Website Summary Files Commits Branches @commit @diff @stats
Commit message (Collapse)AuthorAgeLinesSHA
* cache: use size_t for string lengths
 John Keeping		2016-01-17-2/+23fbfced
| | | | | | | Avoid integer truncation on 64-bit systems. Coverity-id: 13864 Signed-off-by: John Keeping <john@keeping.me.uk>
* ui-log: handle parse_commit() errors
 John Keeping		2016-01-17-1/+3baa5ad1
| | | | | | | | | | | | | If parse_commit() fails, none of the fields in the commit structure will have been populated so we will dereference NULL when accessing item->tree. There isn't much we can do about the error at this point, but if we return true then we'll try parsing the commit again from print_commit() and we can report an error to the user at that point. Coverity-id: 13801 Signed-off-by: John Keeping <john@keeping.me.uk>
* Bump version
 Jason A. Donenfeld		2016-01-14-1/+1e64d5e0
|
* ui-plain: add enable-html-serving flag
 Jason A. Donenfeld		2016-01-14-0/+29c326f3e
| | | | Unrestricts plain/ to contents likely to be executed by browser.
* ui-blob: set CSP just in case
 Jason A. Donenfeld		2016-01-14-0/+39ca2566
|
* ui-blob: always use generic mimetypes
 Jason A. Donenfeld		2016-01-14-6/+492996ac
|
* ui-blob: Do not accept mimetype from user
 Jason A. Donenfeld		2016-01-14-4/+01c581a0
|
* ui-shared: prevent malicious filename from injecting headers
 Jason A. Donenfeld		2016-01-14-3/+32513b386
|
* ui-shared: Avoid new line injection into redirect header
 Jason A. Donenfeld		2016-01-14-1/+34291453
|
* Fix missing prototype declarations
 Peter Colberg		2016-01-14-15/+154c69241
| | | | Signed-off-by: Peter Colberg <peter@colberg.org>
* ui-repolist: return HTTP 404 if no repositories found
 Peter Colberg		2016-01-13-3/+179abe4a2
| | | | | | | | | Return HTTP status code 404 Not found when querying a non-existent repository, which signals to search engines that a repository no longer exists. Further, some webservers such as nginx permit logging requests to different files depending on the HTTP code. Signed-off-by: Peter Colberg <peter@colberg.org>
* ui-repolist: extract repo visibility criteria to separate function
 Peter Colberg		2016-01-13-3/+10a4014d0
| | | | Signed-off-by: Peter Colberg <peter@colberg.org>
* Fix segmentation fault in hc()
 Lukas Fleischer		2016-01-13-0/+3da1b897
| | | | | | | | The ctx.qry.page variable might be unset at this point, e.g. when an invalid command is passed and cgit_print_pageheader() is called to show an error message. Signed-off-by: Lukas Fleischer <lfleischer@lfos.de>
* git: update to v2.7.0
 Christian Hesse		2016-01-13-26/+26559ab5e
| | | | | | | | | | | | | | Update to git version v2.7.0. * Upstream commit ed1c9977cb1b63e4270ad8bdf967a2d02580aa08 (Remove get_object_hash.) changed API: Convert all instances of get_object_hash to use an appropriate reference to the hash member of the oid member of struct object. This provides no functional change, as it is essentially a macro substitution. Signed-off-by: Christian Hesse <mail@eworm.de>
* ui-repolist: initialize char *buf to NULL
 Christian Hesse		2016-01-13-1/+16edc84b
| | | | | | | readfile() can fail if the agefile is not readable. Make sure free() does not free an ininitialized string. Signed-off-by: Christian Hesse <mail@eworm.de>
* filter: avoid integer overflow in authenticate_post
 Jason A. Donenfeld		2015-11-24-1/+14458abf
| | | | | | | | | | | | ctx.env.content_length is an unsigned int, coming from the CONTENT_LENGTH environment variable, which is parsed by strtoul. The HTTP/1.1 spec says that "any Content-Length greater than or equal to zero is a valid value." By storing this into an int, we potentially overflow it, resulting in the following bounding check failing, leading to a buffer overflow. Reported-by: Erik Cabetas <Erik@cabetas.com> Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* about-formatting.sh: comment text out of date
 Jason A. Donenfeld		2015-11-12-1/+1ffe0962
|
* filters: port syntax-highlighting.py to python 3.x
 Christian Hesse		2015-10-12-10/+9143e652
| | | | Signed-off-by: Christian Hesse <mail@eworm.de>
* md2html: the default of stdin works fine
 Jason A. Donenfeld		2015-10-12-2/+13f9e14a
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* filters: misc cleanups
 Jason A. Donenfeld		2015-10-12-2/+1c301899
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* md2html: use pure python
 Jason A. Donenfeld		2015-10-12-6/+9ccb4254
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* cache: fix resource leak: close file handle before return
 Christian Hesse		2015-10-10-3/+976dc7a3
| | | | | Coverity-id: 13910 Signed-off-by: Christian Hesse <mail@eworm.de>
* ui-atom: fix resource leak: free allocation from cgit_pageurl
 Christian Hesse		2015-10-10-1/+4ed5dccb
| | | | | Coverity-id: 13945 Signed-off-by: Christian Hesse <mail@eworm.de>
* ui-atom: fix resource leak: free before return
 Christian Hesse		2015-10-10-1/+2144e3c6
| | | | | Coverity-id: 13946 Signed-off-by: Christian Hesse <mail@eworm.de>
* ui-atom: fix resource leak: free allocation from cgit_repourl
 Christian Hesse		2015-10-10-1/+397da17b
| | | | | Coverity-id: 13947 Signed-off-by: Christian Hesse <mail@eworm.de>
* ui-blob: fix resource leak: free before return
 Christian Hesse		2015-10-10-0/+17320bfa
| | | | | Coverity-id: 13944 Signed-off-by: Christian Hesse <mail@eworm.de>
* ui-blob: fix resource leak: free before return
 Christian Hesse		2015-10-10-0/+13080212
| | | | | Coverity-id: 13943 Signed-off-by: Christian Hesse <mail@eworm.de>
* ui-plain: fix resource leak: free before assigning NULL
 Christian Hesse		2015-10-09-1/+308a2b81
| | | | | Coverity-id: 13939 Signed-off-by: Christian Hesse <mail@eworm.de>
* ui-plain: fix resource leak: free before return
 Christian Hesse		2015-10-09-0/+1979db79
| | | | | Coverity-id: 13940 Signed-off-by: Christian Hesse <mail@eworm.de>
* ui-repolist: fix resource leak: free allocation from cgit_currenturl
 Christian Hesse		2015-10-09-1/+351338f7
| | | | | Coverity-id: 13930 Signed-off-by: Christian Hesse <mail@eworm.de>
* ui-repolist: fix resource leak: free before return
 Christian Hesse		2015-10-09-1/+37ef1a47
| | | | | Coverity-id: 13931 Signed-off-by: Christian Hesse <mail@eworm.de>
* filters: Simplify converters
 Jason A. Donenfeld		2015-10-09-1734/+284525c815
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* ui-shared: fix resource leak: free allocation from cgit_hosturl
 Christian Hesse		2015-10-09-2/+36edfc16
| | | | Signed-off-by: Christian Hesse <mail@eworm.de>
* ui-shared: return value of cgit_hosturl is not const
 Christian Hesse		2015-10-09-4/+4f77e2a8
| | | | Signed-off-by: Christian Hesse <mail@eworm.de>
* cmd: fix resource leak: free allocation from cgit_currenturl and fmtalloc
 Christian Hesse		2015-10-09-3/+76f2e440
| | | | Signed-off-by: Christian Hesse <mail@eworm.de>
* ui-shared: fix resource leak: free allocation from cgit_currenturl
 Christian Hesse		2015-10-09-3/+83e244a0
| | | | | Coverity-id: 13927 Signed-off-by: Christian Hesse <mail@eworm.de>
* ui-shared: return value of cgit_currenturl is not const
 Christian Hesse		2015-10-09-3/+3c5c0eb8
| | | | Signed-off-by: Christian Hesse <mail@eworm.de>
* ui-shared: fix resource leak: free allocation from cgit_fileurl
 Christian Hesse		2015-10-09-5/+1137fce99
| | | | | Coverity-id: 13918 Signed-off-by: Christian Hesse <mail@eworm.de>
* ui-ssdiff: fix resource leak: free allocation from cgit_fileurl
 Christian Hesse		2015-10-09-2/+6fa5810e
| | | | | Coverity-id: 13929 Signed-off-by: Christian Hesse <mail@eworm.de>
* ui-tree: fix resource leak: free before return
 Christian Hesse		2015-10-09-0/+1896cd69
| | | | | Coverity-id: 13938 Signed-off-by: Christian Hesse <mail@eworm.de>
* Avoid use of non-reentrant functions
 Jason A. Donenfeld		2015-10-09-3/+3ad00691
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* Makefile: fix MAKEFLAGS tests with multiple flags
 John Keeping		2015-10-09-1/+135b3c67
| | | | | | | | findstring is defined as $(findstring FIND,IN) so if multiple flags are set these tests do the wrong thing unless $(MAKEFLAGS) is the second argument. Signed-off-by: John Keeping <john@keeping.me.uk>
* ui-refs: remove useless null check
 John Keeping		2015-10-09-1/+1198a440
| | | | | | | There is no way that "tag" can be null here. Coverity-id: 13950 Signed-off-by: John Keeping <john@keeping.me.uk>
* ui-blob: remove useless null check
 John Keeping		2015-10-09-1/+1509488d
| | | | | | | | We have already called strlen() on "path" by the time we get here, so we know it can't be null. Coverity-id: 13954 Signed-off-by: John Keeping <john@keeping.me.uk>
* scan-tree: remove useless strdup()
 John Keeping		2015-10-09-1/+1687cdf6
| | | | | | | | | parse_configfile() takes a "const char *" and doesn't hold any references to it after it returns; there is no reason to pass it a duplicate. Coverity-id: 13941 Signed-off-by: John Keeping <john@keeping.me.uk>
* cgit.c: remove useless null check
 John Keeping		2015-10-09-1/+194182d6
| | | | | | | | Everywhere else in this function we do not check whether the value is null and parse_configfile() never passes a null value to this callback. Coverity-id: 13846 Signed-off-by: John Keeping <john@keeping.me.uk>
* git: update to v2.6.1
 Christian Hesse		2015-10-06-1/+1978ce8c
| | | | | | Update to git version v2.6.1, no changes required. Signed-off-by: Christian Hesse <mail@eworm.de>
* mime: rewrite detection function
 Jason A. Donenfeld		2015-08-17-36/+2673f199b
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* ui-summary: send images plain for about page
 Christian Hesse		2015-08-17-2/+13790d249
| | | | | | | | | The about page used to display just fine, but images were broken: The binary image data was embedded in html code. Use cgit_print_plain() to send images in plain mode and make them available on about page. Signed-off-by: Christian Hesse <mail@eworm.de>
* refactor get_mimetype_from_file() to get_mimetype_for_filename()
 Christian Hesse		2015-08-17-47/+40aa943bc
| | | | | | | * handle mimetype within a single function * return allocated memory on success Signed-off-by: Christian Hesse <mail@eworm.de>
generated by cgit v1.3.1-23-gd82d (git 2.54.0) at 2026-11-11 18:53:16 +0000