user/sven/git.git/gitweb, branch v1.7.6.3

Merge branch 'jn/mime-type-with-params' into maint

2011-08-16T18:41:26Z

* jn/mime-type-with-params: gitweb: Serve */*+xml 'blob_plain' as text/plain with $prevent_xss gitweb: Serve text/* 'blob_plain' as text/plain with $prevent_xss

gitweb: Serve /+xml 'blob_plain' as text/plain with $prevent_xss

2011-06-30T18:26:48Z

Enhance usability of 'blob_plain' view protection against XSS attacks (enabled by setting $prevent_xss to true) by serving contents inline as safe 'text/plain' mimetype where possible, instead of serving with "Content-Disposition: attachment" to make sure they don't run in gitweb's security domain. This patch broadens downgrading to 'text/plain' further, to any */*+xml mimetype. This includes: application/xhtml+xml (*.xhtml, *.xht) application/atom+xml (*.atom) application/rss+xml (*.rss) application/mathml+xm (*.mathml) application/docbook+xml (*.docbook) image/svg+xml (*.svg, *.svgz) Probably most useful is serving XHTML files as text/plain in 'blob_plain' view, directly viewable. Because file with 'image/svg+xml' mimetype can be compressed SVGZ file, we have to check if */*+xml really is text file, via '-T $fd'. Signed-off-by: Jakub Narebski Signed-off-by: Junio C Hamano

gitweb: Serve text/* 'blob_plain' as text/plain with $prevent_xss

2011-06-30T18:26:39Z

One of mechanism enabled by setting $prevent_xss to true is 'blob_plain' view protection. With XSS prevention on, blobs of all types except a few known safe ones are served with "Content-Disposition: attachment" to make sure they don't run in our security domain. Instead of serving text/* type files, except text/plain (and including text/html), as attachements, downgrade it to text/plain. This way HTML pages in 'blob_plain' (raw) view would be displayed in browser, but safely as a source, and not asked to be saved. Signed-off-by: Jakub Narebski Signed-off-by: Junio C Hamano

Merge branch 'maint'

2011-06-21T21:56:59Z

* maint: gitweb: 'pickaxe' and 'grep' features requires 'search' to be enabled

gitweb: 'pickaxe' and 'grep' features requires 'search' to be enabled

2011-06-21T21:07:35Z

Both 'pickaxe' (searching changes) and 'grep' (searching files) require basic 'search' feature to be enabled to work. Enabling e.g. only 'pickaxe' won't work. Add a comment about this. Signed-off-by: Jakub Narebski Signed-off-by: Junio C Hamano

gitweb: do not misparse nonnumeric content tag files that contain a digit

2011-06-09T16:22:44Z

v1.7.6-rc0~27^2~4 (gitweb: Change the way "content tags" ('ctags') are handled, 2011-04-29) tried to make gitweb's tag cloud feature more intuitive for webmasters by checking whether the ctags/ under a project's .git dir contains a number (representing the strength of association to ) before treating it as one. With that change, after putting '$feature{'ctags'}{'default'} = [1];' in your $GITWEB_CONFIG, you could do echo Linux >.git/ctags/linux and gitweb would treat that as a request to tag the current repository with the Linux tag, instead of the previous behavior of writing an error page embedded in the projects list that triggers error messages from Chromium and Firefox about malformed XML. Unfortunately the pattern (\d+) used to match numbers is too loose, and the "XML declaration allowed only at the start of the document" error can still be experienced if you write "Linux-2.6" in place of "Linux" in the example above. Fix it by tightening the pattern to ^\d+$. Signed-off-by: Jonathan Nieder Signed-off-by: Junio C Hamano

Merge branch 'jn/mime-type-with-params'

2011-06-06T18:40:22Z

* jn/mime-type-with-params: gitweb: Fix usability of $prevent_xss

gitweb: Fix usability of $prevent_xss

2011-06-05T17:38:47Z

With XSS prevention on (enabled using $prevent_xss), blobs ('blob_plain') of all types except a few known safe ones are served with "Content-Disposition: attachment". However the check was too strict; it didn't take into account optional parameter attributes, media-type = type "/" subtype *( ";" parameter ) as described in RFC 2616 http://www.w3.org/Protocols/rfc2616/rfc2616-sec14.html#sec14.17 http://www.w3.org/Protocols/rfc2616/rfc2616-sec3.html#sec3.7 This fixes that, and it for example treats following as safe MIME media type: text/plain; charset=utf-8 Signed-off-by: Jakub Narebski Signed-off-by: Junio C Hamano

gitweb: Move "Requirements" up in gitweb/INSTALL

2011-06-03T17:00:24Z

This way you can examine prerequisites at first glance, before detailed instructions on installing gitweb. Straightforward text movement. Signed-off-by: Jakub Narebski Signed-off-by: Junio C Hamano

gitweb: Describe CSSMIN and JSMIN in gitweb/INSTALL

2011-06-02T18:16:56Z

The build-time configuration variables JSMIN and CSSMIN were mentioned only in Makefile; add their description to gitweb/INSTALL. This required moving description of GITWEB_JS up, near GITWEB_CSS and just introduced CSMIN and JSMIN. Signed-off-by: Jakub Narebski Signed-off-by: Junio C Hamano