template.7: Use -width instead of -indent diff from Josiah Frentsos, thanks!

template.7: use An instead of Ar in AUTHORS diff from Josiah Frentsos, thanks!

template.1: Use -std with Ex diff from Josiah Frentsos, thanks!

gotwebd: templateify gotweb_render_diff To avoid calling functions from got_operations.c directly from a template (which would hide the error), change got_output_repo_diff into got_open_diff_for_output that returns a file with the diff in it, to be then rendered by the template. got_gotweb_flushfile needs to be exposed then. It also bundles a smaller change: the `label' argument of got_repo_match_object_id is optional and not used, so just pass NULL there.

template: specify which C loop

template: add `while' construct

switch gotd.conf syntax from 'unix_socket' to 'listen on' ok op@

template: drop tmpl.c from SRCS was added there mistakenly. it's not part of the "compiler", it's part of the "user library" and provides useful functions for the consumers.

gotd: delete unreachable code after gotd_shutdown()

gotwebd: urlencode also the double quote character URLs are embedded as part of the HTML and, while it seems legal from RFC3986 to leave that character unquoted, we need it quoted to avoid breaking the HTML output. ok tracey@

gotwebd: templateify gotweb_render_tree ok tracey@

gotwebd: css: fix horizontal overflow in blob and blame pages spotted by + "looks good" tracey@

gotwebd: render BLOB inline, add BLOBRAW for serving raw blobs binary blobs are automatically redirected to the BLOBRAW page (which is the old BLOB.) ok jamske

provide a getline-style function for blobs ok jamsek

revoke filesystem access in gotd listen process via unveil(2) This should avoid involuntary use of bind(2) with arbitrary socket paths. ok op@

expose 'gotctl info' output only to the root user Now that anyone can connect to the socket, it is probably safer to expose information about currently connected clients only to root.

gotwebd.conf: use `listen on socket' syntax for UNIX sockets too and drop unix_socket and unix_socket_path in server context. ok stsp@

remove the gotsh group requirement from gotd; any user can now connect Repository access is now controlled by access rules in gotd.conf, and concurrent connections to the gotd socket by local users are limited by the listen process. We should keep refining our anti-DoS measures in the future, but at least we have something in place now. ok jamsek, op

gotwebd: rework got_output_file_blob, no functional change can now use got_object_blob_is_binary to simplify the logic. ok stsp@

add got_object_blob_is_binary function needed for future use by gotwebd. ok stsp@

gotd.8: point people at gotsh.1 ssh restriction tips

gotwebd: remove erratic horizontal scrolling In some pages gotwebd shows horizontal scrollbars because the error message overflows the width. Remove the explicit width in the CSS, the message is still rendered fine and doesn't overflow the page. spotted by and ok tracey@

simplify gotd' timeouts string parsing no need to duplicate what strtonum does; pass the *real* maximum value allowed to it directly. ok stsp@

change gotweb_render_content_type argument type to const char * it's a string, `const char *' is fine (and what all the callers use anyway.)

gotwebd: use Content-Disposition for RSS; sets the filename Since gotwebd serves the RSS from a path without a file name component, browsers just make up a random string to give the file a name which can be confusing. Furthermore, since it's served as application/rss+xml they try to render the XML (failing.) Use gotweb_render_content_type_file (which sets the Content-Disposition HTTP header) to fix both: the feed is now called <repo-name>.rss and set as attachment (thus saved and not rendered.) Change the function to take an optional filename suffix for the occasion. ok jamsek