ui-summary: Disallow directory traversal

[ps-cgit] / cgitrc.5.txt

diff --git a/cgitrc.5.txt b/cgitrc.5.txt
index 39b031eacaa56337508c9f4ab84cb1fd12fb356b..12a843bf9aeb58639775ccfbb5c30c5d80ef1766 100644 (file)
--- a/cgitrc.5.txt
+++ b/cgitrc.5.txt
@@ -29,9 +29,10 @@ GLOBAL SETTINGS
 about-filter::
        Specifies a command which will be invoked to format the content of
        about pages (both top-level and for each repository). The command will
-       get the content of the about-file on its STDIN, and the STDOUT from the
-       command will be included verbatim on the about page. Default value:
-       none. See also: "FILTER API".
+       get the content of the about-file on its STDIN, the name of the file
+       as the first argument, and the STDOUT from the command will be
+       included verbatim on the about page. Default value: none. See
+       also: "FILTER API".
 
 agefile::
        Specifies a path, relative to each repository path, which can be used
@@ -163,11 +164,12 @@ enable-tree-linenumbers::
 enable-git-config::
        Flag which, when set to "1", will allow cgit to use git config to set
        any repo specific settings. This option is used in conjunction with
-       "scan-path" to augment repo-specific settings. The keys gitweb.owner,
-       gitweb.category, and gitweb.description will map to the cgit keys
-       repo.owner, repo.section, and repo.desc, respectivly. All git config
-       keys that begin with "cgit." will be mapped to the corresponding "repo."
-       key in cgit. Default value: "0". See also: scan-path, section-from-path.
+       "scan-path", and must be defined prior, to augment repo-specific
+       settings. The keys gitweb.owner, gitweb.category, and gitweb.description
+       will map to the cgit keys repo.owner, repo.section, and repo.desc,
+       respectivly. All git config keys that begin with "cgit." will be mapped
+       to the corresponding "repo." key in cgit. Default value: "0". See also:
+       scan-path, section-from-path.
 
 favicon::
        Url used as link to a shortcut icon for cgit. If specified, it is
@@ -287,13 +289,15 @@ project-list::
        EXPANSION".
 
 readme::
-       Text which will be used as default value for "repo.readme". Default
-       value: none.
+       Text which will be used as default value for "repo.readme". Multiple
+       files may be specified, separated by a space, and cgit will use the
+       first found file in this list. Default value: none.
 
 remove-suffix::
        If set to "1" and scan-path is enabled, if any repositories are found
        with a suffix of ".git", this suffix will be removed for the url and
-       name. Default value: "0". See also: scan-path.
+       name. This must be defined prior to scan-path. Default value: "0".
+       See also: scan-path.
 
 renamelimit::
        Maximum number of files to consider when detecting renames. The value
@@ -357,7 +361,7 @@ section-sort::
        case-sensitive-sort, repository-sort.
 
 section-from-path::
-       A number which, if specified before scan-path, specifies how many
+       A number which, if defined prior to scan-path, specifies how many
        path elements from each repo path to use as a default section name.
        If negative, cgit will discard the specified number of path elements
        above the repo directory. Default value: "0".
@@ -396,8 +400,8 @@ strict-export::
        Filename which, if specified, needs to be present within the repository
        for cgit to allow access to that repository. This can be used to emulate
        gitweb's EXPORT_OK and STRICT_EXPORT functionality and limit cgit's
-       repositories to match those exported by git-daemon. This option MUST come
-       before 'scan-path'.
+       repositories to match those exported by git-daemon. This option must
+       be defined prior to scan-path.
 
 virtual-root::
        Url which, if specified, will be used as root for all cgit links. It
@@ -503,7 +507,12 @@ repo.readme::
        A path (relative to <repo.path>) which specifies a file to include
        verbatim as the "About" page for this repo. You may also specify a
        git refspec by head or by hash by prepending the refspec followed by
-       a colon. For example, "master:docs/readme.mkd" Default value: <readme>.
+       a colon. For example, "master:docs/readme.mkd". If the value begins
+       with a colon, i.e. ":docs/readme.rst", the default branch of the
+       repository will be used. Sharing any file will expose that entire
+       directory tree to the "/about/PATH" endpoints, so be sure that there
+       are no non-public files located in the same directory as the readme
+       file. Default value: <readme>.
 
 repo.snapshots::
        A mask of allowed snapshot-formats for this repo, restricted by the
@@ -538,9 +547,11 @@ config files, e.g. "repo.desc" becomes "desc".
 FILTER API
 ----------
 about filter::
-       This filter is given no arguments. The about text that is to be
-       filtered is available on standard input and the filtered text is
-       expected on standard output.
+       This filter is given a single parameter: the filename of the source
+       file to filter. The filter can use the filename to determine (for
+       example) the type of syntax to follow when formatting the readme file.
+       The about text that is to be filtered is available on standard input
+       and the filtered text is expected on standard output.
 
 commit filter::
        This filter is given no arguments. The commit message text that is to