0/+41
Add a meta description to the page headBryce Kwon-0/+12
Use standard HTTP reason phrasesBryce Kwon-1/+1
Spell the charset UTF-8 everywhereBryce Kwon-1/+1
Drop the wall clock from the page footerBryce Kwon-3/+2
Replace non-ASCII output glyphs with ASCIIBryce Kwon-3/+2
Resolve submodule links from `.gitmodules`Bryce Kwon-6/+244
Fix the submodule rows in the tree listingBryce Kwon-13/+17
A submodule row linked to a path with its trailing slash stripped, was labelled by its path rather than its entry name, shared the name's element with its hash, claimed a size of zero and offered a blame button that cannot work on a gitlink.
Keep error pages out of the cacheBryce Kwon-0/+6
Show a pinned commit in the switcher, title, crumbsBryce Kwon-18/+110
Always send the Status headerBryce Kwon-0/+4
Print the raw-content headers with the restBryce Kwon-0/+7
Drop the Last-Modified, Expires and ETag headersBryce Kwon-19/+0
Tidy the structure of the generated markupBryce Kwon-9/+9
Wrap the dates in time elementsBryce Kwon-3/+12
Drop the XHTML slashes and boolean spellingsBryce Kwon-6/+6
Modernize the document headBryce Kwon-14/+19
Fix ampersand handling in generated urlsBryce Kwon-1/+3
Remove the repository homepage featureBryce Kwon-5/+0
Restyle the sources and fix the audit's findingsBryce Kwon-728/+763
Gather page output into one bufferBryce Kwon-0/+4
Expand `module-link` placeholders outside printfBryce Kwon-2/+40
Settle the names, types and layout of the sourcesBryce Kwon-33/+35
Give empty repositories their own pageBryce Kwon-2/+12
Add `enable-relative-dates` and `date-format`Bryce Kwon-6/+25
Drop the help tab and its built-in guideBryce Kwon-6/+0
Cap the header branch switcherBryce Kwon-2/+9
Backfill an absent commit messageBryce Kwon-1/+1
Emit a conforming `rel=icon` for the favicon linkBryce Kwon-1/+1
Gate the stats page and add a language breakdownBryce Kwon-1/+1
`max-stats` only bounds the selectable periods now and no longer doubles as the enable switch. The tree walk runs before the history walk on purpose. Releasing commit memory while walking history resets each commit slab index, and a commit graph lookup afterwards would read another commit slot and walk the wrong tree. The stats fixture writes a commit graph so the tests cover that path. The history walk bounds the window in process rather than passing a formatted since date to `setup_revisions`, and parses each commit once.
Remove the owner filter hookBryce Kwon-7/+1
Add a help page with common workflowsBryce Kwon-0/+6
Submit option forms without inline handlersBryce Kwon-1/+1
Copyright © 2026 Bryce Kwon. All Rights Deprecated.