AgeCommit message (Collapse)AuthorLines
Drop the help tab and its built-in guideBryce Kwon-120/+0
Add `CGIT_EXTRA_CFLAGS` for cgit-only build flagsBryce Kwon-0/+4
Reorganize the tree into vendor/ and custom/Bryce Kwon-4/+4
Replace the browser markdown renderer with a filterBryce Kwon-34/+4
The readme is now escaped plain text unless `about-filter` points at the new `about-render.lua`, which renders markdown, man pages and plain text server-side. `enable-markdown` goes away with the renderer.
Skip a malformed config lineBryce Kwon-24/+34
Bound the cache listing key outputBryce Kwon-2/+9
Prune the stats walk and guard its datesBryce Kwon-1/+9
Keep zstd snapshots single-threadedBryce Kwon-1/+3
Add `max-patch-count` to bound the patch viewBryce Kwon-0/+9
Cap the header branch switcherBryce Kwon-2/+9
Backfill an absent commit messageBryce Kwon-8/+14
Stream the tree line numbers instead of bufferingBryce Kwon-5/+2
Apply the diff size caps under followBryce Kwon-7/+9
Cap diff blobs by `max-blob-size`Bryce Kwon-3/+22
The diff family inflated a blob of any size just to render it. A file over the limit is reported as binary instead.
Skip a ref whose object cannot be parsedBryce Kwon-1/+7
A dangling or unreadable ref was described through a null object.
Percent-encode file paths in side-by-side diffsBryce Kwon-2/+16
Reorganize and simplify the MakefileBryce Kwon-25/+30
Emit a conforming `rel=icon` for the favicon linkBryce Kwon-1/+1
Build the sources with `-fno-common`Bryce Kwon-0/+7
Apple clang still defaults to `-fcommon`, so git's 64 KB packet_buffer became a common symbol whose size drove a 32 KB section alignment that ld64 then clamped to the 16 KB page size, warning on every macOS link. Everywhere else already compiles with `-fno-common`.
Gate the stats page and add a language breakdownBryce Kwon-21/+197
`max-stats` only bounds the selectable periods now and no longer doubles as the enable switch. The tree walk runs before the history walk on purpose. Releasing commit memory while walking history resets each commit slab index, and a commit graph lookup afterwards would read another commit slot and walk the wrong tree. The stats fixture writes a commit graph so the tests cover that path. The history walk bounds the window in process rather than passing a formatted since date to `setup_revisions`, and parses each commit once.
Keep the version fallback in shallow buildsBryce Kwon-2/+4
A checkout without tags made `git describe` fail and the empty result overwrote the fallback, so CI release binaries carried no version at all. The release workflow now also fetches tags so a tag build stamps its exact version.
Remove the owner filter hookBryce Kwon-28/+3
Declutter the interface on small screensBryce Kwon-10/+10
Move syntax highlighting to a Lua source filterBryce Kwon-8/+4
Stat oversized diffs instead of inlining themBryce Kwon-0/+56
Cap and paginate the ref listingsBryce Kwon-14/+118
Add a help page with common workflowsBryce Kwon-0/+120
Keep line structure in plaintext readmesBryce Kwon-1/+4
Submit option forms without inline handlersBryce Kwon-6/+6
Point the fork's links and credits at itselfBryce Kwon-28/+28
AUTHORS now records the upstream developers as the project's history rather than as maintainers of the fork.
Drop unused config and query fieldsBryce Kwon-7/+0
Key the cache on scheme and hostBryce Kwon-2/+15
Clone urls and atom links are built from the request scheme and Host, but the cache key left them out, so a request with a spoofed Host could cache a page carrying a bogus clone url and serve it to other visitors.
Close the layout on stat-only diffsBryce Kwon-1/+4
The stat-only diff path returned before the closing call, so the content wrapper, footer and closing tags were never emitted.
Emit `updated` on an empty atom feedBryce Kwon-0/+7
The feed-level element was written only inside the commit loop, so a feed with no commits omitted an element the atom format requires.
Fix diffstat and submodule diff outputBryce Kwon-7/+11
The diffstat divided by zero when a commit changed no lines, and a submodule change was printed with a hardcoded length that dropped a digit of a sha-1 and most of a sha-256.
URL-encode the repolist pager linksBryce Kwon-2/+2
The pager html-escaped its search and sort values instead of url-encoding them, so a term with a hash or ampersand broke the link and dropped the active filter on the next page.
Bound the authenticate-post length safelyBryce Kwon-3/+4
The POST length was clamped with a signed comparison, so a very large Content-Length could turn negative and slip past the limit into the fixed-size buffer.
Compare repository idle times by signBryce Kwon-1/+7
The idle-sort comparator returned a 64-bit time difference truncated to int, which could flip sign and leave the ordering inconsistent.
Date repositories from HEAD and guard its branchBryce Kwon-2/+27
The index derived a repository's age from `refs/heads/master` alone, so a repository on any other default branch showed no age. HEAD is repo-controlled and the age stat walks under `refs/heads`, so a branch name carrying a parent-directory component is rejected.
Respect the cgitrc order of sectionsBryce Kwon-1/+1
The default sorted the sections and the repositories within them by name, so the order written in the cgitrc file was ignored.
Keep snapshots working under a global git configBryce Kwon-1/+7
cgit unsets HOME to isolate git from the calling user, but git still finds the global config through its getpwuid fallback and then dies expanding a `~` in `core.excludesfile`. That die happened after the snapshot headers and the gzip filter were already in place, so the error page was compressed into the archive and every snapshot came out undecompressable.
Reject option-like revisions in the log walkBryce Kwon-0/+12
The log page passed the `id` query parameter to git's revision parser without resolving it and ahead of the end-of-options marker. A value like `id=--output=/path` was then parsed as an option, so an unauthenticated request could create or truncate any file the server user could write. No valid ref or object name begins with a dash.
Clamp the log offset to bound history walksBryce Kwon-1/+11
A crafted `ofs` could send cgit walking most of the history for one request.
Require a boundary in the about-path prefix checkBryce Kwon-1/+7
The about subpath was confined to the readme directory with a plain byte-prefix match, so a sibling directory sharing the base name as a prefix passed the check and its files were served.
Build the tree line gutter in one bufferBryce Kwon-2/+5
The line-number gutter did one allocation and one write per line.
Check `max-blob-size` before reading, default 10 MBBryce Kwon-8/+33
Only the tree view honoured the limit, and only after loading the whole object. The raw blob, plain, blame and readme paths now check the size before reading, and the default moves from unlimited to 10 MB so a fresh install never buffers a huge object whole, with zero still the opt-out.
Harden the blob view error pathsBryce Kwon-13/+27
A blob requested by ref with an unknown path fell through to the commit object and was served with a 200 instead of a 404, two error pages passed a null pointer to a %s format when the request carried no object id, and the error pages left the layout open.
Keep an overlong path out of the tab titleBryce Kwon-4/+15
`fmt()` aborts the request rather than truncate, so a very long path fed into a context-sensitive tab title took down page rendering.
Fix the stats year label and a missing authorBryce Kwon-2/+4
The year period rendered without its label, and a commit with no author line crashed the view.
Cast signed chars before ctype callsBryce Kwon-6/+6
A plain char is undefined in the ctype functions for negative values, which a high byte produces wherever char is signed.
Copyright © 2026 Bryce Kwon. All Rights Deprecated.