Welcome to mirror list, hosted at ThFree Co, Russian Federation.

git.kernel.org/pub/scm/git/git.git - Unnamed repository; edit this file 'description' to name the repository.
summaryrefslogtreecommitdiff
path: root/gitweb
AgeCommit message (Collapse)Author
2012-03-13Merge branch 'jn/maint-do-not-match-with-unsanitized-searchtext' into maintJunio C Hamano
"gitweb" did use quotemeta() to prepare search string when asked to do a fixed-string project search, but did not use it by mistake and used the user-supplied string instead. By Jakub Narebski * jn/maint-do-not-match-with-unsanitized-searchtext: gitweb: Fix fixed string (non-regexp) project search
2012-03-07gitweb: Fix fixed string (non-regexp) project searchJakub Narebski
Use $search_regexp, where regex metacharacters are quoted, for searching projects list, rather than $searchtext, which contains original search term. Reported-by: Ramsay Jones <ramsay@ramsay1.demon.co.uk> Signed-off-by: Jakub Narebski <jnareb@gmail.com> Signed-off-by: Junio C Hamano <gitster@pobox.com>
2012-03-05Merge branch 'jn/maint-gitweb-invalid-regexp' into maintJunio C Hamano
* jn/maint-gitweb-invalid-regexp: gitweb: Handle invalid regexp in regexp search
2012-02-28gitweb: Handle invalid regexp in regexp searchJakub Narebski
When using regexp search ('sr' parameter / $search_use_regexp variable is true), check first that regexp is valid. Without this patch we would get an error from Perl during search (if searching is performed by gitweb), or highlighting matches substring (if applicable), if user provided invalid regexp... which means broken HTML, with error page (including HTTP headers) generated after gitweb already produced some output. Add test that illustrates such error: for example for regexp "*\.git" we would get the following error: Quantifier follows nothing in regex; marked by <-- HERE in m/* <-- HERE \.git/ at /var/www/cgi-bin/gitweb.cgi line 3084. Reported-by: Ramsay Jones <ramsay@ramsay1.demon.co.uk> Signed-off-by: Jakub Narebski <jnareb@gmail.com> Signed-off-by: Junio C Hamano <gitster@pobox.com>
2012-02-28Merge branch 'jn/gitweb-unborn-head' into maintJunio C Hamano
* jn/gitweb-unborn-head: gitweb: Fix "heads" view when there is no current branch
2012-02-20gitweb: Fix 'grep' search for multiple matches in fileJakub Narebski
Commit ff7f218 (gitweb: Fix file links in "grep" search, 2012-01-05), added $file_href variable, to reduce duplication and have the fix applied in single place. Unfortunately it made variable defined inside the loop, not taking into account the fact that $file_href was set only if file changed. Therefore for files with multiple matches $file_href was undefined for second and subsequent matches. Fix this bug by moving $file_href declaration outside loop. Adds tests for almost all forms of sarch in gitweb, which were missing from testuite. Note that it only tests if there are no warnings, and it doesn't check that gitweb finds what it should find. Signed-off-by: Jakub Narebski <jnareb@gmail.com> Signed-off-by: Junio C Hamano <gitster@pobox.com>
2012-02-17gitweb: Fix "heads" view when there is no current branchJakub Narebski
In a repository whose HEAD points to an unborn branch with no commits, "heads" view and "summary" view (which shows what is shown in "heads" view) compared the object names of commits at the tip of branches with the output from "git rev-parse HEAD", which caused comparison of a string with undef and resulted in a warning in the server log. This can happen if non-bare repository (with default 'master' branch) is updated not via committing but by other means like push to it, or Gerrit. It can happen also just after running "git checkout --orphan <new branch>" but before creating any new commit on this branch. Rewrite the comparison so that it also works when $head points at nothing; in such a case, no branch can be "the current branch", add a test for it. While at it, rename local variable $head to $head_at, as it points to current commit rather than current branch name (HEAD contents). The code still incorrectly shows all branches that point at the same commit as what HEAD points as "the current branch", even when HEAD is detached. Fixing this bug is outside the scope of this patch. Reported-by: Rajesh Boyapati Signed-off-by: Jakub Narebski <jnareb@gmail.com> Signed-off-by: Junio C Hamano <gitster@pobox.com>
2012-02-04gitweb: Allow UTF-8 encoded CGI query parameters and path_infoJakub Narebski
Gitweb forgot to turn query parameters into UTF-8. This results in a bug that one cannot search for a string with characters outside US-ASCII. For example searching for "Michał Kiedrowicz" (containing letter 'ł' - LATIN SMALL LETTER L WITH STROKE, with Unicode codepoint U+0142, represented with 0xc5 0x82 bytes in UTF-8 and percent-encoded as %C5%82) result in the following incorrect data in search field MichaÅ\202 Kiedrowicz This is caused by CGI by default treating '0xc5 0x82' bytes as two characters in Perl legacy encoding latin-1 (iso-8859-1), because 's' query parameter is not processed explicitly as UTF-8 encoded string. The solution used here follows "Using Unicode in a Perl CGI script" article on http://www.lemoda.net/cgi/perl-unicode/index.html: use CGI; use Encode 'decode_utf8; my $value = params('input'); $value = decode_utf8($value); Decoding UTF-8 is done when filling %input_params hash and $path_info variable; the former requires to move from explicit $cgi->param(<label>) to $input_params{<name>} in a few places, which is a good idea anyway. Also add -override=>1 parameter to $cgi->textfield() invocation in search form. Otherwise CGI would use values from query string if it is present, filling value from $cgi->param... without decode_utf8(). As we are using value of appropriate parameter anyway, -override=>1 doesn't change the situation but makes gitweb fill search field correctly. We could simply use the '-utf8' pragma (via "use CGI '-utf8';") to solve this, but according to CGI.pm documentation, it may cause problems with POST requests containing binary files, and it requires CGI 3.31 (I think), released with perl v5.8.9. Reported-by: Michał Kiedrowicz <michal.kiedrowicz@gmail.com> Signed-off-by: Jakub Narębski <jnareb@gmail.com> Tested-by: Michał Kiedrowicz <michal.kiedrowicz@gmail.com> Signed-off-by: Junio C Hamano <gitster@pobox.com>
2012-01-17Merge branch 'jn/maint-gitweb-grep-fix'Junio C Hamano
* jn/maint-gitweb-grep-fix: gitweb: Harden "grep" search against filenames with ':' gitweb: Fix file links in "grep" search
2012-01-10Merge branch 'mm/maint-gitweb-project-maxdepth'Junio C Hamano
* mm/maint-gitweb-project-maxdepth: gitweb: accept trailing "/" in $project_list
2012-01-06gitweb: Harden "grep" search against filenames with ':'Jakub Narebski
Run "git grep" in "grep" search with '-z' option, to be able to parse response also for files with filename containing ':' character. The ':' character is otherwise (without '-z') used to separate filename from line number and from matched line. Note that this does not protect files with filename containing embedded newline. This would be hard but doable for text files, and harder or even currently impossible with binary files: git does not quote filename in "Binary file <foo> matches" message, but new `--break` and/or `--header` options to git-grep could help here. Signed-off-by: Jakub Narebski <jnareb@gmail.com> Signed-off-by: Junio C Hamano <gitster@pobox.com>
2012-01-06gitweb: Fix file links in "grep" searchJakub Narebski
There were two bugs in generating file links (links to "blob" view), one hidden by the other. The correct way of generating file link is href(action=>"blob", hash_base=>$co{'id'}, file_name=>$file); It was $co{'hash'} (this key does not exist, and therefore this is undef), and 'hash' instead of 'hash_base'. To have this fix applied in single place, this commit also reduces code duplication by saving file link (which is used for line links) in $file_href. Reported-by: Thomas Perl <th.perl@gmail.com> Signed-off-by: Jakub Narebski <jnareb@gmail.com> Signed-off-by: Junio C Hamano <gitster@pobox.com>
2012-01-04gitweb: accept trailing "/" in $project_listMatthieu Moy
The current code is removing the trailing "/", but computing the string length on the previous value, i.e. with the trailing "/". Later in the code, we do my $path = substr($File::Find::name, $pfxlen + 1); And the "$pfxlen + 1" is supposed to mean "the length of the prefix, plus 1 for the / separating the prefix and the path", but with an incorrect $pfxlen, this basically eats the first character of the path, and yields "404 - No projects found". While we're there, also fix $pfxdepth to use $dir, although a change of 1 in the depth shouldn't really matter. Signed-off-by: Matthieu Moy <Matthieu.Moy@imag.fr> Signed-off-by: Junio C Hamano <gitster@pobox.com>
2011-12-23Merge branch 'jn/maint-gitweb-utf8-fix'Junio C Hamano
* jn/maint-gitweb-utf8-fix: gitweb: Fix fallback mode of to_utf8 subroutine gitweb: Output valid utf8 in git_blame_common('data') gitweb: esc_html() site name for title in OPML gitweb: Call to_utf8() on input string in chop_and_escape_str()
2011-12-20gitweb: Fix fallback mode of to_utf8 subroutineJakub Narebski
e5d3de5 (gitweb: use Perl built-in utf8 function for UTF-8 decoding., 2007-12-04) was meant to make gitweb faster by using Perl's internals (see subsection "Messing with Perl's Internals" in Encode(3pm) manpage) Simple benchmark confirms that (old = 00f429a, new = this version): old new old -- -65% new 189% -- Unfortunately it made fallback mode of to_utf8 do not work... except for default value 'latin1' of $fallback_encoding ('latin1' is Perl native encoding), which is why it was not noticed for such long time. utf8::valid(STRING) is an internal function that tests whether STRING is in a _consistent state_ regarding UTF-8. It returns true is well-formed UTF-8 and has the UTF-8 flag on _*or*_ if string is held as bytes (both these states are 'consistent'). For gitweb the second option was true, as output from git commands is opened without ':utf8' layer. What made it work at all for STRING in 'latin1' encoding is the fact that utf8:decode(STRING) turns on UTF-8 flag only if source string is valid UTF-8 and contains multi-byte UTF-8 characters... and that if string doesn't have UTF-8 flag set it is treated as in native Perl encoding, i.e. 'latin1' / 'iso-8859-1' (unless native encoding it is EBCDIC ;-)). It was ':utf8' layer that actually converted 'latin1' (no UTF-8 flag == native == 'latin1) to 'utf8'. Let's make use of the fact that utf8:decode(STRING) returns false if STRING is invalid as UTF-8 to check whether to enable fallback mode. Signed-off-by: Jakub Narebski <jnareb@gmail.com> Signed-off-by: Junio C Hamano <gitster@pobox.com>
2011-12-19gitweb: Output valid utf8 in git_blame_common('data')Jürgen Kreileder
Otherwise when javascript-actions are enabled gitweb shown broken author names in the tooltips on blame pages ('blame_incremental' view). Signed-off-by: Jürgen Kreileder <jk@blackdown.de> Acked-by: Jakub Narębski <jnareb@gmail.com> Signed-off-by: Junio C Hamano <gitster@pobox.com>
2011-12-19gitweb: esc_html() site name for title in OPMLJürgen Kreileder
This escapes the site name in OPML (XML uses the same escaping rules as HTML). Also fixes encoding issues because esc_html() uses to_utf8(). Signed-off-by: Jürgen Kreileder <jk@blackdown.de> Acked-by: Jakub Narębski <jnareb@gmail.com> Signed-off-by: Junio C Hamano <gitster@pobox.com>
2011-12-19gitweb: Call to_utf8() on input string in chop_and_escape_str()Jürgen Kreileder
a) To fix the comparison with the chopped string, otherwise we compare bytes with characters, as chop_str() must run to_utf8() for correct operation b) To give the title attribute correct encoding; we need to mark strings as UTF-8 before outpur Signed-off-by: Jürgen Kreileder <jk@blackdown.de> Acked-by: Jakub Narębski <jnareb@gmail.com> Signed-off-by: Junio C Hamano <gitster@pobox.com>
2011-11-01gitweb: Add navigation to select side-by-side diffKato Kazuyoshi
Add to the lower part of navigation bar (the action specific part) links allowing to switch between 'inline' (ordinary) diff and 'side by side' style diff. It is not shown for combined / compact combined diff. Signed-off-by: Kato Kazuyoshi <kato.kazuyoshi@gmail.com> Signed-off-by: Jakub Narebski <jnareb@gmail.com> Signed-off-by: Junio C Hamano <gitster@pobox.com>
2011-11-01gitweb: Use href(-replay=>1,...) for formats links in "commitdiff"Jakub Narebski
Use href(-replay->1,...) in (sub)navigation links (like changing style of view, or going to parent commit) so that extra options are preserved. This is needed so clicking on such (sub)navigation link would preserve style of diff; for example when using "side-by-side" diff style then going to parent commit would now also use this style. Signed-off-by: Jakub Narebski <jnareb@gmail.com> Signed-off-by: Junio C Hamano <gitster@pobox.com>
2011-11-01gitweb: Give side-by-side diff extra CSS stylingJakub Narebski
Use separate background colors for pure removal, pure addition and change for side-by-side diff. This makes reading such diff easier, allowing to easily distinguish empty lines in diff from vertical whitespace used to align chunk blocks. Note that if lines in diff were numbered, the absence of line numbers [for one side] would help in distinguishing empty lines from vertical align. Signed-off-by: Jakub Narebski <jnareb@gmail.com> Signed-off-by: Junio C Hamano <gitster@pobox.com>
2011-11-01gitweb: Add a feature to show side-by-side diffKato Kazuyoshi
This commits adds to support for showing "side-by-side" style diff. Currently you have to hand-craft the URL; navigation for selecting diff style is to be added in the next commit. The diff output in unified format from "git diff-tree" is reorganized to side-by-side style chunk by chunk with format_sidebyside_diff_chunk(). This reorganization requires knowledge about diff line classification, so format_diff_line() was renamed to process_diff_line(), and changed to return tuple (list) consisting of class of diff line and of HTML-formatted (but not wrapped in <div class="diff ...">...</div>) diff line. Wrapping is now done by caller, i.e. git_patchset_body(). Gitweb uses float+margin CSS-based layout for "side by side" diff. You can specify style of diff with "ds" ('diff_style') query parameter. Currently supported values are 'inline' and 'sidebyside'; the default is 'inline'. Another solution would be to use "opt" ('extra_options') for that... though current use of it in gitweb seems to suggest that "opt" is more about passing extra options to underlying git commands, and "git diff" doesn't support '--side-by-side' like GNU diff does, (yet?). Signed-off-by: Kato Kazuyoshi <kato.kazuyoshi@gmail.com> Signed-off-by: Jakub Narebski <jnareb@gmail.com> Signed-off-by: Junio C Hamano <gitster@pobox.com>
2011-11-01gitweb: Extract formatting of diff chunk headerJakub Narebski
Refactor main parts of HTML-formatting for diff chunk headers (formatting means here adding links and syntax hightlighting) into separate subroutines: * format_unidiff_chunk_header for ordinary diff, * format_cc_diff_chunk_header for combined diff (more than one parent) This makes format_diff_line() subroutine easier to follow. Signed-off-by: Jakub Narebski <jnareb@gmail.com> Signed-off-by: Junio C Hamano <gitster@pobox.com>
2011-11-01gitweb: Refactor diff body line classificationJakub Narebski
Simplify classification of diff line body in format_diff_line(), replacing two long if-elsif chains (one for ordinary diff and one for combined diff of a merge commit) with a single regexp match. Refactor this code into diff_line_class() function. While at it: * Fix an artifact in that $diff_class included leading space to be able to compose classes like this "class=\"diff$diff_class\"', even when $diff_class was an empty string. This made code unnecessary ugly: $diff_class is now just class name or an empty string. * Introduce "ctx" class for context lines ($diff_class was set to "" in this case before this commit). Idea and initial code by Junio C Hamano, polish and testing by Jakub Narebski. Inspired by patch adding side-by-side diff by Kato Kazuyoshi, which required $diff_class to be name of class without extra space. Signed-off-by: Junio C Hamano <gitster@pobox.com> Signed-off-by: Jakub Narebski <jnareb@gmail.com> Signed-off-by: Junio C Hamano <gitster@pobox.com>
2011-10-27Merge branch 'rj/gitweb-clean-js'Junio C Hamano
* rj/gitweb-clean-js: gitweb/Makefile: Remove static/gitweb.js in the clean target
2011-10-27Merge branch 'lh/gitweb-site-html-head'Junio C Hamano
* lh/gitweb-site-html-head: gitweb: provide a way to customize html headers
2011-10-27Merge branch 'jm/maint-gitweb-filter-forks-fix'Junio C Hamano
* jm/maint-gitweb-filter-forks-fix: gitweb: fix regression when filtering out forks
2011-10-27Merge branch 'ps/gitweb-js-with-lineno' into maint-1.7.6Junio C Hamano
* ps/gitweb-js-with-lineno: gitweb: Fix links to lines in blobs when javascript-actions are enabled
2011-10-27gitweb/Makefile: Remove static/gitweb.js in the clean targetRamsay Jones
Since 9a86dd5 (gitweb: Split JavaScript for maintability, combining on build, 2011-04-28), static/gitweb.js has been a build product that should be cleaned upon "make clean". Signed-off-by: Ramsay Jones <ramsay@ramsay1.demon.co.uk> Signed-off-by: Junio C Hamano <gitster@pobox.com>
2011-10-22gitweb: fix regression when filtering out forksJulien Muchembled
This fixes a condition in filter_forks_from_projects_list that failed if process directory was different from project root: in such case, the subroutine was a no-op and forks were not detected. Signed-off-by: Julien Muchembled <jm@jmuchemb.eu> Tested-by: Jakub Narebski <jnareb@gmail.com> Signed-off-by: Junio C Hamano <gitster@pobox.com>
2011-10-21gitweb: provide a way to customize html headersLénaïc Huard
This allows web sites to add some specific html headers to the pages generated by gitweb. The new variable $site_html_head_string can be set to an html snippet that will be inserted at the end of the <head> section of each page generated by gitweb. Signed-off-by: Lénaïc Huard <lenaic@lhuard.fr.eu.org> Signed-off-by: Junio C Hamano <gitster@pobox.com>
2011-10-19Merge branch 'jn/gitweb-manpages'Junio C Hamano
* jn/gitweb-manpages: gitweb: Add gitweb manpages to 'gitweb' package in git.spec Documentation: Add gitweb config variables to git-config(1) Documentation: Link to gitweb(1) and gitweb.conf(5) in other manpages gitweb: Add gitweb(1) manpage for gitweb itself gitweb: Add gitweb.conf(5) manpage for gitweb configuration files
2011-10-16gitweb: Add gitweb(1) manpage for gitweb itselfJakub Narebski
Most of what is in gitweb.txt it has been pulled directly from the README and INSTALL files of gitweb. Current version is somewhat based on structure of SVN::Web manpage (one of web interfaces for Subversion). gitweb.conf(5) i.e. gitweb configuration manpage now refers to appropriate sections in gitweb(1). gitweb/README now refers to gitweb/INSTALL and gitweb(1) manpage. gitweb/INSTALL now refers to gitweb.conf(5) and gitweb(1). Inspired-by: Drew Northup <drew.northup@maine.edu> Signed-off-by: Jakub Narebski <jnareb@gmail.com> Signed-off-by: Junio C Hamano <gitster@pobox.com>
2011-10-16gitweb: Add gitweb.conf(5) manpage for gitweb configuration filesDrew Northup
Much of what is in gitweb.conf.txt has been pulled directly from the README file of gitweb. The manpage was supplemented with description of missing gitweb config variables, and with description of gitweb's %features. There remains a bit of redundancy, which should be reduced if possible... but I think some of duplication of information is inevitable. [jn: Improved, extended, removed duplicate info from README] Signed-off-by: Drew Northup <drew.northup@maine.edu> Signed-off-by: Jakub Narebski <jnareb@gmail.com> Helped-by: Jonathan Nieder <jrnieder@gmail.com> Signed-off-by: Junio C Hamano <gitster@pobox.com>
2011-10-11Merge branch 'ps/gitweb-js-with-lineno'Junio C Hamano
* ps/gitweb-js-with-lineno: gitweb: Fix links to lines in blobs when javascript-actions are enabled
2011-09-27gitweb: Fix links to lines in blobs when javascript-actions are enabledPeter Stuge
The fixLinks() function adds 'js=1' to each link that does not already have 'js' query parameter specified. This is used to signal to gitweb that the browser can actually do javascript when these links are used. There are two problems with the existing code: 1. URIs with fragment and 'js' query parameter, like e.g. ...foo?js=0#l199 were not recognized as having 'js' query parameter already. 2. The 'js' query parameter, in the form of either '?js=1' or ';js=1' was appended at the end of URI, even if it included a fragment (had a hash part). This lead to the incorrect links like this ...foo#l199?js=1 instead of adding query parameter as last part of query, but before the fragment part, i.e. ...foo?js=1#l199 Signed-off-by: Peter Stuge <peter@stuge.se> Acked-by: Jakub Narebski <jnareb@gmail.com> Signed-off-by: Junio C Hamano <gitster@pobox.com>
2011-09-16gitweb: Strip non-printable characters from syntax highlighter outputJakub Narebski
The current code, as is, passes control characters, such as form-feed (^L) to highlight which then passes it through to the browser. User agents (web browsers) that support 'application/xhtml+xml' usually require that web pages declared as XHTML and with this mimetype are well-formed XML. Unescaped control characters cannot appear within a contents of a valid XML document. This will cause the browser to display one of the following warnings: * Safari v5.1 (6534.50) & Google Chrome v13.0.782.112: This page contains the following errors: error on line 657 at column 38: PCDATA invalid Char value 12 Below is a rendering of the page up to the first error. * Mozilla Firefox 3.6.19 & Mozilla Firefox 5.0: XML Parsing Error: not well-formed Location: http://path/to/git/repo/blah/blah Both errors were generated by gitweb.perl v1.7.3.4 w/ highlight 2.7 using arch/ia64/kernel/unwind.c from the Linux kernel. When syntax highlighter is not used, control characters are replaced by esc_html(), but with syntax highlighter they were passed through to browser (to_utf8() doesn't remove control characters). Introduce sanitize() subroutine which strips forbidden characters, but does not perform HTML escaping, and use it in git_blob() to sanitize syntax highlighter output for XHTML. Note that excluding "\t" (U+0009), "\n" (U+000A) and "\r" (U+000D) is not strictly necessary, atleast for currently the only callsite: "\t" tabs are replaced by spaces by untabify(), "\n" is stripped from each line before processing it, and replacing "\r" could be considered improvement. Originally-by: Christopher M. Fuhrman <cfuhrman@panix.com> Signed-off-by: Jakub Narebski <jnareb@gmail.com> Signed-off-by: Junio C Hamano <gitster@pobox.com>
2011-08-16Merge branch 'jn/mime-type-with-params' into maintJunio C Hamano
* jn/mime-type-with-params: gitweb: Serve */*+xml 'blob_plain' as text/plain with $prevent_xss gitweb: Serve text/* 'blob_plain' as text/plain with $prevent_xss
2011-08-08Merge branch 'jn/gitweb-config-list-case'Junio C Hamano
* jn/gitweb-config-list-case: gitweb: Git config keys are case insensitive, make config search too
2011-08-08Merge branch 'jn/gitweb-system-config'Junio C Hamano
* jn/gitweb-system-config: gitweb: Introduce common system-wide settings for convenience
2011-08-04gitweb: pass string after encoding in utf-8 to syntax highlighter张忠山
Otherwise the highlight filter would work on a corrupt byte sequence. Signed-off-by: 张忠山 <zzs213@126.com> Acked-by: Jakub Narebski <jnareb@gmail.com> Signed-off-by: Junio C Hamano <gitster@pobox.com>
2011-08-01gitweb: Git config keys are case insensitive, make config search tooJakub Narebski
"git config -z -l" that gitweb uses in git_parse_project_config() to populate %config hash returns section and key names of config variables in lowercase (they are case insensitive). When checking %config in git_get_project_config() we have to take it into account. Helped-by: Junio C Hamano <gitster@pobox.com> Signed-off-by: Jakub Narebski <jnareb@gmail.com> Signed-off-by: Junio C Hamano <gitster@pobox.com>
2011-07-25gitweb: Introduce common system-wide settings for convenienceJakub Narebski
Because of backward compatibility we cannot change gitweb to always use /etc/gitweb.conf (i.e. even if gitweb_config.perl exists). For common system-wide settings we therefore need separate configuration file: /etc/gitweb-common.conf. Long description: gitweb currently obtains configuration from the following sources: 1. per-instance configuration file (default: gitweb_conf.perl) 2. system-wide configuration file (default: /etc/gitweb.conf) If per-instance configuration file exists, then system-wide configuration is _not used at all_. This is quite untypical and suprising behavior. Moreover it is different from way git itself treats /etc/git.conf. It reads in stuff from /etc/git.conf and then local repos can change or override things as needed. In fact this is quite beneficial, because it gives site admins a simple and easy way to give an automatic hint to a repo about things the admin would like. On the other hand changing current behavior may lead to the situation, where something in /etc/gitweb.conf may interfere with unintended interaction in the local repository. One solution would be to _require_ to do explicit include; with read_config_file() it is now easy, as described in gitweb/README (description introduced in this commit). But as J.H. noticed we cannot ask people to modify their per-instance gitweb config file to include system-wide settings, nor we can require them to do this. Therefore, as proposed by Junio, for gitweb to have centralized config elements while retaining backwards compatibility, introduce separate common system-wide configuration file, by default /etc/gitweb-common.conf Noticed-by: Drew Northup <drew.northup@maine.edu> Helped-by: John 'Warthog9' Hawley <warthog9@kernel.org> Inspired-by: Junio C Hamano <gitster@pobox.com> Signed-off-by: Jakub Narebski <jnareb@gmail.com> Signed-off-by: Junio C Hamano <gitster@pobox.com>
2011-07-23Merge branch 'jn/gitweb-search'Junio C Hamano
* jn/gitweb-search: gitweb: Make git_search_* subroutines render whole pages gitweb: Clean up code in git_search_* subroutines gitweb: Split body of git_search into subroutines gitweb: Check permissions first in git_search
2011-07-19Merge branch 'jn/mime-type-with-params'Junio C Hamano
* jn/mime-type-with-params: gitweb: Serve */*+xml 'blob_plain' as text/plain with $prevent_xss gitweb: Serve text/* 'blob_plain' as text/plain with $prevent_xss
2011-07-19Merge branch 'jn/gitweb-split-header-html'Junio C Hamano
* jn/gitweb-split-header-html: gitweb: Refactor git_header_html
2011-07-14Merge branch 'ln/gitweb-mime-types-split-at-blank'Junio C Hamano
* ln/gitweb-mime-types-split-at-blank: gitweb: allow space as delimiter in mime.types
2011-06-30gitweb: Serve */*+xml 'blob_plain' as text/plain with $prevent_xssJakub Narebski
Enhance usability of 'blob_plain' view protection against XSS attacks (enabled by setting $prevent_xss to true) by serving contents inline as safe 'text/plain' mimetype where possible, instead of serving with "Content-Disposition: attachment" to make sure they don't run in gitweb's security domain. This patch broadens downgrading to 'text/plain' further, to any */*+xml mimetype. This includes: application/xhtml+xml (*.xhtml, *.xht) application/atom+xml (*.atom) application/rss+xml (*.rss) application/mathml+xm (*.mathml) application/docbook+xml (*.docbook) image/svg+xml (*.svg, *.svgz) Probably most useful is serving XHTML files as text/plain in 'blob_plain' view, directly viewable. Because file with 'image/svg+xml' mimetype can be compressed SVGZ file, we have to check if */*+xml really is text file, via '-T $fd'. Signed-off-by: Jakub Narebski <jnareb@gmail.com> Signed-off-by: Junio C Hamano <gitster@pobox.com>
2011-06-30gitweb: Serve text/* 'blob_plain' as text/plain with $prevent_xssJakub Narebski
One of mechanism enabled by setting $prevent_xss to true is 'blob_plain' view protection. With XSS prevention on, blobs of all types except a few known safe ones are served with "Content-Disposition: attachment" to make sure they don't run in our security domain. Instead of serving text/* type files, except text/plain (and including text/html), as attachements, downgrade it to text/plain. This way HTML pages in 'blob_plain' (raw) view would be displayed in browser, but safely as a source, and not asked to be saved. Signed-off-by: Jakub Narebski <jnareb@gmail.com> Signed-off-by: Junio C Hamano <gitster@pobox.com>
2011-06-30Merge branch 'jn/gitweb-js-blame' into nextJunio C Hamano
* jn/gitweb-js-blame: gitweb.js: use setTimeout rather than setInterval in blame_incremental.js gitweb.js: No need for loop in blame_incremental's handleResponse() gitweb.js: No need for inProgress in blame_incremental.js