Age	Commit message (Collapse)	Author	Lines
40 hours	Leave readme out of what scan-path fixes	Bryce Kwon	-0/+10
40 hours	Answer 404 for any path below the about page	Bryce Kwon	-10/+21
	The about page served every file beside the readme as a page of its own, through the about filter, and answered 200 for directories and missing files alike. Images it passed through came from the root of the default branch whatever the readme's own directory and ref. A readme on disk exposed its whole directory this way.
40 hours	Name the right file and error in the scan logs	Bryce Kwon	-0/+28
	A failed stat logged the directory rather than the entry inside it, and a project list that failed to read printed strerror of the flag ferror returns, which names an unrelated error.
40 hours	Skip an indented comment in the mimetype file	Bryce Kwon	-0/+6
	Only a hash in the first column marked a comment, so an indented one was read as the type "#" for every word after it. The manual already describes comments by their first non-blank character.
40 hours	Keep the error of a request that dies mid capture	Bryce Kwon	-0/+29
	The commit and diff pages collect each file's body before printing it, and a die in git while one was collected wrote the error page into that body, which was never sent, so the visitor got a page cut off mid table.
40 hours	Gate a readme ending in a colon like a disk path	Bryce Kwon	-0/+10
	trust-scan-config passed any readme holding a colon as a tracked file, while the parser takes one only when a path follows the colon, so a scanned repository could still name a file on disk outside itself. The two now share one test.
40 hours	Keep a repository with an empty url ignored	Bryce Kwon	-1/+6
	The field resets at the end of cgit_add_repo cleared the ignore flag that the empty url branch had just set, so such a repository was listed on the index and selectable with ?r=, where every link to it read the byte before its url.
2026-10-01	Mark a page behind an auth filter private	Bryce Kwon	-0/+22
	Only the login page carried a Cache-Control, so a page an auth filter had let a visitor see could be kept by a cache shared with the next visitor. The page also varies on the cookie that got them in.
2026-10-01	End a request quietly when the client has gone	Bryce Kwon	-0/+16
	A write that failed with EPIPE on an uncached page died into an error page, which died again at exit when the page could not be sent either, and git logged a recursion warning on every dropped connection. A filter that exits early fails a write the same way, so the quiet exit is kept for writes that reach the client itself.
2026-10-01	Leave a branch spelled like an option out of the switcher	Bryce Kwon	-0/+7
	Such a name is refused as a head before git could read it as an option, and the fallback branch already skips it, so the switcher offered a choice that led only to an error page.
2026-10-01	Walk a path on the blob page from any commit the id names	Bryce Kwon	-0/+15
	With both an id and a path the blob page handed back the raw object the id named, so a commit id gave the commit text itself, while the plain page looked the path up in that commit's tree. A tag is peeled to its commit on the way, and the README example of a pinned commit now uses a form the request checks accept.
2026-10-01	Keep the query string across the about redirects	Bryce Kwon	-0/+13
	The hop to the trailing-slash form of the about page, and the hop back to the summary of a repository without a readme, were built from the path alone, so a request for the about page of another branch landed on the default one. The query goes into the Location line as the client sent it, with any byte a header cannot carry percent-encoded.
2026-10-01	Withhold the alternates file on the dumb transport	Bryce Kwon	-0/+13
	It lists object directories by their path on the server, which a client fetching over http can neither use nor needs to learn. The http-alternates file written for such clients still goes out.
2026-10-01	Send a clone file with its size in whole batches	Bryce Kwon	-0/+15
	The dumb transport read a pack four kilobytes at a time through stdio and sent it without a length, so a client could not tell a cut-off transfer from a complete one.
2026-10-01	Gate html serving behind trust-scan-config	Bryce Kwon	-3/+39
	`enable-html-serving` makes the plain page send a repository file as text/html on the site's own origin, with no nosniff and no policy, so a scanned repository could switch it on from its git config or cgitrc without `trust-scan-config` and run script against every visitor. The warning for a key read from git config also named a null repository, because `repo->path` was set only after that file had been read.
2026-09-27	Rename enable-trailers to enable-commit-trailers	Bryce Kwon	-1/+1
2026-09-21	Test the hardening pass	Bryce Kwon	-0/+471