Age	Commit message (Collapse)	Author	Lines
15 hours	Require a whole page when a filter exits early	Bryce Kwon	-2/+3
	When a filter cannot run, cgit dies mid-page with its Status line already out, so the check passed with no filter at all. That is the case wherever true lives only in /bin, as on busybox. true now comes from the PATH, and the page has to reach its end.
15 hours	Make the main cgitrc filter check run the filter	Bryce Kwon	-3/+6
	The check asked for the summary page, which never runs an about filter, so it passed with exec:/bin/true on macOS, which has no such file, and with a filter that does not exist at all. Its first line read the stderr the previous test left behind. execvp searches the PATH, so a plain true runs the same on macOS, Debian and busybox.
15 hours	Let go of a slot lock that cannot take its key	Bryce Kwon	-0/+15
	A failed truncate or key write returned with the descriptor still open, so the lock was held while the page rendered uncached and the file was left behind. It is removed before its last close, as every holder does.
15 hours	Keep lock contention out of the error log	Bryce Kwon	-2/+20
	process_slot logged every failure to lock, so each request that found its slot being filled left a line, while refresh_slot logged none, so an expired slot in a directory the server cannot write was served stale for good without a word. lock_slot now logs the step that failed, as the scan does, and leaves out only another request at work.
15 hours	Lock the cached repolist with flock	Bryce Kwon	-0/+38
	The slot lock has to be an flock, since an exec filter drops a record lock when it closes the stdout a fill writes through. The scan only got by with fcntl because nothing reopens its file while it runs. One kind of lock lets the two share their code, and on Linux, where the kinds never see each other, an flock on the scan's file now holds a scan off like any other.
15 hours	Open the lock files close-on-exec	Bryce Kwon	-0/+27
	Each exec filter and snapshot compressor a fill runs inherited the slot's lock descriptor beside the stdout it writes into. An flock lasts until its last copy closes and nothing waits for a process a filter leaves behind, so a fill killed before its rename could leave the slot locked, and served stale or uncached, for as long as such a process lived. The scan holds its lock across no exec and opens the same way so that the two stay alike.
15 hours	Tidy the cache test's helpers and outputs	Bryce Kwon	-24/+18
	The header's last sentence named two of the many later subjects, so it goes too. The second request's stderr is still kept, for the lock tests that come next.
15 hours	Use test_dir_is_empty for the empty cache checks	Bryce Kwon	-16/+8
	The library's check also lists whatever was left behind when it fails.
16 hours	Write a session's expiry in whole seconds	Bryce Kwon	-0/+11
	On Lua 5.3 and later a length worked out with a fraction, such as 1.5 * 24 * 60 * 60, is a float, so the signed expiry came out as 1793609024.0, which validate_value refuses, and every login failed. Max-Age took the same .0, which makes a browser ignore it.
16 hours	Drop an auth prerequisite no test asks for	Bryce Kwon	-4/+2
16 hours	Set the Lua prerequisite once for every test	Bryce Kwon	-87/+27
	setup.sh already asks the binary, so the seven scripts that each turned the answer into a prerequisite now share one. test-lib names the missing prerequisite beside every test it skips, so the notes that cgit lacks Lua go, while the ones announcing a fallback stay. The list of standalone interpreters moves into lib.sh and matches the versions the extensions claim directly.
16 hours	Move the highlighter fallback check into t0502	Bryce Kwon	-24/+12
	t0502 owns the shipped highlighter and already writes a cgitrc naming it, so the check needs no config of its own there. t0204's header still called it the last case long after it stopped being one.
16 hours	Share the request helpers in the auth checks	Bryce Kwon	-77/+49
	The two identical posts for an unknown user become one, and no two checks share a name, so a failure report points at a single check.
16 hours	Let an unmirrored sink fail the way Lua would	Bryce Kwon	-12/+0
16 hours	Drop the auth stubs no check reaches	Bryce Kwon	-20/+6
	Every check replaces get_secret, the only caller of posix.sys.stat, link and unlink, and nothing outside the harness calls preload.
16 hours	Drop auth guards for input cgit never sends	Bryce Kwon	-3/+4
	cgit names no repository with an empty string, never nil, so the check that the index stays up proved nothing, and auth-file in fact refuses the index too while its repos file cannot be read. A session_seconds of 0 signs a session that has expired by the time it comes back, so it needs no branch of its own in set_cookie.
16 hours	Strip control characters from the location alone	Bryce Kwon	-2/+0
	set_cookie only ever writes an empty value or a token secure_value built from url-encoded text, digits and hex, so stripping it changed nothing.
16 hours	Take a signed cookie apart with one match	Bryce Kwon	-0/+1
	The loop let a valid cookie through with a field appended, a doubled separator or a zero in front of its expiry. The payload now carries the expiry as written, so only the spelling secure_value issues verifies.
16 hours	Drop a highlighter check that tested the harness	Bryce Kwon	-6/+0
	The filter hands a NUL through untouched, and only the harness's copy of cgit's sink cut the text there, so the check would have failed the day the filter replaced NULs the way about-render does.
16 hours	Drop the highlighter's extension fallback	Bryce Kwon	-14/+5
	The table of extensions and the second lookup served only a Scintillua with no detect(), which now leaves every file uncoloured but escaped. The fake detect() names a lexer after the file's suffix, so every test lexer is reached through it.
16 hours	Drop a stray blank line from the about-render tests	Bryce Kwon	-1/+0
16 hours	Drop the readme hooks that nothing reads	Bryce Kwon	-6/+5
	Nothing in assets/ or in README's list of hooks reads a fenced block's data-lang or the manpage class on a man page's wrapper, so the header now names the two wrappers the stylesheet does style.
16 hours	Trim a snapshot name without reading out of bounds	Bryce Kwon	-0/+30
	For a url of .git, or an empty one, repo_basename stepped its index to the byte before its buffer, read it, and would have cleared it had it held a slash. Git's strbuf trims take the same steps safely, and they lift the 1024-byte cap that failed the page for a longer url.
16 hours	Open the empty page's clone table on its first url	Bryce Kwon	-0/+29
	The page guessed from the two settings cgit_add_clone_urls reads, so a clone-url that expanded to nothing, or an empty one turning the global off, still drew a Clone heading over no rows. The summary already waits for a first url, and both now draw the heading the same way.
16 hours	Tidy up after a directory chain however it ends	Bryce Kwon	-0/+27
	A row whose first entry is itself a directory leaked that entry's name. A level git could not read as a tree returned early instead, which also left the row's log, stats and plain links on the deeper path.
16 hours	Free the log's tip when its walk fails	Bryce Kwon	-0/+19
	Every exit now goes through one label, which also clears the walk arguments that the normal end used to leave allocated.
16 hours	Refuse pathspec magic on the stats page	Bryce Kwon	-0/+9
16 hours	Open the stats window at midnight on its first day	Bryce Kwon	-0/+28
16 hours	Label the age column of a followed log	Bryce Kwon	-0/+12
16 hours	Scroll a line range to where a single line lands	Bryce Kwon	-0/+8
	The anchors' scroll margin of half the window already centres a line scrolled to the top of the view, which is where the browser puts a single line. Asking to centre a range as well centred the margin with it, and in Chromium, WebKit and Firefox the first line of a range landed 73% of the way down the window against 49% for a single line.
16 hours	Stop skipping ages as they change unit	Bryce Kwon	-0/+6
	getElementsByClassName returns a live collection, so an age moved to the next unit dropped out of it mid-loop and the age after it was skipped until the next pass, which can be a day away. On a cached page that has crossed a unit boundary every second age stayed stale. querySelectorAll returns a static list of the same elements.
16 hours	Move scan-path below the settings it inherits	Bryce Kwon	-3/+14
	The quick start says to uncomment scan-path, and in its old place a scanned repository missed every setting below it, among them the filters, the snapshots and the enable flags.
16 hours	Keep the age hook quiet when it cannot write	Bryce Kwon	-0/+23
2 days	Declare each phony target beside its rule	Bryce Kwon	-4/+5
	A list at the end of the file is easy to miss when a target is added or renamed.
2 days	Keep the commit-graph current in an example hook	Bryce Kwon	-1/+23
	cgit's log, blame and graph pages read commits from the commit-graph when a repository has one, and its changed path filters let a walk limited to one file skip the commits that never touched it. git gc writes a graph only now and then and starts those filters only when a write asks for them, so the hook writes a split layer with them after each push.
2 days	Drop only the cache a push makes stale	Bryce Kwon	-17/+91
	The hook cleared every slot on a push to any repository. cgit writes the request a slot answers at its head, so the hook now reads it back and drops only the pushed repository's pages and the index. It finds the repository's url from scan-path or hooks.cgiturl, and with neither it clears everything as before.
2 days	Render the man pages that generators write	Bryce Kwon	-4/+110
	DocBook, pod2man and hand written pages leaked roff onto the page: font escapes inside no fill blocks, comments, layout escapes such as \% and \c, the colours and half line moves around DocBook's links, and the requests and macro definitions their preambles open with. Those now draw nothing, the common named characters and strings render, .EX and pod2man's .Vb read as code, a .TP tag takes a line of its own and the alternating font macros switch fonts between their arguments. Anything rarer still falls back to its text.
2 days	Render more of the markdown seen in readmes	Bryce Kwon	-0/+26
	A line of equals signs or dashes under a paragraph now makes a heading of it, as on GitHub, instead of running into its text, and any other rule ends the paragraph. Four spaces or a tab start a code block, and an escaped pipe stays in its table cell. A link opening with two slashes or backslashes in any mix leads to another site, so it renders as text like the plain scheme relative one already did.
2 days	Keep a readme whole past a NUL byte	Bryce Kwon	-6/+5
	cgit takes filter output through a C string sink that stops at the first NUL, so a readme holding one lost everything after it. Each NUL now shows as U+FFFD, as a browser would show it.
2 days	Offer no diff options on an octopus merge	Bryce Kwon	-0/+12
	The commit page draws no diff for a merge of three or more parents, so the options above it changed nothing.
2 days	Offer the versions as an option	Bryce Kwon	-4/+36
	enable-version-info brings back the cgit and git versions that 3a00e19 took off the footer and the generator tag, for a site that wants them, and the version 2a6726a put on the signature of patches now follows it too. It stays off by default for the reason 3a00e19 gave.
3 days	Name the page first in every title	Bryce Kwon	-0/+20
	Summary, about, log, refs, tag and stats pages shared one title, so tabs, history and search results could not tell them apart. Titles now read page, repository and site, with root-title as the site, and the description stays in the meta description, where search engines read it.
3 days	Name the graph and links header cells	Bryce Kwon	-1/+5
	Both were empty, so a screen reader moving through the table announced those columns with no name. An aria-label names them without adding text to the page.
3 days	Load the scripts with defer	Bryce Kwon	-0/+5
	A plain script in the head held up parsing until it had downloaded and run, though cgit.js only acts once the document is ready. Deferred scripts still run in the order given and before DOMContentLoaded, so a site script after cgit.js can still call window.cgit.
3 days	Tidy the diff and stat options panel	Bryce Kwon	-2/+2
	Its caption sat above the box, each select took its own width, and the reload button hung indented under them. The caption is now the panel's header strip, the selects and the button share one column at the width of the widest select, and the labels lose their colons to match the commit details.
3 days	Test that every copy of the background matches	Bryce Kwon	-0/+16
3 days	Stop folding a tag's signature away	Bryce Kwon	-29/+4
	The fold put a click between the reader and the signature, and the browser's own disclosure marker and summary did not take the theme. The signature prints as part of the message again, as it did up to v2.9.1.
6 days	Draw no diffstat table for a change to no files	Bryce Kwon	-0/+10
	The padding the table gained left an empty commit with a hollow frame where the file rows would be.
6 days	Fold a tag's signature away under its message	Bryce Kwon	-0/+52
	The armour ran on for more lines than most tag messages, as part of the message itself. git finds the signature for every kind it can sign with, so PGP, SSH and X.509 all fold the same way.
6 days	Say when a login fails, and line up the form	Bryce Kwon	-1/+11
	A wrong password sent the reader back to the same empty form, which looked no different from a crash. The redirect now carries a flag the form reads, the same for an unknown user as for a wrong password, and the form leaves the flag out of the way back it signs.