Re: authentication support: work has begun!
Hi, On Wednesday 15 January 2014 02:02:13 Jason A. Donenfeld wrote: While still a horrendous mess, I've begun work adding authentication support, using our nice new lua filter system. A sample script looks like this [at the moment]: http://git.zx2c4.com/cgit/tree/filters/simple-authentication.lua?h=jd/authen tication The full commit of this attrocity looks like this: http://git.zx2c4.com/cgit/commit/?h=jd/authentication It's far from finished or polished, but I thought I'd give everyone a preview of it. It's running on: http://git.zx2c4.com/glouglou/log Currently just enter anything you want as username and password. It will set a cookie. Check out the HTTP headers and response and everything to see what's happening. Preliminary comments? The script is vulnerable to header injection: $ curl -i http://git.zx2c4.com/login -H 'Referer: x%0d\nX: 1' \ -d 'username=1; path%3d/password=%0aY: 2' HTTP/1.1 302 Redirect Server: ZX2C4 Web Server Date: Wed, 15 Jan 2014 08:54:00 GMT Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=20 Location: x%0d\nX: 1 Set-Cookie: auth=1 Set-Cookie: username=1; path=/ Set-Cookie: password= Y: 2 While the referrer part may not be that easily spoofable, the post fields are a different matter. Speaking of the referrer header, that field might not be set at all. What about making the URL available in a post field return-url? It still has to be validated though. For the cookie, I suggest to add ; HttpOnly to Set-Cookie to prevent cookie theft through XSS. If possible, also add ; Secure to prevent leakage through HTTP when HTTPS is used. An important consideration is caching. Adding the Set-Cookie header disables caching for nginx at least, but other authenticated requests can still be cached. This authentication mechanism is unsafe if the transport is not encrypted (i.e. use HTTPS!), passwords are then leaked in the air. You mentioned using a HMAC, but what data do you want to protect? For best results, some state has to be retained. The authentication does not have to rely on cookies either, it can use client SSL certificates too. What if the script fails to load (syntax error)? Is access then granted to everyone, silently ignoring the error? That would be bad, it should then return an 500 Internal server error. Regards, Peter ___ CGit mailing list CGit@lists.zx2c4.com http://lists.zx2c4.com/mailman/listinfo/cgit
Re: authentication support: work has begun!
On Wed, Jan 15, 2014 at 10:28 AM, Peter Wu lekenst...@gmail.com wrote:
The script is vulnerable to header injection:
$ curl -i http://git.zx2c4.com/login -H 'Referer: x%0d\nX: 1' \
-d 'username=1; path%3d/password=%0aY: 2'
HTTP/1.1 302 Redirect
Server: ZX2C4 Web Server
Date: Wed, 15 Jan 2014 08:54:00 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Keep-Alive: timeout=20
Location: x%0d\nX: 1
Set-Cookie: auth=1
Set-Cookie: username=1; path=/
Set-Cookie: password=
Y: 2
While the referrer part may not be that easily spoofable, the post fields
are
a different matter. Speaking of the referrer header, that field might not
be
set at all. What about making the URL available in a post field
return-url?
It still has to be validated though.
Yes, of course. I was aware of this too. Clearly the current spitting out
of headers is unfinished. In the first place, I wouldn't be spitting the
password and username post directly out in the cookies (-- We wouldn't
actually want to set these cookies... Just for testing. in the comments),
let alone leaving everything completely unvalidated. Rest assured, this
won't make it to the master branch.
For the cookie, I suggest to add ; HttpOnly to Set-Cookie to prevent
cookie
theft through XSS. If possible, also add ; Secure to prevent leakage
through
HTTP when HTTPS is used.
I had planned on this too. A good suggestion. None of the cookie generation
is complete right now.
An important consideration is caching. Adding the Set-Cookie header
disables
caching for nginx at least, but other authenticated requests can still be
cached.
Not completely though. I've taken careful precaution to ensure that caching
from the cgit end stays in tact. If the cookie is authenticated, then cgit
is able to serve up the cached pages from its own cache. If the cookie is
unauthenticated, then, yes, it displays an uncached version of the please
authenticate page.
I did not check the ramification this has on nginx's handling of HTTP
caching of resources, however. Can you elaborate on this, if it's a
problem, and how to mitigate it?
This authentication mechanism is unsafe if the transport is not encrypted
(i.e. use HTTPS!), passwords are then leaked in the air. You mentioned
using a HMAC, but what data do you want to protect? For best results,
some state has to be retained. The authentication does not have to rely on
cookies either, it can use client SSL certificates too.
Obviously. All authentication mechanisms in the browser that do not go over
HTTPS are vulnerable. If you have HTTPS, then excellent. If you don't, then
you should be aware of how vulnerable you will be without it. There will be
a note in the documentation about this naturally.
The HMAC mention doesn't have to do with cleartext vs non-cleartext. It's
for this reason -- I'm not going to be relying in an auth=1 cookie for
authentication passing. This is trivially spoofable. Instead, there's going
to be something like ${username}|${expiration-unix-time}|${salt}|${hmac},
so that such state is stored in the cookie itself, but then validated
server side using a secret.
What if the script fails to load (syntax error)? Is access then granted to
everyone, silently ignoring the error? That would be bad, it should then
return an 500 Internal server error.
If the script fails to load due to a syntax error, cgit will bail out. It
fails safe in this regard.
Thanks for your feedback! I'll ping you when I've finished the web side of
things and you can let me know if it's satisfactory.
___
CGit mailing list
CGit@lists.zx2c4.com
http://lists.zx2c4.com/mailman/listinfo/cgit
Re: [PATCH 1/1] email-gravatar: fix html syntax issues
Jimminy cricket. Okay, merged. ___ CGit mailing list CGit@lists.zx2c4.com http://lists.zx2c4.com/mailman/listinfo/cgit
Re: [PATCH 3/3] t0111: Check all arguments
Squashed and merged this series. ___ CGit mailing list CGit@lists.zx2c4.com http://lists.zx2c4.com/mailman/listinfo/cgit
Re: ssh clone config
On Wed, Jan 15, 2014 at 08:24:21AM +0100, Lars Hjemli wrote: On Tue, Jan 14, 2014 at 10:09 PM, Doug Carter dcar...@mercycorps.org wrote: I'd like to create a some ssl clone text that can be copy/pasted like github does it: g...@git.foo.com:repo.git Is there a way to do this and not include any URLs? Yes, using the 'clone-prefix' and/or 'clone-url' settings in cgitrc: http://git.zx2c4.com/cgit/tree/cgitrc.5.txt I've tried a variety of configurations with these settings, but no matter what I try, it prepends the site URL. For example, if I set clone-url to g...@git.foo.com:$CGIT_REPO_URL, the text displays OK, but the href is set to: https://git.foo.com/cgit.cgi/foo/g...@git.foo.com:foo.git Maybe this is an apache config thing? ___ CGit mailing list CGit@lists.zx2c4.com http://lists.zx2c4.com/mailman/listinfo/cgit
Re: authentication support: work has begun!
Username: jason Password: secretpassword ___ CGit mailing list CGit@lists.zx2c4.com http://lists.zx2c4.com/mailman/listinfo/cgit
[PATCH] auth: add basic authentication filter framework
This leverages the new lua support. See
filters/simple-authentication.lua for explaination of how this works.
There is also additional documentation in cgitrc.5.txt.
Though this is a cookie-based approach, cgit's caching mechanism is
preserved for authenticated pages.
Very plugable and extendable depending on user needs.
The sample script uses an HMAC-SHA1 based cookie to store the
currently logged in user, with an expiration date.
Signed-off-by: Jason A. Donenfeld ja...@zx2c4.com
---
You can try this out at http://git.zx2c4.com/glouglou/log using
the username jason and the password secretpassword.
cgit.c| 94 +++-
cgit.h| 7 +-
cgitrc.5.txt | 36 +-
filter.c | 11 ++
filters/simple-authentication.lua | 225 ++
ui-shared.c | 26 +++--
6 files changed, 383 insertions(+), 16 deletions(-)
create mode 100644 filters/simple-authentication.lua
diff --git a/cgit.c b/cgit.c
index f3fe56b..3e6f0b1 100644
--- a/cgit.c
+++ b/cgit.c
@@ -192,6 +192,8 @@ static void config_cb(const char *name, const char *value)
ctx.cfg.commit_filter = cgit_new_filter(value, COMMIT);
else if (!strcmp(name, email-filter))
ctx.cfg.email_filter = cgit_new_filter(value, EMAIL);
+ else if (!strcmp(name, auth-filter))
+ ctx.cfg.auth_filter = cgit_new_filter(value, AUTH);
else if (!strcmp(name, embedded))
ctx.cfg.embedded = atoi(value);
else if (!strcmp(name, max-atom-items))
@@ -378,6 +380,10 @@ static void prepare_context(struct cgit_context *ctx)
ctx-env.script_name = getenv(SCRIPT_NAME);
ctx-env.server_name = getenv(SERVER_NAME);
ctx-env.server_port = getenv(SERVER_PORT);
+ ctx-env.http_cookie = getenv(HTTP_COOKIE);
+ ctx-env.http_referer = getenv(HTTP_REFERER);
+ ctx-env.content_length = getenv(CONTENT_LENGTH) ?
strtoul(getenv(CONTENT_LENGTH), NULL, 10) : 0;
+ ctx-env.authenticated = 0;
ctx-page.mimetype = text/html;
ctx-page.charset = PAGE_ENCODING;
ctx-page.filename = NULL;
@@ -593,11 +599,90 @@ static int prepare_repo_cmd(struct cgit_context *ctx)
return 0;
}
+static inline void open_auth_filter(struct cgit_context *ctx, const char
*function)
+{
+ cgit_open_filter(ctx-cfg.auth_filter, function,
+ ctx-env.http_cookie ? ctx-env.http_cookie : ,
+ ctx-env.request_method ? ctx-env.request_method : ,
+ ctx-env.query_string ? ctx-env.query_string : ,
+ ctx-env.http_referer ? ctx-env.http_referer : ,
+ ctx-env.path_info ? ctx-env.path_info : ,
+ ctx-env.http_host ? ctx-env.http_host : ,
+ ctx-env.https ? ctx-env.https : ,
+ ctx-qry.repo ? ctx-qry.repo : ,
+ ctx-qry.page ? ctx-qry.page : ,
+ ctx-qry.url ? ctx-qry.url : );
+}
+
+#define MAX_AUTHENTICATION_POST_BYTES 4096
+static inline void authenticate_post(struct cgit_context *ctx)
+{
+ if (ctx-env.http_referer strlen(ctx-env.http_referer) 0) {
+ html(Status: 302 Redirect\n);
+ htmlf(Location: %s\n, ctx-env.http_referer);
+ } else {
+ html(Status: 503 Invalid Request\n\n);
+ exit(0);
+ }
+
+ open_auth_filter(ctx, authenticate-post);
+ char buffer[MAX_AUTHENTICATION_POST_BYTES];
+ int len;
+ len = ctx-env.content_length;
+ if (len MAX_AUTHENTICATION_POST_BYTES)
+ len = MAX_AUTHENTICATION_POST_BYTES;
+ if (read(STDIN_FILENO, buffer, len) 0)
+ die_errno(Could not read POST from stdin);
+ if (write(STDOUT_FILENO, buffer, len) 0)
+ die_errno(Could not write POST to stdout);
+ /* The filter may now spit out a Set-Cookie: ... */
+ cgit_close_filter(ctx-cfg.auth_filter);
+
+ html(\n);
+ exit(0);
+}
+
+static inline void authenticate_cookie(struct cgit_context *ctx)
+{
+ /* If we don't have an auth_filter, consider all cookies valid, and
thus return early. */
+ if (!ctx-cfg.auth_filter) {
+ ctx-env.authenticated = 1;
+ return;
+ }
+
+ /* If we're having something POST'd to /login, we're authenticating
POST,
+* instead of the cookie, so call authenticate_post and bail out early.
+* This pattern here should match /?p=login with POST. */
+ if (ctx-env.request_method ctx-qry.page !ctx-repo \
+ !strcmp(ctx-env.request_method, POST) !strcmp(ctx-qry.page,
login)) {
+ authenticate_post(ctx);
+ return;
+ }
+
+ /* If we've made it this far, we're authenticating the cookie for real,
so do that. */
+ open_auth_filter(ctx, authenticate-cookie);
+ ctx-env.authenticated =
[PATCH 2/4] Remove context parameter from all commands
Drop the context parameter from the following functions (and all static
helpers used by them) and use the global context instead:
* cgit_get_cmd()
* All cgit command functions.
* cgit_clone_info()
* cgit_clone_objects()
* cgit_clone_head()
* cgit_print_plain()
* cgit_show_stats()
Fix all invocations of these functions accordingly.
Signed-off-by: Lukas Fleischer c...@cryptocrack.de
---
cgit.c | 4 +--
cmd.c | 100 ++---
cmd.h | 4 +--
ui-clone.c | 42 +-
ui-clone.h | 6 ++--
ui-plain.c | 10 +++
ui-plain.h | 2 +-
ui-stats.c | 29 +-
ui-stats.h | 2 +-
9 files changed, 99 insertions(+), 100 deletions(-)
diff --git a/cgit.c b/cgit.c
index 512ef56..54efd59 100644
--- a/cgit.c
+++ b/cgit.c
@@ -598,7 +598,7 @@ static void process_request(void *cbdata)
struct cgit_context *ctx = cbdata;
struct cgit_cmd *cmd;
- cmd = cgit_get_cmd(ctx);
+ cmd = cgit_get_cmd();
if (!cmd) {
ctx-page.title = cgit error;
ctx-page.status = 404;
@@ -640,7 +640,7 @@ static void process_request(void *cbdata)
cgit_print_pageheader();
}
- cmd-fn(ctx);
+ cmd-fn();
if (cmd-want_layout)
cgit_print_docend();
diff --git a/cmd.c b/cmd.c
index 3022452..cbd235c 100644
--- a/cmd.c
+++ b/cmd.c
@@ -26,120 +26,120 @@
#include ui-tag.h
#include ui-tree.h
-static void HEAD_fn(struct cgit_context *ctx)
+static void HEAD_fn(void)
{
- cgit_clone_head(ctx);
+ cgit_clone_head();
}
-static void atom_fn(struct cgit_context *ctx)
+static void atom_fn(void)
{
- cgit_print_atom(ctx-qry.head, ctx-qry.path, ctx-cfg.max_atom_items);
+ cgit_print_atom(ctx.qry.head, ctx.qry.path, ctx.cfg.max_atom_items);
}
-static void about_fn(struct cgit_context *ctx)
+static void about_fn(void)
{
- if (ctx-repo)
- cgit_print_repo_readme(ctx-qry.path);
+ if (ctx.repo)
+ cgit_print_repo_readme(ctx.qry.path);
else
cgit_print_site_readme();
}
-static void blob_fn(struct cgit_context *ctx)
+static void blob_fn(void)
{
- cgit_print_blob(ctx-qry.sha1, ctx-qry.path, ctx-qry.head, 0);
+ cgit_print_blob(ctx.qry.sha1, ctx.qry.path, ctx.qry.head, 0);
}
-static void commit_fn(struct cgit_context *ctx)
+static void commit_fn(void)
{
- cgit_print_commit(ctx-qry.sha1, ctx-qry.path);
+ cgit_print_commit(ctx.qry.sha1, ctx.qry.path);
}
-static void diff_fn(struct cgit_context *ctx)
+static void diff_fn(void)
{
- cgit_print_diff(ctx-qry.sha1, ctx-qry.sha2, ctx-qry.path, 1, 0);
+ cgit_print_diff(ctx.qry.sha1, ctx.qry.sha2, ctx.qry.path, 1, 0);
}
-static void rawdiff_fn(struct cgit_context *ctx)
+static void rawdiff_fn(void)
{
- cgit_print_diff(ctx-qry.sha1, ctx-qry.sha2, ctx-qry.path, 1, 1);
+ cgit_print_diff(ctx.qry.sha1, ctx.qry.sha2, ctx.qry.path, 1, 1);
}
-static void info_fn(struct cgit_context *ctx)
+static void info_fn(void)
{
- cgit_clone_info(ctx);
+ cgit_clone_info();
}
-static void log_fn(struct cgit_context *ctx)
+static void log_fn(void)
{
- cgit_print_log(ctx-qry.sha1, ctx-qry.ofs, ctx-cfg.max_commit_count,
- ctx-qry.grep, ctx-qry.search, ctx-qry.path, 1,
- ctx-repo-enable_commit_graph,
- ctx-repo-commit_sort);
+ cgit_print_log(ctx.qry.sha1, ctx.qry.ofs, ctx.cfg.max_commit_count,
+ ctx.qry.grep, ctx.qry.search, ctx.qry.path, 1,
+ ctx.repo-enable_commit_graph,
+ ctx.repo-commit_sort);
}
-static void ls_cache_fn(struct cgit_context *ctx)
+static void ls_cache_fn(void)
{
- ctx-page.mimetype = text/plain;
- ctx-page.filename = ls-cache.txt;
+ ctx.page.mimetype = text/plain;
+ ctx.page.filename = ls-cache.txt;
cgit_print_http_headers();
- cache_ls(ctx-cfg.cache_root);
+ cache_ls(ctx.cfg.cache_root);
}
-static void objects_fn(struct cgit_context *ctx)
+static void objects_fn(void)
{
- cgit_clone_objects(ctx);
+ cgit_clone_objects();
}
-static void repolist_fn(struct cgit_context *ctx)
+static void repolist_fn(void)
{
cgit_print_repolist();
}
-static void patch_fn(struct cgit_context *ctx)
+static void patch_fn(void)
{
- cgit_print_patch(ctx-qry.sha1, ctx-qry.sha2, ctx-qry.path);
+ cgit_print_patch(ctx.qry.sha1, ctx.qry.sha2, ctx.qry.path);
}
-static void plain_fn(struct cgit_context *ctx)
+static void plain_fn(void)
{
- cgit_print_plain(ctx);
+ cgit_print_plain();
}
-static void refs_fn(struct cgit_context *ctx)
+static void refs_fn(void)
{
cgit_print_refs();
}
-static void snapshot_fn(struct cgit_context *ctx)
+static void snapshot_fn(void)
{
- cgit_print_snapshot(ctx-qry.head,
[PATCH 0/4] Remove references to the global context variable
Jason noticed that sometimes, we pass a reference (pointer) to the global context variable. This series removes all such references and replaces them with direct use of the global variable. Most of the patches are much easier to review with the following options: --word-diff=color --word-diff-regex='[a-zA-Z_]+|-|\.' Comments welcome! Lukas Fleischer (4): Remove context parameter from cgit_print_*() Remove context parameter from all commands cgit.c: Remove context parameter from initializations Remove callback data parameter for cache slots cache.c | 14 ++- cache.h | 5 +- cgit.c| 249 cmd.c | 102 ++-- cmd.h | 4 +- ui-atom.c | 2 +- ui-blob.c | 2 +- ui-clone.c| 48 +- ui-clone.h| 6 +- ui-diff.c | 2 +- ui-patch.c| 2 +- ui-plain.c| 14 +-- ui-plain.h| 2 +- ui-repolist.c | 6 +- ui-shared.c | 297 +- ui-shared.h | 6 +- ui-snapshot.c | 8 +- ui-stats.c| 29 +++--- ui-stats.h| 2 +- 19 files changed, 397 insertions(+), 403 deletions(-) -- 1.8.5.2 ___ CGit mailing list CGit@lists.zx2c4.com http://lists.zx2c4.com/mailman/listinfo/cgit
[PATCH 3/4] cgit.c: Remove context parameter from initializations
In initialization routines, use the global context variable instead of
passing a pointer around locally.
Signed-off-by: Lukas Fleischer c...@cryptocrack.de
---
cgit.c | 207 -
1 file changed, 103 insertions(+), 104 deletions(-)
diff --git a/cgit.c b/cgit.c
index 54efd59..19bcd0d 100644
--- a/cgit.c
+++ b/cgit.c
@@ -320,78 +320,78 @@ static void querystring_cb(const char *name, const char
*value)
}
}
-static void prepare_context(struct cgit_context *ctx)
+static void prepare_context(void)
{
- memset(ctx, 0, sizeof(*ctx));
- ctx-cfg.agefile = info/web/last-modified;
- ctx-cfg.nocache = 0;
- ctx-cfg.cache_size = 0;
- ctx-cfg.cache_max_create_time = 5;
- ctx-cfg.cache_root = CGIT_CACHE_ROOT;
- ctx-cfg.cache_about_ttl = 15;
- ctx-cfg.cache_repo_ttl = 5;
- ctx-cfg.cache_root_ttl = 5;
- ctx-cfg.cache_scanrc_ttl = 15;
- ctx-cfg.cache_dynamic_ttl = 5;
- ctx-cfg.cache_static_ttl = -1;
- ctx-cfg.case_sensitive_sort = 1;
- ctx-cfg.branch_sort = 0;
- ctx-cfg.commit_sort = 0;
- ctx-cfg.css = /cgit.css;
- ctx-cfg.logo = /cgit.png;
- ctx-cfg.favicon = /favicon.ico;
- ctx-cfg.local_time = 0;
- ctx-cfg.enable_http_clone = 1;
- ctx-cfg.enable_index_owner = 1;
- ctx-cfg.enable_tree_linenumbers = 1;
- ctx-cfg.enable_git_config = 0;
- ctx-cfg.max_repo_count = 50;
- ctx-cfg.max_commit_count = 50;
- ctx-cfg.max_lock_attempts = 5;
- ctx-cfg.max_msg_len = 80;
- ctx-cfg.max_repodesc_len = 80;
- ctx-cfg.max_blob_size = 0;
- ctx-cfg.max_stats = 0;
- ctx-cfg.project_list = NULL;
- ctx-cfg.renamelimit = -1;
- ctx-cfg.remove_suffix = 0;
- ctx-cfg.robots = index, nofollow;
- ctx-cfg.root_title = Git repository browser;
- ctx-cfg.root_desc = a fast webinterface for the git dscm;
- ctx-cfg.scan_hidden_path = 0;
- ctx-cfg.script_name = CGIT_SCRIPT_NAME;
- ctx-cfg.section = ;
- ctx-cfg.repository_sort = name;
- ctx-cfg.section_sort = 1;
- ctx-cfg.summary_branches = 10;
- ctx-cfg.summary_log = 10;
- ctx-cfg.summary_tags = 10;
- ctx-cfg.max_atom_items = 10;
- ctx-cfg.ssdiff = 0;
- ctx-env.cgit_config = getenv(CGIT_CONFIG);
- ctx-env.http_host = getenv(HTTP_HOST);
- ctx-env.https = getenv(HTTPS);
- ctx-env.no_http = getenv(NO_HTTP);
- ctx-env.path_info = getenv(PATH_INFO);
- ctx-env.query_string = getenv(QUERY_STRING);
- ctx-env.request_method = getenv(REQUEST_METHOD);
- ctx-env.script_name = getenv(SCRIPT_NAME);
- ctx-env.server_name = getenv(SERVER_NAME);
- ctx-env.server_port = getenv(SERVER_PORT);
- ctx-page.mimetype = text/html;
- ctx-page.charset = PAGE_ENCODING;
- ctx-page.filename = NULL;
- ctx-page.size = 0;
- ctx-page.modified = time(NULL);
- ctx-page.expires = ctx-page.modified;
- ctx-page.etag = NULL;
- memset(ctx-cfg.mimetypes, 0, sizeof(struct string_list));
- if (ctx-env.script_name)
- ctx-cfg.script_name = xstrdup(ctx-env.script_name);
- if (ctx-env.query_string)
- ctx-qry.raw = xstrdup(ctx-env.query_string);
- if (!ctx-env.cgit_config)
- ctx-env.cgit_config = CGIT_CONFIG;
+ memset(ctx, 0, sizeof(ctx));
+ ctx.cfg.agefile = info/web/last-modified;
+ ctx.cfg.nocache = 0;
+ ctx.cfg.cache_size = 0;
+ ctx.cfg.cache_max_create_time = 5;
+ ctx.cfg.cache_root = CGIT_CACHE_ROOT;
+ ctx.cfg.cache_about_ttl = 15;
+ ctx.cfg.cache_repo_ttl = 5;
+ ctx.cfg.cache_root_ttl = 5;
+ ctx.cfg.cache_scanrc_ttl = 15;
+ ctx.cfg.cache_dynamic_ttl = 5;
+ ctx.cfg.cache_static_ttl = -1;
+ ctx.cfg.case_sensitive_sort = 1;
+ ctx.cfg.branch_sort = 0;
+ ctx.cfg.commit_sort = 0;
+ ctx.cfg.css = /cgit.css;
+ ctx.cfg.logo = /cgit.png;
+ ctx.cfg.favicon = /favicon.ico;
+ ctx.cfg.local_time = 0;
+ ctx.cfg.enable_http_clone = 1;
+ ctx.cfg.enable_index_owner = 1;
+ ctx.cfg.enable_tree_linenumbers = 1;
+ ctx.cfg.enable_git_config = 0;
+ ctx.cfg.max_repo_count = 50;
+ ctx.cfg.max_commit_count = 50;
+ ctx.cfg.max_lock_attempts = 5;
+ ctx.cfg.max_msg_len = 80;
+ ctx.cfg.max_repodesc_len = 80;
+ ctx.cfg.max_blob_size = 0;
+ ctx.cfg.max_stats = 0;
+ ctx.cfg.project_list = NULL;
+ ctx.cfg.renamelimit = -1;
+ ctx.cfg.remove_suffix = 0;
+ ctx.cfg.robots = index, nofollow;
+ ctx.cfg.root_title = Git repository browser;
+ ctx.cfg.root_desc = a fast webinterface for the git dscm;
+ ctx.cfg.scan_hidden_path = 0;
+ ctx.cfg.script_name = CGIT_SCRIPT_NAME;
+ ctx.cfg.section = ;
+ ctx.cfg.repository_sort = name;
+
Re: authentication support: work has begun!
On Wed, Jan 15, 2014 at 7:29 PM, Jason A. Donenfeld ja...@zx2c4.com wrote: On Wed, Jan 15, 2014 at 7:17 PM, Peter Wu lekenst...@gmail.com wrote: The current login page is cachable, you should add Cache-Control: private to prevent that. Excellent idea. I've added no-cache, no-store to the login page and the redirection. I've also merged this to master. Please test, and send any fixes you find! ___ CGit mailing list CGit@lists.zx2c4.com http://lists.zx2c4.com/mailman/listinfo/cgit
Re: Policy on global variables
Jason A. Donenfeld ja...@zx2c4.com wrote: In theory, passing around the variable, and not relying on a global, is better. It allows us at somepoint to have multiple contexts, for, say, implementing FastCGI or an event loop single-process multi response model. This. I prefer we keep passing around the ctx variable to keep the code more flexible for future reuse. Of course, IIRC git itself has this limitation, too... ___ CGit mailing list CGit@lists.zx2c4.com http://lists.zx2c4.com/mailman/listinfo/cgit
Re: Policy on global variables
On Thu, Jan 16, 2014 at 1:59 AM, Eric Wong normalper...@yhbt.net wrote: This. I prefer we keep passing around the ctx variable to keep the code more flexible for future reuse. Of course, IIRC git itself has this limitation, too... Can anyone confirm or deny this? Is it a pointless endeavor because of git's design? ___ CGit mailing list CGit@lists.zx2c4.com http://lists.zx2c4.com/mailman/listinfo/cgit
author/committer/tagger links -- kernel.org?
Hey Konstantin, On Thu, Jan 9, 2014 at 4:21 PM, Konstantin Ryabitsev mri...@kernel.org wrote: That's pretty nifty. That reminds me -- I'm working on a web-of-trust site for kernel.org and something I wouldn't mind having is a way to link from cgit to the web of trust for that person. E.g. an email address for torva...@linux-foundation.org on this page (http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=d6e0a2dd12f4067a5bcefb8bbd8ddbeff800afbc) would be wrapped in a link such as: a href=https://blah.kernel.org/?user=torvalds%40linux-foundation.org; torva...@linux-foundation.org/a which will bring up a page similar to: https://www.kernel.org/doc/wot/torvalds.html Not sure if you've been following along, but we've got the email-filter patches merged along with the lua support, so this should allow for some pretty neat scripts to do exactly what you want -- http://git.zx2c4.com/cgit/tree/filters/email-gravatar.lua as a sample. Is this API sufficient for you? If you don't want to have the web of trust links everywhere, you can use the page argument to filter_open as a distinguishing factor. Please let me know if you need anything else! Jason ___ CGit mailing list CGit@lists.zx2c4.com http://lists.zx2c4.com/mailman/listinfo/cgit
