Website Summary Files Commits Branches @commit @diff @stats
Commit message (Collapse)AuthorAgeLinesSHA
...
* cache: don't check for match with no key
 John Keeping		2016-01-17-2/+333bc949
| | | | | | | | | | | We call open_slot() from cache_ls() without a key since we simply want to read the path out of the header. Should the file happen to contain an empty key then we end up calling memcmp() with NULL and a non-zero length. Fix this by assigning slot->match only if a key is set, which is always will be in the code paths where we use slot->match. Coverity-id: 13807 Signed-off-by: John Keeping <john@keeping.me.uk>
* cache: use size_t for string lengths
 John Keeping		2016-01-17-2/+23fbfced
| | | | | | | Avoid integer truncation on 64-bit systems. Coverity-id: 13864 Signed-off-by: John Keeping <john@keeping.me.uk>
* ui-log: handle parse_commit() errors
 John Keeping		2016-01-17-1/+3baa5ad1
| | | | | | | | | | | | | If parse_commit() fails, none of the fields in the commit structure will have been populated so we will dereference NULL when accessing item->tree. There isn't much we can do about the error at this point, but if we return true then we'll try parsing the commit again from print_commit() and we can report an error to the user at that point. Coverity-id: 13801 Signed-off-by: John Keeping <john@keeping.me.uk>
* Bump version
 Jason A. Donenfeld		2016-01-14-1/+1e64d5e0
|
* ui-plain: add enable-html-serving flag
 Jason A. Donenfeld		2016-01-14-0/+29c326f3e
| | | | Unrestricts plain/ to contents likely to be executed by browser.
* ui-blob: set CSP just in case
 Jason A. Donenfeld		2016-01-14-0/+39ca2566
|
* ui-blob: always use generic mimetypes
 Jason A. Donenfeld		2016-01-14-6/+492996ac
|
* ui-blob: Do not accept mimetype from user
 Jason A. Donenfeld		2016-01-14-4/+01c581a0
|
* ui-shared: prevent malicious filename from injecting headers
 Jason A. Donenfeld		2016-01-14-3/+32513b386
|
* ui-shared: Avoid new line injection into redirect header
 Jason A. Donenfeld		2016-01-14-1/+34291453
|
* Fix missing prototype declarations
 Peter Colberg		2016-01-14-15/+154c69241
| | | | Signed-off-by: Peter Colberg <peter@colberg.org>
* ui-repolist: return HTTP 404 if no repositories found
 Peter Colberg		2016-01-13-3/+179abe4a2
| | | | | | | | | Return HTTP status code 404 Not found when querying a non-existent repository, which signals to search engines that a repository no longer exists. Further, some webservers such as nginx permit logging requests to different files depending on the HTTP code. Signed-off-by: Peter Colberg <peter@colberg.org>
* ui-repolist: extract repo visibility criteria to separate function
 Peter Colberg		2016-01-13-3/+10a4014d0
| | | | Signed-off-by: Peter Colberg <peter@colberg.org>
* Fix segmentation fault in hc()
 Lukas Fleischer		2016-01-13-0/+3da1b897
| | | | | | | | The ctx.qry.page variable might be unset at this point, e.g. when an invalid command is passed and cgit_print_pageheader() is called to show an error message. Signed-off-by: Lukas Fleischer <lfleischer@lfos.de>
* git: update to v2.7.0
 Christian Hesse		2016-01-13-26/+26559ab5e
| | | | | | | | | | | | | | Update to git version v2.7.0. * Upstream commit ed1c9977cb1b63e4270ad8bdf967a2d02580aa08 (Remove get_object_hash.) changed API: Convert all instances of get_object_hash to use an appropriate reference to the hash member of the oid member of struct object. This provides no functional change, as it is essentially a macro substitution. Signed-off-by: Christian Hesse <mail@eworm.de>
* ui-repolist: initialize char *buf to NULL
 Christian Hesse		2016-01-13-1/+16edc84b
| | | | | | | readfile() can fail if the agefile is not readable. Make sure free() does not free an ininitialized string. Signed-off-by: Christian Hesse <mail@eworm.de>
* filter: avoid integer overflow in authenticate_post
 Jason A. Donenfeld		2015-11-24-1/+14458abf
| | | | | | | | | | | | ctx.env.content_length is an unsigned int, coming from the CONTENT_LENGTH environment variable, which is parsed by strtoul. The HTTP/1.1 spec says that "any Content-Length greater than or equal to zero is a valid value." By storing this into an int, we potentially overflow it, resulting in the following bounding check failing, leading to a buffer overflow. Reported-by: Erik Cabetas <Erik@cabetas.com> Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* about-formatting.sh: comment text out of date
 Jason A. Donenfeld		2015-11-12-1/+1ffe0962
|
* filters: port syntax-highlighting.py to python 3.x
 Christian Hesse		2015-10-12-10/+9143e652
| | | | Signed-off-by: Christian Hesse <mail@eworm.de>
* md2html: the default of stdin works fine
 Jason A. Donenfeld		2015-10-12-2/+13f9e14a
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* filters: misc cleanups
 Jason A. Donenfeld		2015-10-12-2/+1c301899
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* md2html: use pure python
 Jason A. Donenfeld		2015-10-12-6/+9ccb4254
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* cache: fix resource leak: close file handle before return
 Christian Hesse		2015-10-10-3/+976dc7a3
| | | | | Coverity-id: 13910 Signed-off-by: Christian Hesse <mail@eworm.de>
* ui-atom: fix resource leak: free allocation from cgit_pageurl
 Christian Hesse		2015-10-10-1/+4ed5dccb
| | | | | Coverity-id: 13945 Signed-off-by: Christian Hesse <mail@eworm.de>
* ui-atom: fix resource leak: free before return
 Christian Hesse		2015-10-10-1/+2144e3c6
| | | | | Coverity-id: 13946 Signed-off-by: Christian Hesse <mail@eworm.de>
* ui-atom: fix resource leak: free allocation from cgit_repourl
 Christian Hesse		2015-10-10-1/+397da17b
| | | | | Coverity-id: 13947 Signed-off-by: Christian Hesse <mail@eworm.de>
* ui-blob: fix resource leak: free before return
 Christian Hesse		2015-10-10-0/+17320bfa
| | | | | Coverity-id: 13944 Signed-off-by: Christian Hesse <mail@eworm.de>
* ui-blob: fix resource leak: free before return
 Christian Hesse		2015-10-10-0/+13080212
| | | | | Coverity-id: 13943 Signed-off-by: Christian Hesse <mail@eworm.de>
* ui-plain: fix resource leak: free before assigning NULL
 Christian Hesse		2015-10-09-1/+308a2b81
| | | | | Coverity-id: 13939 Signed-off-by: Christian Hesse <mail@eworm.de>
* ui-plain: fix resource leak: free before return
 Christian Hesse		2015-10-09-0/+1979db79
| | | | | Coverity-id: 13940 Signed-off-by: Christian Hesse <mail@eworm.de>
* ui-repolist: fix resource leak: free allocation from cgit_currenturl
 Christian Hesse		2015-10-09-1/+351338f7
| | | | | Coverity-id: 13930 Signed-off-by: Christian Hesse <mail@eworm.de>
* ui-repolist: fix resource leak: free before return
 Christian Hesse		2015-10-09-1/+37ef1a47
| | | | | Coverity-id: 13931 Signed-off-by: Christian Hesse <mail@eworm.de>
* filters: Simplify converters
 Jason A. Donenfeld		2015-10-09-1734/+284525c815
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* ui-shared: fix resource leak: free allocation from cgit_hosturl
 Christian Hesse		2015-10-09-2/+36edfc16
| | | | Signed-off-by: Christian Hesse <mail@eworm.de>
* ui-shared: return value of cgit_hosturl is not const
 Christian Hesse		2015-10-09-4/+4f77e2a8
| | | | Signed-off-by: Christian Hesse <mail@eworm.de>
* cmd: fix resource leak: free allocation from cgit_currenturl and fmtalloc
 Christian Hesse		2015-10-09-3/+76f2e440
| | | | Signed-off-by: Christian Hesse <mail@eworm.de>
* ui-shared: fix resource leak: free allocation from cgit_currenturl
 Christian Hesse		2015-10-09-3/+83e244a0
| | | | | Coverity-id: 13927 Signed-off-by: Christian Hesse <mail@eworm.de>
* ui-shared: return value of cgit_currenturl is not const
 Christian Hesse		2015-10-09-3/+3c5c0eb8
| | | | Signed-off-by: Christian Hesse <mail@eworm.de>
* ui-shared: fix resource leak: free allocation from cgit_fileurl
 Christian Hesse		2015-10-09-5/+1137fce99
| | | | | Coverity-id: 13918 Signed-off-by: Christian Hesse <mail@eworm.de>
* ui-ssdiff: fix resource leak: free allocation from cgit_fileurl
 Christian Hesse		2015-10-09-2/+6fa5810e
| | | | | Coverity-id: 13929 Signed-off-by: Christian Hesse <mail@eworm.de>
* ui-tree: fix resource leak: free before return
 Christian Hesse		2015-10-09-0/+1896cd69
| | | | | Coverity-id: 13938 Signed-off-by: Christian Hesse <mail@eworm.de>
* Avoid use of non-reentrant functions
 Jason A. Donenfeld		2015-10-09-3/+3ad00691
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* Makefile: fix MAKEFLAGS tests with multiple flags
 John Keeping		2015-10-09-1/+135b3c67
| | | | | | | | findstring is defined as $(findstring FIND,IN) so if multiple flags are set these tests do the wrong thing unless $(MAKEFLAGS) is the second argument. Signed-off-by: John Keeping <john@keeping.me.uk>
* ui-refs: remove useless null check
 John Keeping		2015-10-09-1/+1198a440
| | | | | | | There is no way that "tag" can be null here. Coverity-id: 13950 Signed-off-by: John Keeping <john@keeping.me.uk>
* ui-blob: remove useless null check
 John Keeping		2015-10-09-1/+1509488d
| | | | | | | | We have already called strlen() on "path" by the time we get here, so we know it can't be null. Coverity-id: 13954 Signed-off-by: John Keeping <john@keeping.me.uk>
* scan-tree: remove useless strdup()
 John Keeping		2015-10-09-1/+1687cdf6
| | | | | | | | | parse_configfile() takes a "const char *" and doesn't hold any references to it after it returns; there is no reason to pass it a duplicate. Coverity-id: 13941 Signed-off-by: John Keeping <john@keeping.me.uk>
* cgit.c: remove useless null check
 John Keeping		2015-10-09-1/+194182d6
| | | | | | | | Everywhere else in this function we do not check whether the value is null and parse_configfile() never passes a null value to this callback. Coverity-id: 13846 Signed-off-by: John Keeping <john@keeping.me.uk>
* git: update to v2.6.1
 Christian Hesse		2015-10-06-1/+1978ce8c
| | | | | | Update to git version v2.6.1, no changes required. Signed-off-by: Christian Hesse <mail@eworm.de>
* mime: rewrite detection function
 Jason A. Donenfeld		2015-08-17-36/+2673f199b
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* ui-summary: send images plain for about page
 Christian Hesse		2015-08-17-2/+13790d249
| | | | | | | | | The about page used to display just fine, but images were broken: The binary image data was embedded in html code. Use cgit_print_plain() to send images in plain mode and make them available on about page. Signed-off-by: Christian Hesse <mail@eworm.de>
generated by cgit v1.3.1-23-gd82d (git 2.54.0) at 2026-11-08 01:59:48 +0000