Age	Commit message (Collapse)	Author	Lines
18 hours	Escape the same characters in the highlighter	Bryce Kwon	-0/+40
	A lexer may hand back the bytes of one separator, or the CR and LF of a line ending, in different tokens, so line endings become line feeds before lexing and the separators are escaped once the tokens are joined.
18 hours	Show characters a browser breaks at as escapes	Bryce Kwon	-4/+62
	The HTML parser turns a carriage return with no line feed after it into a line feed, and WebKit starts a new line at U+2028 and U+2029, while git and the line numbers count line feeds alone, so each one set every later line of the tree and blame pages a line below its number. CSS Text makes vertical tab, form feed and next line forced breaks as well, though no engine honours that yet. The escapes follow gitweb, which shows control characters the same way.
18 hours	Keep the code in step with its line numbers	Bryce Kwon	-0/+9
	The stylesheet overhaul in 4ce57f5 gave the pre of the tree and blame pages the site's monospace font but left the code element inside it on the browser's own, Courier in Safari and DejaVu Sans Mono on a typical Linux desktop. A line box holds both fonts on one baseline, so where their ascent and descent differ each code line comes out a little taller than its number. By the end of a 2,000 line file the code sat 45 lines low in Safari and 109 in all three engines on Debian.
7 days	Give the trim timing check room for a slow host	Bryce Kwon	-2/+3
	The about-render unit test bounds three renders at one second to catch the cubic trim coming back. They take 0.1 s natively and three seconds on an emulated x86_64 host, where the check failed, while the old code took minutes, so ten seconds still tells the two apart.
7 days	Isolate git from HOME before git's own setup	Bryce Kwon	-3/+4
	Git reads the global config for its trace settings before cmd_main is reached, so the isolation there came too late and every request probed $HOME/.gitconfig. The home-access test had passed on arm64 only because access is no syscall of its own there, so it now traces every call that takes a path.
7 days	Lock a cache slot with flock	Bryce Kwon	-0/+38
	The slot lock was a POSIX record lock, which a process loses the moment any descriptor on the file closes, and the fill puts the lock file on stdout, which every exec filter and snapshot compressor closes with its dup2. A second request on the slot could then rebuild it under the first and splice the two pages. An flock holds until the last descriptor goes.
7 days	Abandon a fill whose last flush fails to write	Bryce Kwon	-0/+16
	The slot being filled was forgotten before the page's final flush, so a write that failed there, on a full disk for one, could not abandon the fill: cgit died into the lock file instead and the visitor got nothing. The mid-page path already delivered the page from the lock file.
7 days	Hold patch and rawdiff to max-blob-size	Bryce Kwon	-0/+18
	Both pages hand the diff to git, whose own limit on an inlined blob is 512 MB, so a commit adding a blob the other views refuse was inflated and diffed in full. The cap is passed through to git, which shows such a blob as binary.
7 days	Keep every control byte out of a header value	Bryce Kwon	-0/+14
	A quoted header value escaped only the quote, the backslash, CR and LF. A web server refuses a response whose header holds any other control byte, so a file named with one could not be downloaded at all.
7 days	Hold a scanned defbranch to a ref name	Bryce Kwon	-0/+11
	The index stats the default branch below the repository to date it, and a scanned repository sets its own defbranch, which was not held to what a ref may hold, so one spelled as a path reached a file outside.
7 days	Answer the plain view once for duplicate entries	Bryce Kwon	-0/+25
	A tree can hold two entries of one name when fsck is off, and the walk went on after the first answered: a second file put two responses in one body, and a directory under the same name printed headers from the mimetype string the first had already freed.
7 days	Hold a signature download to max-blob-size	Bryce Kwon	-0/+12
	A signature is a note a pusher stored, and the download read it whole without the size check every other blob a page inflates goes through.
7 days	Lead a snapshot name to its tag ahead of a branch	Bryce Kwon	-0/+9
	The refs listing offers a tag's snapshot under the stem of its name, and the lookup back from that name settled on whatever ref matched first, so a branch spelled like the stem was archived in the tag's place. Every candidate is now tried as a tag before any is tried as a branch.
7 days	Pass over a notes ref that names no tree	Bryce Kwon	-0/+20
	A pusher can point refs/notes/commits or a signature notes ref at any object, and git dies loading one that is no tree, which ended every page of the repository, the dumb transport included. Such a ref now counts as absent.
7 days	Show an odd pushed date rather than die on it	Bryce Kwon	-0/+39
	A date past what the system holds, a zone that is no hhmm offset, or a date earlier than its own westward offset all made git die inside show_date, which took the summary, refs, log, commit and feed pages of the repository down. They are now clamped as git's own log clamps them.
7 days	Check the id before the page chrome resolves it	Bryce Kwon	-0/+12
	The chrome renders on an error page too, where the id had just been refused for using the wider revision syntax, and then looked it up anyway. A :/pattern id walks the whole history for a match.
7 days	Serve only the files a dumb clone asks for	Bryce Kwon	-5/+9
	The object path check let any run of safe characters through, so a spelling such as info//alternates or info/./alternates reached the alternates file the exact name was refused for. Only a loose object, a pack with its index and info/http-alternates are served now, and any other path is not found.
7 days	Search the log literally as intended	Bryce Kwon	-0/+9
	setup_revisions compiles the pattern itself, and the literal type cgit set afterwards came too late, so text that was no valid regular expression, such as an unbalanced bracket, ended in a 500.
8 days	Test the features the suite never reached	Bryce Kwon	-0/+75
	Index sorting, the commit graph, the stats periods past a week, the hex dump of a binary file and a Lua filter's html_url_arg and html_include ran in no test.
8 days	Run a config comment to the end of its line	Bryce Kwon	-0/+16
	skip_line stopped at a NUL as well as at a newline, so the rest of the comment after one was read as a setting.
8 days	Give a repository without a path no age	Bryce Kwon	-0/+10
	The index built its paths from a NULL repo.path, which the C library prints as "(null)", so it looked for refs under that name in the working directory.
8 days	End a long directory chain on its last link	Bryce Kwon	-0/+27
	Past fifteen single directories the row stopped after writing the next separator, which left it ending in a dangling " / ".
8 days	Show an absolute link target as text	Bryce Kwon	-0/+26
	A symlink to /etc/passwd was resolved against the tree and linked to etc/passwd inside it, a different file or none at all.
8 days	Find a compressor on the default path when unset	Bryce Kwon	-0/+14
	With no PATH in the environment, the check that a compressor exists gave up and refused every compressed snapshot, though execvp would have found it on the system's default path.
8 days	Keep snapshot members from starting at a slash	Bryce Kwon	-0/+21
	A name that was all suffix, such as .tar, settled on a ref called v with an empty prefix, and an empty snapshot-prefix did the same for a snapshot asked for by id, so every member of the archive started at /.
8 days	Say why an oversized readme leaves about empty	Bryce Kwon	-0/+15
	A readme past max-blob-size is never read, which left the about page with an empty block and no word of why.
8 days	Offer tag snapshots only for a tagged commit	Bryce Kwon	-0/+14
	The tag page offered a download for a tag of a tree or a blob, which only led to a "Not a commit" page. The refs listing already checks.
8 days	Refuse pathspec magic in the feed as in the log	Bryce Kwon	-0/+9
	A feed path starting with a colon reached git as pathspec magic, so an unknown magic word ended the request in a 500 and a known one changed what the path matched, while the log answers both with a 400.
8 days	Date a reftable repository on the index	Bryce Kwon	-0/+5
	The idle column falls back on the mtime of the branch's loose ref or of packed-refs, and a reftable repository has neither, so its cell stayed empty. Git rewrites reftable/tables.list on every ref update.
8 days	Answer dumb-clone HEAD from the ref store	Bryce Kwon	-0/+26
	A reftable repository keeps only a placeholder in its HEAD file, so a dumb clone was told HEAD named refs/heads/.invalid and checked nothing out. HEAD is now answered the way git's http-backend answers it.
8 days	Cut text between characters, never inside one	Bryce Kwon	-0/+24
	The index description was cut at a byte count, which could split a multibyte character and leave an invalid sequence on the page. Commit subjects already backed up to the start of the character, so html_ntxt now does that for every caller.
8 days	Find libc's write when git writes first	Bryce Kwon	-0/+8
	A Lua build replaces write, and git can write before cmd_main reaches cgit_init_filters, as it does when GIT_TRACE2 is set, which called through a null pointer and crashed every request.
8 days	Read a negative ref count as no limit	Bryce Kwon	-0/+20
	summary-branches, summary-tags and max-ref-count already listed every ref at 0, but a negative value reached qsort as a count and crashed the summary and refs pages, and emptied the branch switcher.
8 days	Page a followed log by the name asked for	Bryce Kwon	-1/+9
	Each row of a followed log moves ctx.qry.vpath to the name its commit knew the file by, and the pager built its links from that, so past a rename both links named the old file and led to an empty page.
8 days	Show the root commit in a followed log	Bryce Kwon	-0/+38
	A followed log diffs each commit against its parent to learn whether the file changed there, and a root commit was skipped rather than diffed against the empty tree, so a file created in the first commit never showed that commit.
8 days	Peel an annotated tag before looking for a readme	Bryce Kwon	-0/+14
	Tag links carry the tag name as the head, so on any page reached from an annotated tag the about tab vanished and the about page redirected to the summary.
8 days	Encode repository urls and the feed branch	Bryce Kwon	-2/+14
	Links built from the repository url, among them the description link on the index and the Atom and refs links, wrote it as configured, so a name holding a space, '#' or '?' broke them. The feed link in the page head did the same with the branch, which turned a '+' into a space.
8 days	Name every Lua filter failure in the log	Bryce Kwon	-0/+13
	A script raising anything but a string handed die a null to print, and a Lua state that could not be created was used anyway once the filter closed.
8 days	Let a Lua script write while it loads	Bryce Kwon	-0/+20
	A script's top level runs before cgit hooks stdout for it, and the unhook html() began with tripped an assert that aborted cgit.
8 days	Claim and test Lua 5.5 for every extension	Bryce Kwon	-5/+5
	luaossl from release 20260910 and luaposix load under Lua 5.5, and cgit renders the same pages under it as under LuaJIT. Running the suites there already caught a write to a for loop's control variable, which 5.5 makes read-only.
8 days	Find a script's lexer from its shebang line	Bryce Kwon	-4/+11
	Scintillua's detect reads the first line as well as the name, and without it hooks, bin scripts and anything else lacking an extension stayed plain.
8 days	Ship the example tracker links commented out	Bryce Kwon	-19/+35
	An unedited copy sent every #123, Closes: and Bug: mark to bugs.example.com, a link that is wrong for every site.
8 days	Name the auth cookie __Host- where it can be	Bryce Kwon	-26/+51
	Without the prefix any host under the same domain could set a cgitauth cookie of its own, signing a visitor in as someone else or out.
8 days	End a session when its account's hash changes	Bryce Kwon	-4/+20
	A session stayed good for its whole week after the password changed or the account went away, which is when ending it matters most.
8 days	Load auth libraries only when a request needs one	Bryce Kwon	-6/+43
	Required at the top, a missing luaossl or luaposix failed every request to the site, public pages included, and each public page paid to load both.
8 days	Spend a missing account's login on a real hash	Bryce Kwon	-36/+68
	The fixed SHA-512 stand-in matched only the documented setup, so a site hashing with yescrypt, other rounds or bcrypt answered for missing and real names in different times, and on OpenBSD it failed at once.
8 days	Turn down passwords past 256 bytes unchecked	Bryce Kwon	-0/+22
	SHA-crypt hashes the password in most of its rounds, so the 4 KB that cgit's POST limit lets through cost about fifteen ordinary logins per anonymous attempt.
8 days	Read the auth cookie in linear time	Bryce Kwon	-0/+10
	Splitting the header with patterns that backtrack over spaces cost a quarter of a second per request at the 8 KB line most web servers allow, and a second at 16 KB, without any login. auth-file's trim had the same shape and now reads the cookie as well.
8 days	Offer avatars at twice the size to dense screens	Bryce Kwon	-0/+1
	The 13 pixel icon came out blurred on the high density screens most phones and laptops have.
8 days	Hash avatar addresses with SHA-256	Bryce Kwon	-7/+9
	Gravatar's documentation now describes SHA-256 hashes on gravatar.com alone, and Libravatar has long accepted them beside MD5.