ui-shared: prevent malicious filename from injecting headers

[ps-cgit] / cgit.c

diff --git a/cgit.c b/cgit.c
index 28a2f149c6cd41d8c113acf4d6e9db254a82685f..05e5d5737d71cc302868ffd4f6388e8d1f947e9d 100644 (file)
--- a/cgit.c
+++ b/cgit.c
@@ -110,7 +110,7 @@ static void config_cb(const char *name, const char *value)
                ctx.repo->path = trim_end(value, '/');
        else if (ctx.repo && starts_with(name, "repo."))
                repo_config(ctx.repo, name + 5, value);
-       else if (!strcmp(name, "readme") && value != NULL)
+       else if (!strcmp(name, "readme"))
                string_list_append(&ctx.cfg.readme, xstrdup(value));
        else if (!strcmp(name, "root-title"))
                ctx.cfg.root_title = xstrdup(value);
@@ -651,7 +651,7 @@ static inline void open_auth_filter(const char *function)
 static inline void authenticate_post(void)
 {
        char buffer[MAX_AUTHENTICATION_POST_BYTES];
-       int len;
+       unsigned int len;
 
        open_auth_filter("authenticate-post");
        len = ctx.env.content_length;