aboutsummaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* ui-blob: Do not accept mimetype from userJason A. Donenfeld2016-01-143-4/+0
|
* ui-shared: prevent malicious filename from injecting headersJason A. Donenfeld2016-01-143-3/+32
|
* ui-shared: Avoid new line injection into redirect headerJason A. Donenfeld2016-01-141-1/+3
|
* Fix missing prototype declarationsPeter Colberg2016-01-146-15/+15
| | | | Signed-off-by: Peter Colberg <[email protected]>
* ui-repolist: return HTTP 404 if no repositories foundPeter Colberg2016-01-131-3/+17
| | | | | | | | | Return HTTP status code 404 Not found when querying a non-existent repository, which signals to search engines that a repository no longer exists. Further, some webservers such as nginx permit logging requests to different files depending on the HTTP code. Signed-off-by: Peter Colberg <[email protected]>
* ui-repolist: extract repo visibility criteria to separate functionPeter Colberg2016-01-131-3/+10
| | | | Signed-off-by: Peter Colberg <[email protected]>
* Fix segmentation fault in hc()Lukas Fleischer2016-01-131-0/+3
| | | | | | | | The ctx.qry.page variable might be unset at this point, e.g. when an invalid command is passed and cgit_print_pageheader() is called to show an error message. Signed-off-by: Lukas Fleischer <[email protected]>
* git: update to v2.7.0Christian Hesse2016-01-1313-26/+26
| | | | | | | | | | | | | | Update to git version v2.7.0. * Upstream commit ed1c9977cb1b63e4270ad8bdf967a2d02580aa08 (Remove get_object_hash.) changed API: Convert all instances of get_object_hash to use an appropriate reference to the hash member of the oid member of struct object. This provides no functional change, as it is essentially a macro substitution. Signed-off-by: Christian Hesse <[email protected]>
* ui-repolist: initialize char *buf to NULLChristian Hesse2016-01-131-1/+1
| | | | | | | readfile() can fail if the agefile is not readable. Make sure free() does not free an ininitialized string. Signed-off-by: Christian Hesse <[email protected]>
* filter: avoid integer overflow in authenticate_postJason A. Donenfeld2015-11-241-1/+1
| | | | | | | | | | | | ctx.env.content_length is an unsigned int, coming from the CONTENT_LENGTH environment variable, which is parsed by strtoul. The HTTP/1.1 spec says that "any Content-Length greater than or equal to zero is a valid value." By storing this into an int, we potentially overflow it, resulting in the following bounding check failing, leading to a buffer overflow. Reported-by: Erik Cabetas <[email protected]> Signed-off-by: Jason A. Donenfeld <[email protected]>
* about-formatting.sh: comment text out of dateJason A. Donenfeld2015-11-121-1/+1
|
* filters: port syntax-highlighting.py to python 3.xChristian Hesse2015-10-121-10/+9
| | | | Signed-off-by: Christian Hesse <[email protected]>
* md2html: the default of stdin works fineJason A. Donenfeld2015-10-121-2/+1
| | | | Signed-off-by: Jason A. Donenfeld <[email protected]>
* filters: misc cleanupsJason A. Donenfeld2015-10-122-2/+1
| | | | Signed-off-by: Jason A. Donenfeld <[email protected]>
* md2html: use pure pythonJason A. Donenfeld2015-10-121-6/+9
| | | | Signed-off-by: Jason A. Donenfeld <[email protected]>
* cache: fix resource leak: close file handle before returnChristian Hesse2015-10-101-3/+9
| | | | | Coverity-id: 13910 Signed-off-by: Christian Hesse <[email protected]>
* ui-atom: fix resource leak: free allocation from cgit_pageurlChristian Hesse2015-10-101-1/+4
| | | | | Coverity-id: 13945 Signed-off-by: Christian Hesse <[email protected]>
* ui-atom: fix resource leak: free before returnChristian Hesse2015-10-101-1/+2
| | | | | Coverity-id: 13946 Signed-off-by: Christian Hesse <[email protected]>
* ui-atom: fix resource leak: free allocation from cgit_repourlChristian Hesse2015-10-101-1/+3
| | | | | Coverity-id: 13947 Signed-off-by: Christian Hesse <[email protected]>
* ui-blob: fix resource leak: free before returnChristian Hesse2015-10-101-0/+1
| | | | | Coverity-id: 13944 Signed-off-by: Christian Hesse <[email protected]>
* ui-blob: fix resource leak: free before returnChristian Hesse2015-10-101-0/+1
| | | | | Coverity-id: 13943 Signed-off-by: Christian Hesse <[email protected]>
* ui-plain: fix resource leak: free before assigning NULLChristian Hesse2015-10-091-1/+3
| | | | | Coverity-id: 13939 Signed-off-by: Christian Hesse <[email protected]>
* ui-plain: fix resource leak: free before returnChristian Hesse2015-10-091-0/+1
| | | | | Coverity-id: 13940 Signed-off-by: Christian Hesse <[email protected]>
* ui-repolist: fix resource leak: free allocation from cgit_currenturlChristian Hesse2015-10-091-1/+3
| | | | | Coverity-id: 13930 Signed-off-by: Christian Hesse <[email protected]>
* ui-repolist: fix resource leak: free before returnChristian Hesse2015-10-091-1/+3
| | | | | Coverity-id: 13931 Signed-off-by: Christian Hesse <[email protected]>
* filters: Simplify convertersJason A. Donenfeld2015-10-094-1734/+284
| | | | Signed-off-by: Jason A. Donenfeld <[email protected]>
* ui-shared: fix resource leak: free allocation from cgit_hosturlChristian Hesse2015-10-091-2/+3
| | | | Signed-off-by: Christian Hesse <[email protected]>
* ui-shared: return value of cgit_hosturl is not constChristian Hesse2015-10-092-4/+4
| | | | Signed-off-by: Christian Hesse <[email protected]>
* cmd: fix resource leak: free allocation from cgit_currenturl and fmtallocChristian Hesse2015-10-091-3/+7
| | | | Signed-off-by: Christian Hesse <[email protected]>
* ui-shared: fix resource leak: free allocation from cgit_currenturlChristian Hesse2015-10-091-3/+8
| | | | | Coverity-id: 13927 Signed-off-by: Christian Hesse <[email protected]>
* ui-shared: return value of cgit_currenturl is not constChristian Hesse2015-10-092-3/+3
| | | | Signed-off-by: Christian Hesse <[email protected]>
* ui-shared: fix resource leak: free allocation from cgit_fileurlChristian Hesse2015-10-091-5/+11
| | | | | Coverity-id: 13918 Signed-off-by: Christian Hesse <[email protected]>
* ui-ssdiff: fix resource leak: free allocation from cgit_fileurlChristian Hesse2015-10-091-2/+6
| | | | | Coverity-id: 13929 Signed-off-by: Christian Hesse <[email protected]>
* ui-tree: fix resource leak: free before returnChristian Hesse2015-10-091-0/+1
| | | | | Coverity-id: 13938 Signed-off-by: Christian Hesse <[email protected]>
* Avoid use of non-reentrant functionsJason A. Donenfeld2015-10-091-3/+3
| | | | Signed-off-by: Jason A. Donenfeld <[email protected]>
* Makefile: fix MAKEFLAGS tests with multiple flagsJohn Keeping2015-10-091-1/+1
| | | | | | | | findstring is defined as $(findstring FIND,IN) so if multiple flags are set these tests do the wrong thing unless $(MAKEFLAGS) is the second argument. Signed-off-by: John Keeping <[email protected]>
* ui-refs: remove useless null checkJohn Keeping2015-10-091-1/+1
| | | | | | | There is no way that "tag" can be null here. Coverity-id: 13950 Signed-off-by: John Keeping <[email protected]>
* ui-blob: remove useless null checkJohn Keeping2015-10-091-1/+1
| | | | | | | | We have already called strlen() on "path" by the time we get here, so we know it can't be null. Coverity-id: 13954 Signed-off-by: John Keeping <[email protected]>
* scan-tree: remove useless strdup()John Keeping2015-10-091-1/+1
| | | | | | | | | parse_configfile() takes a "const char *" and doesn't hold any references to it after it returns; there is no reason to pass it a duplicate. Coverity-id: 13941 Signed-off-by: John Keeping <[email protected]>
* cgit.c: remove useless null checkJohn Keeping2015-10-091-1/+1
| | | | | | | | Everywhere else in this function we do not check whether the value is null and parse_configfile() never passes a null value to this callback. Coverity-id: 13846 Signed-off-by: John Keeping <[email protected]>
* git: update to v2.6.1Christian Hesse2015-10-062-1/+1
| | | | | | Update to git version v2.6.1, no changes required. Signed-off-by: Christian Hesse <[email protected]>
* mime: rewrite detection functionJason A. Donenfeld2015-08-171-36/+26
| | | | Signed-off-by: Jason A. Donenfeld <[email protected]>
* ui-summary: send images plain for about pageChristian Hesse2015-08-171-2/+13
| | | | | | | | | The about page used to display just fine, but images were broken: The binary image data was embedded in html code. Use cgit_print_plain() to send images in plain mode and make them available on about page. Signed-off-by: Christian Hesse <[email protected]>
* refactor get_mimetype_from_file() to get_mimetype_for_filename()Christian Hesse2015-08-173-51/+44
| | | | | | | * handle mimetype within a single function * return allocated memory on success Signed-off-by: Christian Hesse <[email protected]>
* move get_mimetype_from_file() to sharedChristian Hesse2015-08-173-40/+42
| | | | Signed-off-by: Christian Hesse <[email protected]>
* cmd: fix command definitionJohn Keeping2015-08-141-1/+1
| | | | | | | | The previous commit removed the "pre" field from "struct cgit_cmd" but forgot to update this macro. Signed-off-by: John Keeping <[email protected]> Reviewed-by: Christian Hesse <[email protected]>
* cmd: no need for pre function hook nowJason A. Donenfeld2015-08-143-20/+9
| | | | Signed-off-by: Jason A. Donenfeld <[email protected]>
* ui-shared: cache errors for "dynamic TTL"John Keeping2015-08-141-0/+1
| | | | | | | Most errors we generate are (potentially) transient, such as non-existent object IDs so we don't want them to be cached forever. Signed-off-by: John Keeping <[email protected]>
* cmd: remove "want_layout" fieldJohn Keeping2015-08-143-34/+24
| | | | | | No commands use this any more. Signed-off-by: John Keeping <[email protected]>
* tree: move layout into page functionJohn Keeping2015-08-142-6/+19
| | | | | | | | This also allows us to return proper HTTP error codes when the requested tree is not found and display an error message in one case (invalid path inside valid commit) where we previously just displayed an empty page. Signed-off-by: John Keeping <[email protected]>
generated by cgit v1.2.3-70-g09d2 (git 2.46.0) at 2025-04-20 11:42:05 +0000