ui-snapshot: do not access $HOME

It's a bit tedious to have to do this here too. If we encounter other
issues with $HOME down the line, I'll look into adding some nice utility
functions to handle this, or perhaps giving up on the hope that we could
keep $HOME defined for scripts.

This commit additionally adds a test case, should the issue surface
again.

Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
New mailing list.
t0109: "function" is a bash-ism

We try to stick to POSIX shell in the tests but a "function" keyword has
found its way into t0109.  Remove it.

This makes the tests work with dash again.

Signed-off-by: John Keeping <john@keeping.me.uk>
cache.c: fix cache_ls

Commit fb3655d (use struct strbuf instead of static buffers, 2013-04-06)
broke the logic in cache.c::cache_ls by failing to set slot->cache_name
before calling open_slot.

While fixing this, also free the strbufs added by that commit once we're
done with them.

Signed-off-by: John Keeping <john@keeping.me.uk>
Makefile: fix parallel "make test"

When building the "test" target we depend on both cgit and building the
Git tools.  By doing this with two targets we end up running make in the
git/ directory twice, concurrently if using parallel make, which causes
us to build more than we need and potentially builds incorrectly if
multi-step build-then-move operations overlap.

Fix this by instead calling back into the makefile so that we alter the
"cgit" target to also build the Git tools.

Signed-off-by: John Keeping <john@keeping.me.uk>
ui-log: add <span/> around commit decorations

This helps projects that have a large number of tags to display them all
using custom CSS.

The default stylesheet has not been updated since what is useful for
projects with a lot of tags is not the same as what is useful for
projects with only a small number of decorations per commit.

Suggested-by: Konstantin Ryabitsev <mricon@kernel.org>
Signed-off-by: John Keeping <john@keeping.me.uk>
html.c: die when write fails

If we fail to write HTML output once, there's no point carrying on so
just write a failure message once and die.  By using Git's die_errno
function we also let the user know in what way the write failed.

Signed-off-by: John Keeping <john@keeping.me.uk>
shared.c: use die_errno() where appropriate

This replaces some code that is re-implementing die_errno by just
calling the function.

Signed-off-by: John Keeping <john@keeping.me.uk>
tests: introduce strip_header() helper function

This means that we can avoid hardcoding the number of headers we expect
CGit to generate in test cases and simply remove whatever headers happen
to by there when we are checking body content.

Signed-off-by: John Keeping <john@keeping.me.uk>
cache.c: cache ls_cache output properly

By using the standard library's printf, cache_ls does not redirect its
output to the cache when we change the process' stdout file descriptor
to point to the cache file.  Fix this by using "htmlf" in the same way
that we do for writing HTTP headers.

Signed-off-by: John Keeping <john@keeping.me.uk>
git: update to 1.8.3

No changes required, just bump the submodule and Makefile versions.

Signed-off-by: John Keeping <john@keeping.me.uk>
cgit.c: sync repo config printing with struct cgit_repo

We've now added quite a few config keys for repositories, but we've
forgotten to update the printing of it for cache files. Synchronize the
two.

Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
cgit.c: Do not reset HOME after unsetting it.

The number of odd cases in which git will try to read config is far too
great to keep putting a bandaid over each one, so we'll just unset it.

If it turns out that scripts really liked to know about $HOME, we can
always reset it in the filter forks.

Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
ui-summary: Use default branch for readme if : prefix

If the readme value begins with ":", and has no specified branch before
it, use the repository's default branch.

Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
ui-summary: Pass filename to about-filter

This gives the about-filter API the same semantics as source-filter,
where the filter receives the filename so it can decide what to do next
with it.

While we're at it, plug a memory leak.

Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
readme: Accept multiple candidates and test them.

The readme variable may now contain multiple space deliminated entries,
which per usual are either a filepath or a git ref filepath. If multiple
are specified, cgit will now select the first one in the list that
exists. This is to make it easier to specify multiple default readme
types in the main cgitrc file and have them automatically get applied to
each repo based on what exists.

Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
cgitrc.5: information on directory traversal and multiple readme files

Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
ui-summary: Disallow directory traversal

Using the url= query string, it was possible request arbitrary files
from the filesystem if the readme for a given page was set to a
filesystem file. The following request would return my /etc/passwd file:

http://git.zx2c4.com/?url=/somerepo/about/../../../../etc/passwd
http://data.zx2c4.com/cgit-directory-traversal.png

This fix uses realpath(3) to canonicalize all paths, and then compares
the base components.

This fix introduces a subtle timing attack, whereby a client can check
whether or not strstr is called using timing measurements in order
to determine if a given file exists on the filesystem.

This fix also does not account for filesystem race conditions (TOCTOU)
in resolving symlinks.

Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
readme: use string_list instead of space deliminations

Now this is possible in cgitrc -

readme=:README.md
readme=:readme.md
readme=:README.mkd
readme=:readme.mkd
readme=:README.rst
readme=:readme.rst
readme=:README.html
readme=:readme.html
readme=:README.htm
readme=:readme.htm
readme=:README.txt
readme=:readme.txt
readme=:README
readme=:readme
readme=:INSTALL.txt
readme=:install.txt
readme=:INSTALL
readme=:install

Suggested-by: John Keeping <john@keeping.me.uk>
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
filters: import more modern scripts

Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>