From fc384b16fb9787380746000d3cea2d53fccc548e Mon Sep 17 00:00:00 2001 From: Jim Meyering Date: Mon, 28 Feb 2011 12:18:57 +0100 Subject: do not infloop on a query ending in %XY, for invalid hex X or Y When a query ends in say %gg, (or any invalid hex) e.g., http://git.gnome.org/browse/gdlmm/commit/?id=%gg convert_query_hexchar calls memmove(txt, txt+3, 0), and then returns txt-1, so the loop in http_parse_querystring never terminates. The solution is to make the memmove also copy the trailing NUL. * html.c (convert_query_hexchar): Fix off-by-one error. Signed-off-by: Lars Hjemli --- html.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/html.c b/html.c index d86b2c1..5336596 100644 --- a/html.c +++ b/html.c @@ -249,7 +249,7 @@ char *convert_query_hexchar(char *txt) d1 = hextoint(*(txt+1)); d2 = hextoint(*(txt+2)); if (d1<0 || d2<0) { - memmove(txt, txt+3, n-3); + memmove(txt, txt+3, n-2); return txt-1; } else { *txt = d1 * 16 + d2; -- cgit 1.4.1 >DON'T USE THIS! --- web frontend for git
about summary refs log tree commit diff
path: root/filters/email-gravatar.lua (unfollow)
Commit message (Collapse)Author
2014-01-17repolist: make owner clickable to searchJason A. Donenfeld
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2014-01-17ui-shared: move about tab all the way to the leftJason A. Donenfeld
There were no objections (at the time of committing this): http://lists.zx2c4.com/pipermail/cgit/2013-May/001393.html http://lists.zx2c4.com/pipermail/cgit/2014-January/001904.html Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2014-01-17filter: don't forget to reap the auth filterJason A. Donenfeld
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2014-01-17cgit.c: free tmp variableJason A. Donenfeld
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2014-01-17Switch to exclusively using global ctxLukas Fleischer
Drop the context parameter from the following functions (and all static helpers used by them) and use the global context instead: * cgit_print_http_headers() * cgit_print_docstart() * cgit_print_pageheader() Remove context parameter from all commands Drop the context parameter from the following functions (and all static helpers used by them) and use the global context instead: * cgit_get_cmd() * All cgit command functions. * cgit_clone_info() * cgit_clone_objects() * cgit_clone_head() * cgit_print_plain() * cgit_show_stats() In initialization routines, use the global context variable instead of passing a pointer around locally. Remove callback data parameter for cache slots This is no longer needed since the context is always read from the global context variable. Signed-off-by: Lukas Fleischer <cgit@cryptocrack.de>
2014-01-16auth: have cgit calculate login addressJason A. Donenfeld
This way we're sure to use virtual root, or any other strangeness encountered. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2014-01-16auth: lua string comparisons are time invariantJason A. Donenfeld
By default, strings are compared by hash, so we can remove this comment. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2014-01-16authentication: use hidden form instead of refererJason A. Donenfeld
This also gives us some CSRF protection. Note that we make use of the hmac to protect the redirect value. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2014-01-16auth: add basic authentication filter frameworkJason A. Donenfeld
This leverages the new lua support. See filters/simple-authentication.lua for explaination of how this works. There is also additional documentation in cgitrc.5.txt. Though this is a cookie-based approach, cgit's caching mechanism is preserved for authenticated pages. Very plugable and extendable depending on user needs. The sample script uses an HMAC-SHA1 based cookie to store the currently logged in user, with an expiration date. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2014-01-16t0111: Additions and fixesLukas Fleischer
* Rename the capitalize-* filters to dump.* since they also dump the arguments. * Add full argument validation to the email filters. Signed-off-by: Lukas Fleischer <cgit@cryptocrack.de>
2014-01-16parsing.c: Remove leading space from committerLukas Fleischer