This helps tracking what git version cgit uses. The security implications are
low as anybody can look up the version of our submodule anyway. The paranoid
can use a custom footer. :-p
On the other hand this brings potential security issues to the
administrators eyes...
Signed-off-by: Christian Hesse <mail@eworm.de>
Update to git version v2.17.1. Required changes:
* The function 'typename' has been renamed to 'type_name'
(upstream commit debca9d2fe784193dc2d9f98b5edac605ddfefbb)
Signed-off-by: Christian Hesse <mail@eworm.de>
Way back in 2009 all of these were lower cased except this one
occurrence.
Signed-off-by: Jon DeVree <nuxi@vault24.org>
Signed-off-by: John Keeping <john@keeping.me.uk>
This is mostly taken from Git's doc/Makefile, although simplified for
our use. The output now uses Asciidoc's default CSS which I think looks
a bit nicer than the Docbook formatting; as a result of this we no
longer need our custom .css file.
A side effect of this change is that temporary files generated from the
HTML output no longer conflict with the manpage output format (because
any temporary HTML output files use names derived from the output
filename which includes .html).
Signed-off-by: John Keeping <john@keeping.me.uk>
The html documentation is generated using a2x which calls docbook tools
to do the work. The generate.consistent.ids parameter ensures that when
the docbook stylesheet assigns an id value to an output element it is
consistent as long as the document structure has not changed.
Having consistent html files reduces frivolous changes between builds.
Distributions can more easily deploy multiple architecture builds and
compare changes between package versions. End-users avoid needless
changes in files deployed or backed up.
The generate.consistent.ids parameter was added in docbook-xsl-1.77.0.
Older versions gracefully ignore the parameter, so we can pass the
parameter unconditionally. Most distributions contain docbook-xsl newer
than 1.77.0. This includes Fedora, Debian, Ubuntu, and RHEL/CentOS 7.
RHEL/CentOS 6 and Debian Wheezy (old stable) ship with an older version,
unsurprisingly.
Signed-off-by: Todd Zullinger <tmz@pobox.com>
Place file contents into a single block so that syntax highlighting can
be applied in the usual fashion. Place the alternating color bars
behind the file contents. Force the default syntax highlighting
background to transparent.
Signed-off-by: Jeff Smith <whydoubt@gmail.com>
Reviewed-by: John Keeping <john@keeping.me.uk>
Update to git version v2.16.0:
* refs: convert resolve_ref_unsafe to struct object_id
(49e61479be913f67e66bb3fdf8de9475c41b58bd)
* diff: remove DIFF_OPT_SET macro
(23dcf77f48feb49c54bad09210f093a799816334)
* log: add option to choose which refs to decorate
(65516f586b69307f977cd67cc45513a296cabc25)
* diff: convert flags to be stored in bitfields
(02f2f56bc377c287c411947d0e1482aac888f8db)
Signed-off-by: Christian Hesse <mail@eworm.de>
Update to git version v2.15.1: With commit 0abe14f6 prepare_packed_git()
moved to packfile.[ch].
Signed-off-by: Christian Hesse <mail@eworm.de>
Reviewed-by: John Keeping <john@keeping.me.uk>
Since commit c699866 (parsing: clear query path before starting,
2017-02-19), we clear the "page" variable simply by calling
cgit_parse_url() even if the URL is empty. This breaks a URL like:
.../cgit?p=about
which is generated when using the "root-readme" configuration option.
This happens because "page" is set to "about" when parsing the query
string before we handle the path (which is empty, but non-null).
It turns out that this is not the only case which is broken, but
specifying repository and page via query options has been broken since
before the commit mentioned above, for example:
.../cgit?r=git&p=log
Fix both of these by allowing the previous state to persist if PATH_INFO
is empty, falling back to the query parameters if no path has been
requested.
Reported-by: Tom Ryder <tom@sanctum.geek.nz>
Signed-off-by: John Keeping <john@keeping.me.uk>
Implement a page which provides the blame view of a specified file.
This feature is controlled by a new config variable, "enable-blame",
which is disabled by default.
Signed-off-by: Jeff Smith <whydoubt@gmail.com>
Reviewed-by: John Keeping <john@keeping.me.uk>
All cgit_xxx_link functions take const char* for the 'name' parameter,
except for cgit_commit_link, which takes a char* and subsequently
modifies the contents. Avoiding the content changes, and making it
const char* will avoid the need to make copies of const char* strings
being passed to cgit_commit_link.
Signed-off-by: Jeff Smith <whydoubt@gmail.com>
Reviewed-by: John Keeping <john@keeping.me.uk>
The ui-blame code will also need to call set_title_from_path, so go
ahead and move it to ui-shared.
Signed-off-by: Jeff Smith <whydoubt@gmail.com>
Reviewed-by: John Keeping <john@keeping.me.uk>
For implementing a ui-blame page, there is need for a function that
outputs a selection from a block of text, transformed for HTML output,
but with no further modifications or additions.
Signed-off-by: Jeff Smith <whydoubt@gmail.com>
Reviewed-by: John Keeping <john@keeping.me.uk>
As described in commit 2efb59e (ui-patch: Flush stdout after outputting
data, 2014-06-11), we need to ensure that stdout is flushed before
restoring the file descriptor when writing to the cache. It turns out
that it's not just ui-patch that is affected by this but also raw diff
which writes to stdout internally.
Let's avoid risking more places doing this by ensuring that stdout is
flushed after writing in fill_slot().
Signed-off-by: John Keeping <john@keeping.me.uk>
The git protocol provides no transport security. https does provide
transport security and should be preferred by default. https is also
more likely than git to be permitted by firewalls in restricted
environments.
Signed-off-by: Daniel M. Weeks <dan@danweeks.net>
We currently ignore symlinks in ui-plain, leading to a 404. In ui-tree
we print the content of the blob (that is, the path to the target of the
link), so it makes sense to do the same here.
Signed-off-by: John Keeping <john@keeping.me.uk>
After the previous two patches, this can be classified as a tidy up
rather than a bug fix, but I think it makes sense to group all of the
tests together before setting up the environment for the command to
execute.
Signed-off-by: John Keeping <john@keeping.me.uk>
By specifying the "url" query parameter multiple times it is possible to
end up with ctx.qry.vpath set while ctx.repo is null, which triggers an
invalid code path from cgit_print_pageheader() while printing path
crumbs, resulting in a null dereference.
The previous patch fixed this segfault, but it makes no sense for us to
clear ctx.repo while leaving ctx.qry.path set to the previous value, so
let's just clear it here so that the last "url" parameter given takes
full effect rather than partially overriding the effect of the previous
value.
Signed-off-by: John Keeping <john@keeping.me.uk>
cgit_print_path_crumbs() can call repolink() which assumes that ctx.repo
is non-null. Currently we don't have any commands that set want_vpath
without also setting want_repo so it shouldn't be possible to fail this
test, but the check in cgit.c is in the wrong order so it is possible to
specify a query string like "?p=log&path=foo/bar" to end up here without
a valid repository.
This was found by American fuzzy lop [0].
[0] http://lcamtuf.coredump.cx/afl/
Signed-off-by: John Keeping <john@keeping.me.uk>
If the delimiter here is '&' then it needs to be escaped for inclusion
in an attribute. Use html_attrf() to ensure that this happens (we know
that hex won't need escaping, but this makes it clearer what's
happening.
Signed-off-by: John Keeping <john@keeping.me.uk>
Numerous changes were made to git functions to use an object_id
structure rather than sending sha1 hashes as raw unsigned character
arrays. The functions that affect cgit are: parse_object,
lookup_commit_reference, lookup_tag, lookup_tree, parse_tree_indirect,
diff_root_tree_sha1, diff_tree_sha1, and format_display_notes.
Commit b2141fc (config: don't include config.h by default) made it
necessary to that config.h be explicitly included when needed.
Commit 07a3d41 (grep: remove regflags from the public grep_opt API)
removed one way of specifying the ignore-case grep option.
Signed-off-by: Jeff Smith <whydoubt@gmail.com>
Update to git version v2.13.4: With commit 8aee769f (pathspec: copy and free
owned memory) the definition of struct pathspec_item has changed with the
expectation that pathspecs will be managed dynamically. We work around this
a bit by setting up a static structure, but let's allocate the match string
to avoid needing to cast away const.
Updated a patch from John Keeping <john@keeping.me.uk> for git v2.12.1.
When empty repos exist, comparing them against an existing repo with a
good mtime might, with particular qsort implementations, not sort
correctly, because of this brokenness:
if (get_repo_modtime(r1, &t) && get_repo_modtime(r2, &t))
However, sorting by the age column works as expected, so anyway, to tidy
things up, we simply reuse that function.
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
The array passed to setup_revisions() must be NULL-terminated. Fixes a
regression introduced in 455b598 (ui-patch.c: Use log_tree_commit() to
generate diffs, 2013-08-20).
Reported-by: Florian Pritz <bluewind@xinu.at>
Signed-off-by: Lukas Fleischer <lfleischer@lfos.de>
The submodule was accidentally downgraded in commit 8e9ddd21 (Bump
version, 2016-11-23). Restore v2.10.2 so it matches the makefile again.
Signed-off-by: John Keeping <john@keeping.me.uk>
We have to use a pointer for walk_tree_ctx->matched_oid.
This fixes faulty commit 6e4b7b6776
(ui-blob: replace 'unsigned char sha1[20]' with 'struct object_id oid').
This was originally applied added in commit eac1b67 (ui-patch: Apply
path limit to generated patch, 2010-06-10) but the ability to limit
patches to particular paths was lost in commit 455b598 (ui-patch.c: Use
log_tree_commit() to generate diffs, 2013-08-20).
The new output is slightly different from the original because Git's
diff infrastructure doesn't give us a way to insert an annotation
immediately after the "---" separator, so the commit has moved below the
diff stat.
Signed-off-by: John Keeping <john@keeping.me.uk>
