| Commit message (Collapse) | Author | Age | Files | Lines |
| | |
|
| | |
|
| |
|
|
| |
removed remnant dashed border
|
| |
|
|
| |
differently
|
| | |
|
| |
|
|
| |
spacing units.
|
| | |
|
| | |
|
| | |
|
| | |
|
| |
|
|
| |
mobile devices.
|
| |
|
|
| |
updated css to adapt to mobile phones
|
| |
|
|
| |
minor fixes to improve the scrolling experience on mobile phones.
|
| |
|
|
| |
friendly even on small devices.
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| |
|
|
| |
remnants
|
| | |
|
| | |
|
| | |
|
| |
|
|
| |
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
|
| |
|
|
| |
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Update to git version v2.54.0, this requires changes for these
upstream commits:
* d9ecf268ef3f69130fa269012318470d908978f6
odb: embed base source in the "files" backend
* cb506a8a69c953f7b87bb3ae099e0bed8218d3ab
odb: introduce "files" source
... and probably more related.
Signed-off-by: Christian Hesse <mail@eworm.de>
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
These would be largely invalid anyway (save, I suppose, for Linux file
paths that technically can contain new lines).
The actual problem is that these get printed back out into cached -- and
trusted -- cgitrc files, and if the fields have newlines, the git-config
way of less trusted users configuring repos on a shared system can be
abused to inject newlines, which then can be used to smuggle global
options (including filters, which execute code) into the cached cgitrc.
So now, only ever duplicate up to the newline, when dealing with these
inputs.
Reported-by: Adrian Denkiewicz <adrian@doyensec.com>
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
|
| |
|
|
| |
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
|
| |
|
|
|
|
|
| |
There's no reason to pass around function pointers. It was never used
for anything beyond one function.
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
lock_slot() opens the lock file with O_RDWR|O_CREAT but without
O_TRUNC. If a previous cgit process was killed between lock_slot() and
unlock_slot() (e.g. by a CGI timeout or OOM), the stale lock file
remains on disk with the old content, and the kernel releases the fcntl
lock.
The next process to claim the same cache slot then opens this stale lock
file, acquires the fcntl lock, writes its key and generated content on
top of the old bytes. If the new response is shorter than what was
previously in the file, trailing bytes from the old response survive
beyond the end of the new content. fstat() in fill_slot() reports the
total file size (including the stale tail), and print_slot() faithfully
sends all of it -- producing a response that is the correct page
followed by a fragment of whatever previously occupied that lock file.
Fix this by truncating the lock file after acquiring the lock and before
writing the new key.
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
We don't get any return value from compile_grep_patterns calling
compile_regexp_failed, causing the default die routine to print to
stderr and then for cgit to exit ungracefully.
Instead override the default die routine to show a normal error page.
Perhaps compile_grep_patterns ought to change upstream to return an
error. But this commit here will handle future issues as well, so
perhaps not a bad idea to do anyway.
Link: https://lists.zx2c4.com/pipermail/cgit/2026-March/004982.html
Link: https://lists.zx2c4.com/pipermail/cgit/2026-March/004983.html
Reported-by: Adrian C. <anrxc@sysphere.org>
Reported-by: Aiden Woodruff <aiden@aidenw.net>
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
|
| |
|
|
|
|
|
| |
This exists for other CPU heavy operations like blame, but doesn't for
the follow functionality. Add it for that.
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
|
| |
|
|
| |
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
|
| |
|
|
|
|
|
|
|
| |
In git 2.36, the logic for diff_flush() changed, resulting in our object
getting freed, which led to following renames producing garbage commits
until it eventually crashed.
Fixes: bb02e24 ("git: update to v2.36.0")
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
|
| |
|
|
| |
Signed-off-by: Christian Hesse <mail@eworm.de>
|
| |
|
|
|
|
|
| |
... specified in the URL, with a curved arrow ahead of the line number.
Signed-off-by: Loïc <lagiraudiere+cgit@free.fr>
Signed-off-by: Christian Hesse <mail@eworm.de>
|
| |
|
|
|
| |
Signed-off-by: Christian Barcenas <christian@cbarcenas.com>
Signed-off-by: Christian Hesse <mail@eworm.de>
|
| |
|
|
|
| |
Signed-off-by: Christian Barcenas <christian@cbarcenas.com>
Signed-off-by: Christian Hesse <mail@eworm.de>
|
| |
|
|
|
|
|
|
|
|
| |
Since the favicon setting defaults to "/favicon.ico", the user can
only unset it with favicon=. However, that would write an empty string
as the config value. Previously, such empty string always satisfied
the if condition. In this case it is better to omit the <link> entirely.
Signed-off-by: Christian Barcenas <christian@cbarcenas.com>
Signed-off-by: Christian Hesse <mail@eworm.de>
|