- struct tag *tag;
- struct taginfo *info;
- struct object *obj;
- char buf[256], *url;
- unsigned char fileid[20];
-
- if (prefixcmp(refname, "refs/archives"))
- return 0;
- strncpy(buf, refname+14, sizeof(buf));
- obj = parse_object(sha1);
- if (!obj)
- return 1;
- if (obj->type == OBJ_TAG) {
- tag = lookup_tag(sha1);
- if (!tag || parse_tag(tag) || !(info = cgit_parse_tag(tag)))
- return 0;
- hashcpy(fileid, tag->tagged->sha1);
- } else if (obj->type != OBJ_BLOB) {
- return 0;
- } else {
- hashcpy(fileid, sha1);
- }
- if (!header) {
- html("<table id='downloads'>");
- html("<tr><th>Downloads</th></tr>");
- header = 1;
+ char *file, *base_dir, *full_path, *resolved_base = NULL, *resolved_full = NULL;
+ /* If a subpath is specified for the about page, make it relative
+ * to the directory containing the configured readme. */
+
+ file = xstrdup(filename);
+ base_dir = dirname(file);
+ if (!strcmp(base_dir, ".") || !strcmp(base_dir, "..")) {
+ if (!ref) {
+ free(file);
+ return NULL;
+ }
+ full_path = xstrdup(path);
+ } else
+ full_path = fmtalloc("%s/%s", base_dir, path);
+
+ if (!ref) {
+ resolved_base = realpath(base_dir, NULL);
+ resolved_full = realpath(full_path, NULL);
+ if (!resolved_base || !resolved_full || prefixcmp(resolved_full, resolved_base)) {
+ free(full_path);
+ full_path = NULL;
+ }