1 /*
2  * Copyright (c) 2016, 2019, 2020-2022 Tracey Emery <tracey@traceyemery.net>
3  * Copyright (c) 2015 Mike Larkin <mlarkin@openbsd.org>
4  * Copyright (c) 2014 Reyk Floeter <reyk@openbsd.org>
5  * Copyright (c) 2013 David Gwynne <dlg@openbsd.org>
6  * Copyright (c) 2013 Florian Obser <florian@openbsd.org>
7  *
8  * Permission to use, copy, modify, and distribute this software for any
9  * purpose with or without fee is hereby granted, provided that the above
10  * copyright notice and this permission notice appear in all copies.
11  *
12  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
13  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
14  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
15  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
16  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
17  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
18  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
19  */
20 #include "got_compat.h"
21 
22 #include <net/if.h>
23 #include <netinet/in.h>
24 #include <sys/queue.h>
25 #include <sys/stat.h>
26 #include <sys/types.h>
27 
28 #include <ctype.h>
29 #include <dirent.h>
30 #include <errno.h>
31 #include <event.h>
32 #include <fcntl.h>
33 #include <imsg.h>
34 #include <stdio.h>
35 #include <stdlib.h>
36 #include <string.h>
37 #include <unistd.h>
38 
39 #include "got_error.h"
40 #include "got_object.h"
41 #include "got_reference.h"
42 #include "got_repository.h"
43 #include "got_path.h"
44 #include "got_cancel.h"
45 #include "got_worktree.h"
46 #include "got_diff.h"
47 #include "got_commit_graph.h"
48 #include "got_blame.h"
49 #include "got_privsep.h"
50 
51 #include "proc.h"
52 #include "gotwebd.h"
53 #include "tmpl.h"
54 
55 static const struct querystring_keys querystring_keys[] = {
56 	{ "action",		ACTION },
57 	{ "commit",		COMMIT },
58 	{ "file",		RFILE },
59 	{ "folder",		FOLDER },
60 	{ "headref",		HEADREF },
61 	{ "index_page",		INDEX_PAGE },
62 	{ "path",		PATH },
63 	{ "page",		PAGE },
64 };
65 
66 static const struct action_keys action_keys[] = {
67 	{ "blame",	BLAME },
68 	{ "blob",	BLOB },
69 	{ "blobraw",	BLOBRAW },
70 	{ "briefs",	BRIEFS },
71 	{ "commits",	COMMITS },
72 	{ "diff",	DIFF },
73 	{ "error",	ERR },
74 	{ "index",	INDEX },
75 	{ "summary",	SUMMARY },
76 	{ "tag",	TAG },
77 	{ "tags",	TAGS },
78 	{ "tree",	TREE },
79 	{ "rss",	RSS },
80 };
81 
82 static const struct got_error *gotweb_init_querystring(struct querystring **);
83 static const struct got_error *gotweb_parse_querystring(struct querystring **,
84     char *);
85 static const struct got_error *gotweb_assign_querystring(struct querystring **,
86     char *, char *);
87 static int gotweb_render_index(struct template *);
88 static const struct got_error *gotweb_init_repo_dir(struct repo_dir **,
89     const char *);
90 static const struct got_error *gotweb_load_got_path(struct request *c,
91     struct repo_dir *);
92 static const struct got_error *gotweb_get_repo_description(char **,
93     struct server *, const char *, int);
94 static const struct got_error *gotweb_get_clone_url(char **, struct server *,
95     const char *, int);
96 
97 static void gotweb_free_querystring(struct querystring *);
98 static void gotweb_free_repo_dir(struct repo_dir *);
99 
100 struct server *gotweb_get_server(uint8_t *, uint8_t *);
101 
102 static int
103 gotweb_reply(struct request *c, int status, const char *ctype,
104     struct gotweb_url *location)
105 {
106 	const char	*csp;
107 
108 	if (status != 200 && fcgi_printf(c, "Status: %d\r\n", status) == -1)
109 		return -1;
110 
111 	if (location) {
112 		if (fcgi_puts(c->tp, "Location: ") == -1 ||
113 		    gotweb_render_url(c, location) == -1 ||
114 		    fcgi_puts(c->tp, "\r\n") == -1)
115 			return -1;
116 	}
117 
118 	csp = "Content-Security-Policy: default-src 'self'; "
119 	    "script-src 'none'; object-src 'none';\r\n";
120 	if (fcgi_puts(c->tp, csp) == -1)
121 		return -1;
122 
123 	if (ctype && fcgi_printf(c, "Content-Type: %s\r\n", ctype) == -1)
124 		return -1;
125 
126 	return fcgi_puts(c->tp, "\r\n");
127 }
128 
129 static int
130 gotweb_reply_file(struct request *c, const char *ctype, const char *file,
131     const char *suffix)
132 {
133 	int r;
134 
135 	r = fcgi_printf(c, "Content-Disposition: attachment; "
136 	    "filename=%s%s\r\n", file, suffix ? suffix : "");
137 	if (r == -1)
138 		return -1;
139 	return gotweb_reply(c, 200, ctype, NULL);
140 }
141 
142 void
143 gotweb_process_request(struct request *c)
144 {
145 	const struct got_error *error = NULL;
146 	struct server *srv = NULL;
147 	struct querystring *qs = NULL;
148 	struct repo_dir *repo_dir = NULL;
149 	const char *rss_ctype = "application/rss+xml;charset=utf-8";
150 	const uint8_t *buf;
151 	size_t len;
152 	int r, binary = 0;
153 
154 	/* init the transport */
155 	error = gotweb_init_transport(&c->t);
156 	if (error) {
157 		log_warnx("%s: %s", __func__, error->msg);
158 		return;
159 	}
160 	/* don't process any further if client disconnected */
161 	if (c->sock->client_status == CLIENT_DISCONNECT)
162 		return;
163 	/* get the gotwebd server */
164 	srv = gotweb_get_server(c->server_name, c->http_host);
165 	if (srv == NULL) {
166 		log_warnx("%s: error server is NULL", __func__);
167 		goto err;
168 	}
169 	c->srv = srv;
170 	/* parse our querystring */
171 	error = gotweb_init_querystring(&qs);
172 	if (error) {
173 		log_warnx("%s: %s", __func__, error->msg);
174 		goto err;
175 	}
176 	c->t->qs = qs;
177 	error = gotweb_parse_querystring(&qs, c->querystring);
178 	if (error) {
179 		log_warnx("%s: %s", __func__, error->msg);
180 		goto err;
181 	}
182 
183 	/*
184 	 * certain actions require a commit id in the querystring. this stops
185 	 * bad actors from exploiting this by manually manipulating the
186 	 * querystring.
187 	 */
188 
189 	if (qs->action == BLAME || qs->action == BLOB ||
190 	    qs->action == BLOBRAW || qs->action == DIFF) {
191 		if (qs->commit == NULL) {
192 			error = got_error(GOT_ERR_QUERYSTRING);
193 			goto err;
194 		}
195 	}
196 
197 	if (qs->action != INDEX) {
198 		error = gotweb_init_repo_dir(&repo_dir, qs->path);
199 		if (error)
200 			goto err;
201 		error = gotweb_load_got_path(c, repo_dir);
202 		c->t->repo_dir = repo_dir;
203 		if (error && error->code != GOT_ERR_LONELY_PACKIDX)
204 			goto err;
205 	}
206 
207 	if (qs->action == BLOBRAW || qs->action == BLOB) {
208 		error = got_get_repo_commits(c, 1);
209 		if (error)
210 			goto err;
211 
212 		error = got_open_blob_for_output(&c->t->blob, &c->t->fd,
213 		    &binary, c);
214 		if (error)
215 			goto err;
216 	}
217 
218 	switch(qs->action) {
219 	case BLAME:
220 		error = got_get_repo_commits(c, 1);
221 		if (error) {
222 			log_warnx("%s: %s", __func__, error->msg);
223 			goto err;
224 		}
225 		if (gotweb_reply(c, 200, "text/html", NULL) == -1)
226 			return;
227 		gotweb_render_page(c->tp, gotweb_render_blame);
228 		return;
229 	case BLOB:
230 		if (binary) {
231 			struct gotweb_url url = {
232 				.index_page = -1,
233 				.page = -1,
234 				.action = BLOBRAW,
235 				.path = qs->path,
236 				.commit = qs->commit,
237 				.folder = qs->folder,
238 				.file = qs->file,
239 			};
240 
241 			gotweb_reply(c, 302, NULL, &url);
242 			return;
243 		}
244 
245 		if (gotweb_reply(c, 200, "text/html", NULL) == -1)
246 			return;
247 		gotweb_render_page(c->tp, gotweb_render_blob);
248 		return;
249 	case BLOBRAW:
250 		if (binary)
251 			r = gotweb_reply_file(c, "application/octet-stream",
252 			    qs->file, NULL);
253 		else
254 			r = gotweb_reply(c, 200, "text/plain", NULL);
255 		if (r == -1)
256 			return;
257 
258 		for (;;) {
259 			error = got_object_blob_read_block(&len, c->t->blob);
260 			if (error)
261 				break;
262 			if (len == 0)
263 				break;
264 			buf = got_object_blob_get_read_buf(c->t->blob);
265 			if (fcgi_gen_binary_response(c, buf, len) == -1)
266 				break;
267 		}
268 		return;
269 	case BRIEFS:
270 		if (gotweb_reply(c, 200, "text/html", NULL) == -1)
271 			return;
272 		gotweb_render_page(c->tp, gotweb_render_briefs);
273 		return;
274 	case COMMITS:
275 		error = got_get_repo_commits(c, srv->max_commits_display);
276 		if (error) {
277 			log_warnx("%s: %s", __func__, error->msg);
278 			goto err;
279 		}
280 		if (gotweb_reply(c, 200, "text/html", NULL) == -1)
281 			return;
282 		gotweb_render_page(c->tp, gotweb_render_commits);
283 		return;
284 	case DIFF:
285 		error = got_get_repo_commits(c, 1);
286 		if (error) {
287 			log_warnx("%s: %s", __func__, error->msg);
288 			goto err;
289 		}
290 		error = got_open_diff_for_output(&c->t->fp, &c->t->fd, c);
291 		if (error) {
292 			log_warnx("%s: %s", __func__, error->msg);
293 			goto err;
294 		}
295 		if (gotweb_reply(c, 200, "text/html", NULL) == -1)
296 			return;
297 		gotweb_render_page(c->tp, gotweb_render_diff);
298 		return;
299 	case INDEX:
300 		c->t->nrepos = scandir(srv->repos_path, &c->t->repos, NULL,
301 		    alphasort);
302 		if (c->t->nrepos == -1) {
303 			c->t->repos = NULL;
304 			error = got_error_from_errno2("scandir",
305 			    srv->repos_path);
306 			goto err;
307 		}
308 		if (gotweb_reply(c, 200, "text/html", NULL) == -1)
309 			return;
310 		gotweb_render_page(c->tp, gotweb_render_index);
311 		return;
312 	case RSS:
313 		error = got_get_repo_tags(c, D_MAXSLCOMMDISP);
314 		if (error)
315 			goto err;
316 		if (gotweb_reply_file(c, rss_ctype, repo_dir->name, ".rss")
317 		    == -1)
318 			return;
319 		gotweb_render_rss(c->tp);
320 		return;
321 	case SUMMARY:
322 		error = got_ref_list(&c->t->refs, c->t->repo, "refs/heads",
323 		    got_ref_cmp_by_name, NULL);
324 		if (error) {
325 			log_warnx("%s: got_ref_list: %s", __func__,
326 			    error->msg);
327 			goto err;
328 		}
329 		qs->action = TAGS;
330 		error = got_get_repo_tags(c, D_MAXSLCOMMDISP);
331 		if (error) {
332 			log_warnx("%s: got_get_repo_tags: %s", __func__,
333 			    error->msg);
334 			goto err;
335 		}
336 		qs->action = SUMMARY;
337 		if (gotweb_reply(c, 200, "text/html", NULL) == -1)
338 			return;
339 		gotweb_render_page(c->tp, gotweb_render_summary);
340 		return;
341 	case TAG:
342 		error = got_get_repo_tags(c, 1);
343 		if (error) {
344 			log_warnx("%s: %s", __func__, error->msg);
345 			goto err;
346 		}
347 		if (c->t->tag_count == 0) {
348 			error = got_error_msg(GOT_ERR_BAD_OBJ_ID,
349 			    "bad commit id");
350 			goto err;
351 		}
352 		if (gotweb_reply(c, 200, "text/html", NULL) == -1)
353 			return;
354 		gotweb_render_page(c->tp, gotweb_render_tag);
355 		return;
356 	case TAGS:
357 		error = got_get_repo_tags(c, srv->max_commits_display);
358 		if (error) {
359 			log_warnx("%s: %s", __func__, error->msg);
360 			goto err;
361 		}
362 		if (gotweb_reply(c, 200, "text/html", NULL) == -1)
363 			return;
364 		gotweb_render_page(c->tp, gotweb_render_tags);
365 		return;
366 	case TREE:
367 		error = got_get_repo_commits(c, 1);
368 		if (error) {
369 			log_warnx("%s: %s", __func__, error->msg);
370 			goto err;
371 		}
372 		if (gotweb_reply(c, 200, "text/html", NULL) == -1)
373 			return;
374 		gotweb_render_page(c->tp, gotweb_render_tree);
375 		return;
376 	case ERR:
377 	default:
378 		error = got_error(GOT_ERR_BAD_QUERYSTRING);
379 	}
380 
381 err:
382 	c->t->error = error;
383 	if (gotweb_reply(c, 400, "text/html", NULL) == -1)
384 		return;
385 	gotweb_render_page(c->tp, gotweb_render_error);
386 }
387 
388 struct server *
389 gotweb_get_server(uint8_t *server_name, uint8_t *subdomain)
390 {
391 	struct server *srv = NULL;
392 
393 	/* check against the server name first */
394 	if (strlen(server_name) > 0)
395 		TAILQ_FOREACH(srv, &gotwebd_env->servers, entry)
396 			if (strcmp(srv->name, server_name) == 0)
397 				goto done;
398 
399 	/* check against subdomain second */
400 	if (strlen(subdomain) > 0)
401 		TAILQ_FOREACH(srv, &gotwebd_env->servers, entry)
402 			if (strcmp(srv->name, subdomain) == 0)
403 				goto done;
404 
405 	/* if those fail, send first server */
406 	TAILQ_FOREACH(srv, &gotwebd_env->servers, entry)
407 		if (srv != NULL)
408 			break;
409 done:
410 	return srv;
411 };
412 
413 const struct got_error *
414 gotweb_init_transport(struct transport **t)
415 {
416 	const struct got_error *error = NULL;
417 
418 	*t = calloc(1, sizeof(**t));
419 	if (*t == NULL)
420 		return got_error_from_errno2("%s: calloc", __func__);
421 
422 	TAILQ_INIT(&(*t)->repo_commits);
423 	TAILQ_INIT(&(*t)->repo_tags);
424 	TAILQ_INIT(&(*t)->refs);
425 
426 	(*t)->repo = NULL;
427 	(*t)->repo_dir = NULL;
428 	(*t)->qs = NULL;
429 	(*t)->next_id = NULL;
430 	(*t)->prev_id = NULL;
431 	(*t)->next_disp = 0;
432 	(*t)->prev_disp = 0;
433 
434 	(*t)->fd = -1;
435 
436 	return error;
437 }
438 
439 static const struct got_error *
440 gotweb_init_querystring(struct querystring **qs)
441 {
442 	const struct got_error *error = NULL;
443 
444 	*qs = calloc(1, sizeof(**qs));
445 	if (*qs == NULL)
446 		return got_error_from_errno2("%s: calloc", __func__);
447 
448 	(*qs)->headref = strdup("HEAD");
449 	if ((*qs)->headref == NULL) {
450 		free(*qs);
451 		*qs = NULL;
452 		return got_error_from_errno2("%s: strdup", __func__);
453 	}
454 
455 	(*qs)->action = INDEX;
456 	(*qs)->commit = NULL;
457 	(*qs)->file = NULL;
458 	(*qs)->folder = NULL;
459 	(*qs)->index_page = 0;
460 	(*qs)->path = NULL;
461 
462 	return error;
463 }
464 
465 static const struct got_error *
466 gotweb_parse_querystring(struct querystring **qs, char *qst)
467 {
468 	const struct got_error *error = NULL;
469 	char *tok1 = NULL, *tok1_pair = NULL, *tok1_end = NULL;
470 	char *tok2 = NULL, *tok2_pair = NULL, *tok2_end = NULL;
471 
472 	if (qst == NULL)
473 		return error;
474 
475 	tok1 = strdup(qst);
476 	if (tok1 == NULL)
477 		return got_error_from_errno2("%s: strdup", __func__);
478 
479 	tok1_pair = tok1;
480 	tok1_end = tok1;
481 
482 	while (tok1_pair != NULL) {
483 		strsep(&tok1_end, "&");
484 
485 		tok2 = strdup(tok1_pair);
486 		if (tok2 == NULL) {
487 			free(tok1);
488 			return got_error_from_errno2("%s: strdup", __func__);
489 		}
490 
491 		tok2_pair = tok2;
492 		tok2_end = tok2;
493 
494 		while (tok2_pair != NULL) {
495 			strsep(&tok2_end, "=");
496 			if (tok2_end) {
497 				error = gotweb_assign_querystring(qs, tok2_pair,
498 				    tok2_end);
499 				if (error)
500 					goto err;
501 			}
502 			tok2_pair = tok2_end;
503 		}
504 		free(tok2);
505 		tok1_pair = tok1_end;
506 	}
507 	free(tok1);
508 	return error;
509 err:
510 	free(tok2);
511 	free(tok1);
512 	return error;
513 }
514 
515 /*
516  * Adapted from usr.sbin/httpd/httpd.c url_decode.
517  */
518 static const struct got_error *
519 gotweb_urldecode(char *url)
520 {
521 	char		*p, *q;
522 	char		 hex[3];
523 	unsigned long	 x;
524 
525 	hex[2] = '\0';
526 	p = q = url;
527 
528 	while (*p != '\0') {
529 		switch (*p) {
530 		case '%':
531 			/* Encoding character is followed by two hex chars */
532 			if (!isxdigit((unsigned char)p[1]) ||
533 			    !isxdigit((unsigned char)p[2]) ||
534 			    (p[1] == '0' && p[2] == '0'))
535 				return got_error(GOT_ERR_BAD_QUERYSTRING);
536 
537 			hex[0] = p[1];
538 			hex[1] = p[2];
539 
540 			/*
541 			 * We don't have to validate "hex" because it is
542 			 * guaranteed to include two hex chars followed by nul.
543 			 */
544 			x = strtoul(hex, NULL, 16);
545 			*q = (char)x;
546 			p += 2;
547 			break;
548 		default:
549 			*q = *p;
550 			break;
551 		}
552 		p++;
553 		q++;
554 	}
555 	*q = '\0';
556 
557 	return NULL;
558 }
559 
560 static const struct got_error *
561 gotweb_assign_querystring(struct querystring **qs, char *key, char *value)
562 {
563 	const struct got_error *error = NULL;
564 	const char *errstr;
565 	int a_cnt, el_cnt;
566 
567 	error = gotweb_urldecode(value);
568 	if (error)
569 		return error;
570 
571 	for (el_cnt = 0; el_cnt < QSELEM__MAX; el_cnt++) {
572 		if (strcmp(key, querystring_keys[el_cnt].name) != 0)
573 			continue;
574 
575 		switch (querystring_keys[el_cnt].element) {
576 		case ACTION:
577 			for (a_cnt = 0; a_cnt < ACTIONS__MAX; a_cnt++) {
578 				if (strcmp(value, action_keys[a_cnt].name) != 0)
579 					continue;
580 				else if (strcmp(value,
581 				    action_keys[a_cnt].name) == 0){
582 					(*qs)->action =
583 					    action_keys[a_cnt].action;
584 					goto qa_found;
585 				}
586 			}
587 			(*qs)->action = ERR;
588 qa_found:
589 			break;
590 		case COMMIT:
591 			(*qs)->commit = strdup(value);
592 			if ((*qs)->commit == NULL) {
593 				error = got_error_from_errno2("%s: strdup",
594 				    __func__);
595 				goto done;
596 			}
597 			break;
598 		case RFILE:
599 			(*qs)->file = strdup(value);
600 			if ((*qs)->file == NULL) {
601 				error = got_error_from_errno2("%s: strdup",
602 				    __func__);
603 				goto done;
604 			}
605 			break;
606 		case FOLDER:
607 			(*qs)->folder = strdup(value);
608 			if ((*qs)->folder == NULL) {
609 				error = got_error_from_errno2("%s: strdup",
610 				    __func__);
611 				goto done;
612 			}
613 			break;
614 		case HEADREF:
615 			free((*qs)->headref);
616 			(*qs)->headref = strdup(value);
617 			if ((*qs)->headref == NULL) {
618 				error = got_error_from_errno2("%s: strdup",
619 				    __func__);
620 				goto done;
621 			}
622 			break;
623 		case INDEX_PAGE:
624 			if (strlen(value) == 0)
625 				break;
626 			(*qs)->index_page = strtonum(value, INT64_MIN,
627 			    INT64_MAX, &errstr);
628 			if (errstr) {
629 				error = got_error_from_errno3("%s: strtonum %s",
630 				    __func__, errstr);
631 				goto done;
632 			}
633 			if ((*qs)->index_page < 0)
634 				(*qs)->index_page = 0;
635 			break;
636 		case PATH:
637 			(*qs)->path = strdup(value);
638 			if ((*qs)->path == NULL) {
639 				error = got_error_from_errno2("%s: strdup",
640 				    __func__);
641 				goto done;
642 			}
643 			break;
644 		case PAGE:
645 			if (strlen(value) == 0)
646 				break;
647 			(*qs)->page = strtonum(value, INT64_MIN,
648 			    INT64_MAX, &errstr);
649 			if (errstr) {
650 				error = got_error_from_errno3("%s: strtonum %s",
651 				    __func__, errstr);
652 				goto done;
653 			}
654 			if ((*qs)->page < 0)
655 				(*qs)->page = 0;
656 			break;
657 		default:
658 			break;
659 		}
660 	}
661 done:
662 	return error;
663 }
664 
665 void
666 gotweb_free_repo_tag(struct repo_tag *rt)
667 {
668 	if (rt != NULL) {
669 		free(rt->commit_id);
670 		free(rt->tag_name);
671 		free(rt->tag_commit);
672 		free(rt->commit_msg);
673 		free(rt->tagger);
674 	}
675 	free(rt);
676 }
677 
678 void
679 gotweb_free_repo_commit(struct repo_commit *rc)
680 {
681 	if (rc != NULL) {
682 		free(rc->path);
683 		free(rc->refs_str);
684 		free(rc->commit_id);
685 		free(rc->parent_id);
686 		free(rc->tree_id);
687 		free(rc->author);
688 		free(rc->committer);
689 		free(rc->commit_msg);
690 	}
691 	free(rc);
692 }
693 
694 static void
695 gotweb_free_querystring(struct querystring *qs)
696 {
697 	if (qs != NULL) {
698 		free(qs->commit);
699 		free(qs->file);
700 		free(qs->folder);
701 		free(qs->headref);
702 		free(qs->path);
703 	}
704 	free(qs);
705 }
706 
707 static void
708 gotweb_free_repo_dir(struct repo_dir *repo_dir)
709 {
710 	if (repo_dir != NULL) {
711 		free(repo_dir->name);
712 		free(repo_dir->owner);
713 		free(repo_dir->description);
714 		free(repo_dir->url);
715 		free(repo_dir->path);
716 	}
717 	free(repo_dir);
718 }
719 
720 void
721 gotweb_free_transport(struct transport *t)
722 {
723 	const struct got_error *err;
724 	struct repo_commit *rc = NULL, *trc = NULL;
725 	struct repo_tag *rt = NULL, *trt = NULL;
726 	int i;
727 
728 	got_ref_list_free(&t->refs);
729 	TAILQ_FOREACH_SAFE(rc, &t->repo_commits, entry, trc) {
730 		TAILQ_REMOVE(&t->repo_commits, rc, entry);
731 		gotweb_free_repo_commit(rc);
732 	}
733 	TAILQ_FOREACH_SAFE(rt, &t->repo_tags, entry, trt) {
734 		TAILQ_REMOVE(&t->repo_tags, rt, entry);
735 		gotweb_free_repo_tag(rt);
736 	}
737 	gotweb_free_repo_dir(t->repo_dir);
738 	gotweb_free_querystring(t->qs);
739 	free(t->more_id);
740 	free(t->next_id);
741 	free(t->prev_id);
742 	if (t->blob)
743 		got_object_blob_close(t->blob);
744 	if (t->fp) {
745 		err = got_gotweb_flushfile(t->fp, t->fd);
746 		if (err)
747 			log_warnx("%s: got_gotweb_flushfile failure: %s",
748 			    __func__, err->msg);
749 		t->fd = -1;
750 	}
751 	if (t->fd != -1)
752 		close(t->fd);
753 	if (t->repos) {
754 		for (i = 0; i < t->nrepos; ++i)
755 			free(t->repos[i]);
756 		free(t->repos);
757 	}
758 	free(t);
759 }
760 
761 void
762 gotweb_get_navs(struct request *c, struct gotweb_url *prev, int *have_prev,
763     struct gotweb_url *next, int *have_next)
764 {
765 	struct transport *t = c->t;
766 	struct querystring *qs = t->qs;
767 	struct server *srv = c->srv;
768 
769 	*have_prev = *have_next = 0;
770 
771 	switch(qs->action) {
772 	case INDEX:
773 		if (qs->index_page > 0) {
774 			*have_prev = 1;
775 			*prev = (struct gotweb_url){
776 				.action = -1,
777 				.index_page = qs->index_page - 1,
778 				.page = -1,
779 			};
780 		}
781 		if (t->next_disp == srv->max_repos_display &&
782 		    t->repos_total != (qs->index_page + 1) *
783 		    srv->max_repos_display) {
784 			*have_next = 1;
785 			*next = (struct gotweb_url){
786 				.action = -1,
787 				.index_page = qs->index_page + 1,
788 				.page = -1,
789 			};
790 		}
791 		break;
792 	case TAGS:
793 		if (t->prev_id && qs->commit != NULL &&
794 		    strcmp(qs->commit, t->prev_id) != 0) {
795 			*have_prev = 1;
796 			*prev = (struct gotweb_url){
797 				.action = TAGS,
798 				.index_page = -1,
799 				.page = qs->page - 1,
800 				.path = qs->path,
801 				.commit = t->prev_id,
802 				.headref = qs->headref,
803 			};
804 		}
805 		if (t->next_id) {
806 			*have_next = 1;
807 			*next = (struct gotweb_url){
808 				.action = TAGS,
809 				.index_page = -1,
810 				.page = qs->page + 1,
811 				.path = qs->path,
812 				.commit = t->next_id,
813 				.headref = qs->headref,
814 			};
815 		}
816 		break;
817 	}
818 }
819 
820 static int
821 gotweb_render_index(struct template *tp)
822 {
823 	const struct got_error *error = NULL;
824 	struct request *c = tp->tp_arg;
825 	struct server *srv = c->srv;
826 	struct transport *t = c->t;
827 	struct querystring *qs = t->qs;
828 	struct repo_dir *repo_dir = NULL;
829 	struct dirent **sd_dent = t->repos;
830 	unsigned int d_i, d_disp = 0;
831 	unsigned int d_skipped = 0;
832 	int type, r;
833 
834 	if (gotweb_render_repo_table_hdr(c->tp) == -1)
835 		return -1;
836 
837 	for (d_i = 0; d_i < t->nrepos; d_i++) {
838 		if (srv->max_repos > 0 && t->prev_disp == srv->max_repos)
839 			break;
840 
841 		if (strcmp(sd_dent[d_i]->d_name, ".") == 0 ||
842 		    strcmp(sd_dent[d_i]->d_name, "..") == 0) {
843 			d_skipped++;
844 			continue;
845 		}
846 
847 		error = got_path_dirent_type(&type, srv->repos_path,
848 		    sd_dent[d_i]);
849 		if (error)
850 			continue;
851 		if (type != DT_DIR) {
852 			d_skipped++;
853 			continue;
854 		}
855 
856 		if (qs->index_page > 0 && (qs->index_page *
857 		    srv->max_repos_display) > t->prev_disp) {
858 			t->prev_disp++;
859 			continue;
860 		}
861 
862 		error = gotweb_init_repo_dir(&repo_dir, sd_dent[d_i]->d_name);
863 		if (error)
864 			continue;
865 
866 		error = gotweb_load_got_path(c, repo_dir);
867 		if (error && error->code == GOT_ERR_LONELY_PACKIDX) {
868 			if (error->code != GOT_ERR_NOT_GIT_REPO)
869 				log_warnx("%s: %s: %s", __func__,
870 				    sd_dent[d_i]->d_name, error->msg);
871 			gotweb_free_repo_dir(repo_dir);
872 			repo_dir = NULL;
873 			d_skipped++;
874 			continue;
875 		}
876 
877 		d_disp++;
878 		t->prev_disp++;
879 
880 		r = gotweb_render_repo_fragment(c->tp, repo_dir);
881 		gotweb_free_repo_dir(repo_dir);
882 		if (r == -1)
883 			return -1;
884 
885 		t->next_disp++;
886 		if (d_disp == srv->max_repos_display)
887 			break;
888 	}
889 	t->repos_total = t->nrepos - d_skipped;
890 
891 	if (srv->max_repos_display == 0)
892 		return 0;
893 	if (srv->max_repos > 0 && srv->max_repos < srv->max_repos_display)
894 		return 0;
895 	if (t->repos_total <= srv->max_repos ||
896 	    t->repos_total <= srv->max_repos_display)
897 		return 0;
898 
899 	if (gotweb_render_navs(c->tp) == -1)
900 		return -1;
901 
902 	return 0;
903 }
904 
905 static inline int
906 should_urlencode(int c)
907 {
908 	if (c <= ' ' || c >= 127)
909 		return 1;
910 
911 	switch (c) {
912 		/* gen-delim */
913 	case ':':
914 	case '/':
915 	case '?':
916 	case '#':
917 	case '[':
918 	case ']':
919 	case '@':
920 		/* sub-delims */
921 	case '!':
922 	case '$':
923 	case '&':
924 	case '\'':
925 	case '(':
926 	case ')':
927 	case '*':
928 	case '+':
929 	case ',':
930 	case ';':
931 	case '=':
932 		/* needed because the URLs are embedded into the HTML */
933 	case '\"':
934 		return 1;
935 	default:
936 		return 0;
937 	}
938 }
939 
940 static char *
941 gotweb_urlencode(const char *str)
942 {
943 	const char *s;
944 	char *escaped;
945 	size_t i, len;
946 	int a, b;
947 
948 	len = 0;
949 	for (s = str; *s; ++s) {
950 		len++;
951 		if (should_urlencode(*s))
952 			len += 2;
953 	}
954 
955 	escaped = calloc(1, len + 1);
956 	if (escaped == NULL)
957 		return NULL;
958 
959 	i = 0;
960 	for (s = str; *s; ++s) {
961 		if (should_urlencode(*s)) {
962 			a = (*s & 0xF0) >> 4;
963 			b = (*s & 0x0F);
964 
965 			escaped[i++] = '%';
966 			escaped[i++] = a <= 9 ? ('0' + a) : ('7' + a);
967 			escaped[i++] = b <= 9 ? ('0' + b) : ('7' + b);
968 		} else
969 			escaped[i++] = *s;
970 	}
971 
972 	return escaped;
973 }
974 
975 const char *
976 gotweb_action_name(int action)
977 {
978 	switch (action) {
979 	case BLAME:
980 		return "blame";
981 	case BLOB:
982 		return "blob";
983 	case BLOBRAW:
984 		return "blobraw";
985 	case BRIEFS:
986 		return "briefs";
987 	case COMMITS:
988 		return "commits";
989 	case DIFF:
990 		return "diff";
991 	case ERR:
992 		return "err";
993 	case INDEX:
994 		return "index";
995 	case SUMMARY:
996 		return "summary";
997 	case TAG:
998 		return "tag";
999 	case TAGS:
1000 		return "tags";
1001 	case TREE:
1002 		return "tree";
1003 	case RSS:
1004 		return "rss";
1005 	default:
1006 		return NULL;
1007 	}
1008 }
1009 
1010 int
1011 gotweb_render_url(struct request *c, struct gotweb_url *url)
1012 {
1013 	const char *sep = "?", *action;
1014 	char *tmp;
1015 	int r;
1016 
1017 	action = gotweb_action_name(url->action);
1018 	if (action != NULL) {
1019 		if (fcgi_printf(c, "?action=%s", action) == -1)
1020 			return -1;
1021 		sep = "&";
1022 	}
1023 
1024 	if (url->commit) {
1025 		if (fcgi_printf(c, "%scommit=%s", sep, url->commit) == -1)
1026 			return -1;
1027 		sep = "&";
1028 	}
1029 
1030 	if (url->previd) {
1031 		if (fcgi_printf(c, "%sprevid=%s", sep, url->previd) == -1)
1032 			return -1;
1033 		sep = "&";
1034 	}
1035 
1036 	if (url->prevset) {
1037 		if (fcgi_printf(c, "%sprevset=%s", sep, url->prevset) == -1)
1038 			return -1;
1039 		sep = "&";
1040 	}
1041 
1042 	if (url->file) {
1043 		tmp = gotweb_urlencode(url->file);
1044 		if (tmp == NULL)
1045 			return -1;
1046 		r = fcgi_printf(c, "%sfile=%s", sep, tmp);
1047 		free(tmp);
1048 		if (r == -1)
1049 			return -1;
1050 		sep = "&";
1051 	}
1052 
1053 	if (url->folder) {
1054 		tmp = gotweb_urlencode(url->folder);
1055 		if (tmp == NULL)
1056 			return -1;
1057 		r = fcgi_printf(c, "%sfolder=%s", sep, tmp);
1058 		free(tmp);
1059 		if (r == -1)
1060 			return -1;
1061 		sep = "&";
1062 	}
1063 
1064 	if (url->headref) {
1065 		tmp = gotweb_urlencode(url->headref);
1066 		if (tmp == NULL)
1067 			return -1;
1068 		r = fcgi_printf(c, "%sheadref=%s", sep, url->headref);
1069 		free(tmp);
1070 		if (r == -1)
1071 			return -1;
1072 		sep = "&";
1073 	}
1074 
1075 	if (url->index_page != -1) {
1076 		if (fcgi_printf(c, "%sindex_page=%d", sep,
1077 		    url->index_page) == -1)
1078 			return -1;
1079 		sep = "&";
1080 	}
1081 
1082 	if (url->path) {
1083 		tmp = gotweb_urlencode(url->path);
1084 		if (tmp == NULL)
1085 			return -1;
1086 		r = fcgi_printf(c, "%spath=%s", sep, tmp);
1087 		free(tmp);
1088 		if (r == -1)
1089 			return -1;
1090 		sep = "&";
1091 	}
1092 
1093 	if (url->page != -1) {
1094 		if (fcgi_printf(c, "%spage=%d", sep, url->page) == -1)
1095 			return -1;
1096 		sep = "&";
1097 	}
1098 
1099 	return 0;
1100 }
1101 
1102 int
1103 gotweb_render_absolute_url(struct request *c, struct gotweb_url *url)
1104 {
1105 	struct template	*tp = c->tp;
1106 	const char	*proto = c->https ? "https" : "http";
1107 
1108 	if (fcgi_puts(tp, proto) == -1 ||
1109 	    fcgi_puts(tp, "://") == -1 ||
1110 	    tp_htmlescape(tp, c->server_name) == -1 ||
1111 	    tp_htmlescape(tp, c->document_uri) == -1)
1112 		return -1;
1113 
1114 	return gotweb_render_url(c, url);
1115 }
1116 
1117 static struct got_repository *
1118 find_cached_repo(struct server *srv, const char *path)
1119 {
1120 	int i;
1121 
1122 	for (i = 0; i < srv->ncached_repos; i++) {
1123 		if (strcmp(srv->cached_repos[i].path, path) == 0)
1124 			return srv->cached_repos[i].repo;
1125 	}
1126 
1127 	return NULL;
1128 }
1129 
1130 static const struct got_error *
1131 cache_repo(struct got_repository **new, struct server *srv,
1132     struct repo_dir *repo_dir, struct socket *sock)
1133 {
1134 	const struct got_error *error = NULL;
1135 	struct got_repository *repo;
1136 	struct cached_repo *cr;
1137 	int evicted = 0;
1138 
1139 	if (srv->ncached_repos >= GOTWEBD_REPO_CACHESIZE) {
1140 		cr = &srv->cached_repos[srv->ncached_repos - 1];
1141 		error = got_repo_close(cr->repo);
1142 		memset(cr, 0, sizeof(*cr));
1143 		srv->ncached_repos--;
1144 		if (error)
1145 			return error;
1146 		memmove(&srv->cached_repos[1], &srv->cached_repos[0],
1147 		    srv->ncached_repos * sizeof(srv->cached_repos[0]));
1148 		cr = &srv->cached_repos[0];
1149 		evicted = 1;
1150 	} else {
1151 		cr = &srv->cached_repos[srv->ncached_repos];
1152 	}
1153 
1154 	error = got_repo_open(&repo, repo_dir->path, NULL, sock->pack_fds);
1155 	if (error) {
1156 		if (evicted) {
1157 			memmove(&srv->cached_repos[0], &srv->cached_repos[1],
1158 			    srv->ncached_repos * sizeof(srv->cached_repos[0]));
1159 		}
1160 		return error;
1161 	}
1162 
1163 	if (strlcpy(cr->path, repo_dir->path, sizeof(cr->path))
1164 	    >= sizeof(cr->path)) {
1165 		if (evicted) {
1166 			memmove(&srv->cached_repos[0], &srv->cached_repos[1],
1167 			    srv->ncached_repos * sizeof(srv->cached_repos[0]));
1168 		}
1169 		return got_error(GOT_ERR_NO_SPACE);
1170 	}
1171 
1172 	cr->repo = repo;
1173 	srv->ncached_repos++;
1174 	*new = repo;
1175 	return NULL;
1176 }
1177 
1178 static const struct got_error *
1179 gotweb_load_got_path(struct request *c, struct repo_dir *repo_dir)
1180 {
1181 	const struct got_error *error = NULL;
1182 	struct socket *sock = c->sock;
1183 	struct server *srv = c->srv;
1184 	struct transport *t = c->t;
1185 	struct got_repository *repo = NULL;
1186 	DIR *dt;
1187 	char *dir_test;
1188 
1189 	if (asprintf(&dir_test, "%s/%s/%s", srv->repos_path, repo_dir->name,
1190 	    GOTWEB_GIT_DIR) == -1)
1191 		return got_error_from_errno("asprintf");
1192 
1193 	dt = opendir(dir_test);
1194 	if (dt == NULL) {
1195 		free(dir_test);
1196 	} else {
1197 		repo_dir->path = dir_test;
1198 		dir_test = NULL;
1199 		goto done;
1200 	}
1201 
1202 	if (asprintf(&dir_test, "%s/%s", srv->repos_path,
1203 	    repo_dir->name) == -1)
1204 		return got_error_from_errno("asprintf");
1205 
1206 	dt = opendir(dir_test);
1207 	if (dt == NULL) {
1208 		error = got_error_path(repo_dir->name, GOT_ERR_NOT_GIT_REPO);
1209 		goto err;
1210 	} else {
1211 		repo_dir->path = dir_test;
1212 		dir_test = NULL;
1213 	}
1214 
1215 done:
1216 	if (srv->respect_exportok &&
1217 	    faccessat(dirfd(dt), "git-daemon-export-ok", F_OK, 0) == -1) {
1218 		error = got_error_path(repo_dir->name, GOT_ERR_NOT_GIT_REPO);
1219 		goto err;
1220 	}
1221 
1222 	repo = find_cached_repo(srv, repo_dir->path);
1223 	if (repo == NULL) {
1224 		error = cache_repo(&repo, srv, repo_dir, sock);
1225 		if (error)
1226 			goto err;
1227 	}
1228 	t->repo = repo;
1229 	error = gotweb_get_repo_description(&repo_dir->description, srv,
1230 	    repo_dir->path, dirfd(dt));
1231 	if (error)
1232 		goto err;
1233 	error = got_get_repo_owner(&repo_dir->owner, c);
1234 	if (error)
1235 		goto err;
1236 	error = got_get_repo_age(&repo_dir->age, c, NULL);
1237 	if (error)
1238 		goto err;
1239 	error = gotweb_get_clone_url(&repo_dir->url, srv, repo_dir->path,
1240 	    dirfd(dt));
1241 err:
1242 	free(dir_test);
1243 	if (dt != NULL && closedir(dt) == EOF && error == NULL)
1244 		error = got_error_from_errno("closedir");
1245 	return error;
1246 }
1247 
1248 static const struct got_error *
1249 gotweb_init_repo_dir(struct repo_dir **repo_dir, const char *dir)
1250 {
1251 	const struct got_error *error;
1252 
1253 	*repo_dir = calloc(1, sizeof(**repo_dir));
1254 	if (*repo_dir == NULL)
1255 		return got_error_from_errno("calloc");
1256 
1257 	if (asprintf(&(*repo_dir)->name, "%s", dir) == -1) {
1258 		error = got_error_from_errno("asprintf");
1259 		free(*repo_dir);
1260 		*repo_dir = NULL;
1261 		return error;
1262 	}
1263 	(*repo_dir)->owner = NULL;
1264 	(*repo_dir)->description = NULL;
1265 	(*repo_dir)->url = NULL;
1266 	(*repo_dir)->path = NULL;
1267 
1268 	return NULL;
1269 }
1270 
1271 static const struct got_error *
1272 gotweb_get_repo_description(char **description, struct server *srv,
1273     const char *dirpath, int dir)
1274 {
1275 	const struct got_error *error = NULL;
1276 	struct stat sb;
1277 	int fd = -1;
1278 	off_t len;
1279 
1280 	*description = NULL;
1281 	if (srv->show_repo_description == 0)
1282 		return NULL;
1283 
1284 	fd = openat(dir, "description", O_RDONLY);
1285 	if (fd == -1) {
1286 		if (errno != ENOENT && errno != EACCES) {
1287 			error = got_error_from_errno_fmt("openat %s/%s",
1288 			    dirpath, "description");
1289 		}
1290 		goto done;
1291 	}
1292 
1293 	if (fstat(fd, &sb) == -1) {
1294 		error = got_error_from_errno_fmt("fstat %s/%s",
1295 		    dirpath, "description");
1296 		goto done;
1297 	}
1298 
1299 	len = sb.st_size;
1300 	if (len > GOTWEBD_MAXDESCRSZ - 1)
1301 		len = GOTWEBD_MAXDESCRSZ - 1;
1302 
1303 	*description = calloc(len + 1, sizeof(**description));
1304 	if (*description == NULL) {
1305 		error = got_error_from_errno("calloc");
1306 		goto done;
1307 	}
1308 
1309 	if (read(fd, *description, len) == -1)
1310 		error = got_error_from_errno("read");
1311 done:
1312 	if (fd != -1 && close(fd) == -1 && error == NULL)
1313 		error = got_error_from_errno("close");
1314 	return error;
1315 }
1316 
1317 static const struct got_error *
1318 gotweb_get_clone_url(char **url, struct server *srv, const char *dirpath,
1319     int dir)
1320 {
1321 	const struct got_error *error = NULL;
1322 	struct stat sb;
1323 	int fd = -1;
1324 	off_t len;
1325 
1326 	*url = NULL;
1327 	if (srv->show_repo_cloneurl == 0)
1328 		return NULL;
1329 
1330 	fd = openat(dir, "cloneurl", O_RDONLY);
1331 	if (fd == -1) {
1332 		if (errno != ENOENT && errno != EACCES) {
1333 			error = got_error_from_errno_fmt("openat %s/%s",
1334 			    dirpath, "cloneurl");
1335 		}
1336 		goto done;
1337 	}
1338 
1339 	if (fstat(fd, &sb) == -1) {
1340 		error = got_error_from_errno_fmt("fstat %s/%s",
1341 		    dirpath, "cloneurl");
1342 		goto done;
1343 	}
1344 
1345 	len = sb.st_size;
1346 	if (len > GOTWEBD_MAXCLONEURLSZ - 1)
1347 		len = GOTWEBD_MAXCLONEURLSZ - 1;
1348 
1349 	*url = calloc(len + 1, sizeof(**url));
1350 	if (*url == NULL) {
1351 		error = got_error_from_errno("calloc");
1352 		goto done;
1353 	}
1354 
1355 	if (read(fd, *url, len) == -1)
1356 		error = got_error_from_errno("read");
1357 done:
1358 	if (fd != -1 && close(fd) == -1 && error == NULL)
1359 		error = got_error_from_errno("close");
1360 	return error;
1361 }
1362 
1363 int
1364 gotweb_render_age(struct template *tp, time_t committer_time, int ref_tm)
1365 {
1366 	struct request *c = tp->tp_arg;
1367 	struct tm tm;
1368 	long long diff_time;
1369 	const char *years = "years ago", *months = "months ago";
1370 	const char *weeks = "weeks ago", *days = "days ago";
1371 	const char *hours = "hours ago",  *minutes = "minutes ago";
1372 	const char *seconds = "seconds ago", *now = "right now";
1373 	char *s;
1374 	char datebuf[64];
1375 	size_t r;
1376 
1377 	switch (ref_tm) {
1378 	case TM_DIFF:
1379 		diff_time = time(NULL) - committer_time;
1380 		if (diff_time > 60 * 60 * 24 * 365 * 2) {
1381 			if (fcgi_printf(c, "%lld %s",
1382 			    (diff_time / 60 / 60 / 24 / 365), years) == -1)
1383 				return -1;
1384 		} else if (diff_time > 60 * 60 * 24 * (365 / 12) * 2) {
1385 			if (fcgi_printf(c, "%lld %s",
1386 			    (diff_time / 60 / 60 / 24 / (365 / 12)),
1387 			    months) == -1)
1388 				return -1;
1389 		} else if (diff_time > 60 * 60 * 24 * 7 * 2) {
1390 			if (fcgi_printf(c, "%lld %s",
1391 			    (diff_time / 60 / 60 / 24 / 7), weeks) == -1)
1392 				return -1;
1393 		} else if (diff_time > 60 * 60 * 24 * 2) {
1394 			if (fcgi_printf(c, "%lld %s",
1395 			    (diff_time / 60 / 60 / 24), days) == -1)
1396 				return -1;
1397 		} else if (diff_time > 60 * 60 * 2) {
1398 			if (fcgi_printf(c, "%lld %s",
1399 			    (diff_time / 60 / 60), hours) == -1)
1400 				return -1;
1401 		} else if (diff_time > 60 * 2) {
1402 			if (fcgi_printf(c, "%lld %s", (diff_time / 60),
1403 			    minutes) == -1)
1404 				return -1;
1405 		} else if (diff_time > 2) {
1406 			if (fcgi_printf(c, "%lld %s", diff_time,
1407 			    seconds) == -1)
1408 				return -1;
1409 		} else {
1410 			if (fcgi_puts(tp, now) == -1)
1411 				return -1;
1412 		}
1413 		break;
1414 	case TM_LONG:
1415 		if (gmtime_r(&committer_time, &tm) == NULL)
1416 			return -1;
1417 
1418 		s = asctime_r(&tm, datebuf);
1419 		if (s == NULL)
1420 			return -1;
1421 
1422 		if (fcgi_puts(tp, datebuf) == -1 ||
1423 		    fcgi_puts(tp, " UTC") == -1)
1424 			return -1;
1425 		break;
1426 	case TM_RFC822:
1427 		if (gmtime_r(&committer_time, &tm) == NULL)
1428 			return -1;
1429 
1430 		r = strftime(datebuf, sizeof(datebuf),
1431 		    "%a, %d %b %Y %H:%M:%S GMT", &tm);
1432 		if (r == 0)
1433 			return -1;
1434 
1435 		if (fcgi_puts(tp, datebuf) == -1)
1436 			return -1;
1437 		break;
1438 	}
1439 	return 0;
1440 }