| Age | Commit message (Collapse) | Author | |
|---|---|---|---|
| 2022-10-28 | add gitpad.encode_uri_component Lua function | Martin Fischer | |
| 2022-10-28 | drop gitpad.decode_toml Lua function | Martin Fischer | |
| The function made sense when we had Lua shebangs but now that they have been removed, the function doesn't make much sense anymore. | |||
| 2022-10-28 | refactor: avoid unnecessary LuaTable::get call | Martin Fischer | |
| 2022-10-28 | drop support for Lua shebangs | Martin Fischer | |
| Now that we have Lua templating, which is more flexible, it doesn't make sense to keep Lua shebangs around. | |||
| 2022-10-28 | implement lua-based templates | Martin Fischer | |
| 2022-10-28 | refactor: introduce lua_context function | Martin Fischer | |
| 2022-10-28 | stop rendering .html files via <iframe>s | Martin Fischer | |
| Now that we have Lua scripting we don't need iframes anymore. | |||
| 2022-08-14 | add gitpad.decode_toml lua method | Martin Fischer | |
| We are vendoring the rlua_serde crate because it currently depends on rlua 0.17, which is outdated and my attempts to contact the crate author were bounced by Yandex for somehow looking like spam. | |||
| 2022-08-14 | allow inline CSS (for lua scripts) | Martin Fischer | |
| 2022-07-30 | implement lua scripting | Martin Fischer | |
| Inspired by the Scribunto extension for MediaWiki. | |||
| 2022-07-30 | fix SoloController::build_url_path | Martin Fischer | |
| 2022-07-30 | set Referrer-Policy: same-origin for more privacy | Martin Fischer | |
| 2022-07-30 | fix regression: allow creation of branches | Martin Fischer | |
| 2022-07-30 | refactor: restructure build_response logic | Martin Fischer | |
| 2022-07-30 | add some basic tests | Martin Fischer | |
| 2022-07-29 | refactor: introduce SoloController::new | Martin Fischer | |
| 2022-07-27 | refactor: use Context::branch_head | Martin Fischer | |
| 2022-07-27 | refactor: remove needless borrows / returns | Martin Fischer | |
| 2022-07-27 | update clap dependency | Martin Fischer | |
| 2021-07-18 | refactor: use camino for UTF-8 paths | Martin Fischer | |
| 2021-07-18 | refactor: remove unreachable else branch | Martin Fischer | |
| When viewing the user directory of another user the request is intercepted beforehand by parse_url_path. | |||
| 2021-07-18 | support If-None-Match headers with W/ prefix | Martin Fischer | |
| 2021-07-05 | refactor: move HttpOrigin to new origins module | Martin Fischer | |
| 2021-07-05 | disable textarea spellcheck for ext not in (md, txt) | Martin Fischer | |
| 2021-07-05 | css: stop wrapping action links in div | Martin Fischer | |
| 2021-07-05 | refactor: stop wrapping Page.header in Option | Martin Fischer | |
| 2021-07-04 | refactor: short-circuit with ? instead of mapping | Martin Fischer | |
| 2021-07-04 | move src/help/*.html files to src/static/ | Martin Fischer | |
| 2021-07-04 | refactor: move Error rendering to error module | Martin Fischer | |
| 2021-07-04 | strictly enforce Host and Origin headers | Martin Fischer | |
| Previously the Origin header was only checked if you specified an origin with --origin on startup and when you didn't we just printed a warning that this might make you vulnerable to CSRF attacks. I implemented it this way since I wanted GitPad to be runnable without any command-line options, but such warnings are of course suboptimal for security since they can simply be ignored. This commit changes this behavior so that the Origin header is always checked for POST requests. If you just run "gitpad" the enforced origin defaults to http://127.0.0.1:<port>. Additionally this commit also enforces an exact Host header (extracted from the Origin) to prevent DNS rebinding attacks. | |||
| 2021-07-03 | refactor: introduce build_raw_response helper | Martin Fischer | |
| 2021-07-03 | render .html files securely using IFrames | Martin Fischer | |
| 2021-07-03 | allow renderers to mutate Page (and frame-src CSP) | Martin Fischer | |
| 2021-06-24 | generate <script> tags and CSP from Page vectors | Martin Fischer | |
| 2021-06-24 | refactor render_page | Martin Fischer | |
| 2021-06-24 | make CSP stricter by setting default-src to 'self' | Martin Fischer | |
| Embedding remote files can leak info via the Referer header. Also changes child-src to frame-src since it has a higher precedence. (https://www.w3.org/TR/CSP3/#changes-from-level-2) | |||
| 2021-06-24 | refactor: simplify Page and Context structs | Martin Fischer | |
| Previously the Page struct contained references to the Controller and the http::request::Parts, so that page.render() could call controller.user_info_html(parts). This commit removes these references from the Page struct, so that it can implement Default in the future. The Context struct needs to be moved around since it contains git2::Repository, which isn't Send. Previously the Context struct also contained the http::request::Parts, so they were moved along. This commit extracts Parts out of the Context struct, so that our service function can access Parts after invoking our build_request method, allowing us to easily log request details for errors in the future. | |||
| 2021-06-24 | refactor: simplify Controller request interception | Martin Fischer | |
| In multi-user mode if Alice attempts to access /~bob/ she would get an Unauthorized error since branches are private. To improve the UX we instead already showed Alice a list of which files Bob has shared with her. Previously this was achieved with an before_return_error hook in the Controller trait. While this worked fine, it wasn't elegant, since it required passing the Context struct in all Unauthorized errors, so that the before_return_error hook could access the context. This commit refactors the code to intercept requests to paths like /~bob/ before the regular request handling instead of afterwards. While this could have been implemented in the before_route hook, this would have required either invoking parse_url_path a second time or passing the Result of parse_url_path, both of which would be akward. Therefore this commit also merges before_route into parse_url_path. | |||
| 2021-06-24 | css: decrease margin-top for h1 | Martin Fischer | |
| 2021-06-24 | log: allow diffing specific revisions | Martin Fischer | |
| 2021-06-24 | log: mark up dates as headings | Martin Fischer | |
| 2021-06-24 | css: set row-gap for body | Martin Fischer | |
| 2021-06-24 | refactor diff_blob | Martin Fischer | |
| 2021-06-24 | refactor: move Error enum and impls to own module | Martin Fischer | |
| 2021-06-24 | split off diff action from log action | Martin Fischer | |
| 2021-06-24 | refactor: split up blob routes into functions | Martin Fischer | |
| 2021-06-23 | make single-user mode operate on HEAD branch | Martin Fischer | |
| 2021-06-23 | stop using #![feature] to support stable Rust | Martin Fischer | |
| 2021-06-23 | refactor: split off shares.rs from controller.rs | Martin Fischer | |
| 2021-06-23 | refactor: split up main.rs into multiple modules | Martin Fischer | |
 |
index : gitpad-legacy | |
| A git web interface with editing and Markdown support. |
| aboutsummaryrefslogtreecommitdiff |