summary refs log tree commit diff
path: root/debian
diff options
context:
space:
mode:
authorMichael Greenberg <michael.greenberg@pomona.edu>2020-04-29 20:04:21 -0700
committerHerbert Xu <herbert@gondor.apana.org.au>2020-05-15 16:24:38 +1000
commit2b6a5a30eeae293ca50d849bc1dae15f27044f99 (patch)
treea3035150efc600620203256ead9f34a39571958c /debian
parentexpand: Remove unused expandmeta() flag parameter (diff)
downloaddash-2b6a5a30eeae293ca50d849bc1dae15f27044f99.tar.gz
dash-2b6a5a30eeae293ca50d849bc1dae15f27044f99.zip
shell: mktokens relative TMPDIR
The mktokens script fails when /tmp isn't writable (e.g., when building
in a sandbox with a different TMPDIR). Replace absolute references to
/tmp to relative references to TMPDIR. If TMPDIR is unset or null,
default to /tmp.

The mkbuiltins script was already hardened to work relative to TMPDIR,
also defaulting to /tmp.

v2 ensures that TMPDIR is quoted.
v3 adds an extra quotation that prevents extra pathname expansions.

Signed-off-by: Michael Greenberg <michael.greenberg@pomona.edu>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Diffstat (limited to 'debian')
0 files changed, 0 insertions, 0 deletions
 

generated by cgit-pink 1.4.1 (git 2.36.1) at 2026-02-06 09:02:12 +0000


 


d>Jason A. Donenfeld

Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>



2014-01-17ui-shared: move about tab all the way to the leftJason A. Donenfeld

There were no objections (at the time of committing this):
   http://lists.zx2c4.com/pipermail/cgit/2013-May/001393.html
   http://lists.zx2c4.com/pipermail/cgit/2014-January/001904.html

Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>



2014-01-17filter: don't forget to reap the auth filterJason A. Donenfeld

Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>



2014-01-17cgit.c: free tmp variableJason A. Donenfeld

Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>



2014-01-17Switch to exclusively using global ctxLukas Fleischer

Drop the context parameter from the following functions (and all static
helpers used by them) and use the global context instead:

* cgit_print_http_headers()
* cgit_print_docstart()
* cgit_print_pageheader()

Remove context parameter from all commands

Drop the context parameter from the following functions (and all static
helpers used by them) and use the global context instead:

* cgit_get_cmd()
* All cgit command functions.
* cgit_clone_info()
* cgit_clone_objects()
* cgit_clone_head()
* cgit_print_plain()
* cgit_show_stats()

In initialization routines, use the global context variable instead of
passing a pointer around locally.

Remove callback data parameter for cache slots

This is no longer needed since the context is always read from the
global context variable.

Signed-off-by: Lukas Fleischer <cgit@cryptocrack.de>



2014-01-16auth: have cgit calculate login addressJason A. Donenfeld

This way we're sure to use virtual root, or any other strangeness
encountered.

Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>



2014-01-16auth: lua string comparisons are time invariantJason A. Donenfeld

By default, strings are compared by hash, so we can remove this comment.

Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>



2014-01-16authentication: use hidden form instead of refererJason A. Donenfeld

This also gives us some CSRF protection. Note that we make use of the
hmac to protect the redirect value.

Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>



2014-01-16auth: add basic authentication filter frameworkJason A. Donenfeld

This leverages the new lua support. See
filters/simple-authentication.lua for explaination of how this works.
There is also additional documentation in cgitrc.5.txt.

Though this is a cookie-based approach, cgit's caching mechanism is
preserved for authenticated pages.

Very plugable and extendable depending on user needs.

The sample script uses an HMAC-SHA1 based cookie to store the
currently logged in user, with an expiration date.

Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>



2014-01-16t0111: Additions and fixesLukas Fleischer

* Rename the capitalize-* filters to dump.* since they also dump the
  arguments.

* Add full argument validation to the email filters.

Signed-off-by: Lukas Fleischer <cgit@cryptocrack.de>



2014-01-16parsing.c: Remove leading space from committerLukas Fleischer