1 /*
2  * Copyright (c) 2016, 2019, 2020-2022 Tracey Emery <tracey@traceyemery.net>
3  * Copyright (c) 2015 Mike Larkin <mlarkin@openbsd.org>
4  * Copyright (c) 2014 Reyk Floeter <reyk@openbsd.org>
5  * Copyright (c) 2013 David Gwynne <dlg@openbsd.org>
6  * Copyright (c) 2013 Florian Obser <florian@openbsd.org>
7  *
8  * Permission to use, copy, modify, and distribute this software for any
9  * purpose with or without fee is hereby granted, provided that the above
10  * copyright notice and this permission notice appear in all copies.
11  *
12  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
13  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
14  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
15  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
16  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
17  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
18  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
19  */
20 #include "got_compat.h"
21 
22 #include <net/if.h>
23 #include <netinet/in.h>
24 #include <sys/queue.h>
25 #include <sys/stat.h>
26 #include <sys/types.h>
27 
28 #include <ctype.h>
29 #include <dirent.h>
30 #include <errno.h>
31 #include <event.h>
32 #include <fcntl.h>
33 #include <imsg.h>
34 #include <stdio.h>
35 #include <stdlib.h>
36 #include <string.h>
37 #include <unistd.h>
38 
39 #include "got_error.h"
40 #include "got_object.h"
41 #include "got_reference.h"
42 #include "got_repository.h"
43 #include "got_path.h"
44 #include "got_cancel.h"
45 #include "got_worktree.h"
46 #include "got_diff.h"
47 #include "got_commit_graph.h"
48 #include "got_blame.h"
49 #include "got_privsep.h"
50 
51 #include "proc.h"
52 #include "gotwebd.h"
53 #include "tmpl.h"
54 
55 static const struct querystring_keys querystring_keys[] = {
56 	{ "action",		ACTION },
57 	{ "commit",		COMMIT },
58 	{ "file",		RFILE },
59 	{ "folder",		FOLDER },
60 	{ "headref",		HEADREF },
61 	{ "index_page",		INDEX_PAGE },
62 	{ "path",		PATH },
63 	{ "page",		PAGE },
64 };
65 
66 static const struct action_keys action_keys[] = {
67 	{ "blame",	BLAME },
68 	{ "blob",	BLOB },
69 	{ "blobraw",	BLOBRAW },
70 	{ "briefs",	BRIEFS },
71 	{ "commits",	COMMITS },
72 	{ "diff",	DIFF },
73 	{ "error",	ERR },
74 	{ "index",	INDEX },
75 	{ "summary",	SUMMARY },
76 	{ "tag",	TAG },
77 	{ "tags",	TAGS },
78 	{ "tree",	TREE },
79 	{ "rss",	RSS },
80 };
81 
82 static const struct got_error *gotweb_init_querystring(struct querystring **);
83 static const struct got_error *gotweb_parse_querystring(struct querystring **,
84     char *);
85 static const struct got_error *gotweb_assign_querystring(struct querystring **,
86     char *, char *);
87 static int gotweb_render_index(struct template *);
88 static const struct got_error *gotweb_init_repo_dir(struct repo_dir **,
89     const char *);
90 static const struct got_error *gotweb_load_got_path(struct request *c,
91     struct repo_dir *);
92 static const struct got_error *gotweb_get_repo_description(char **,
93     struct server *, const char *, int);
94 static const struct got_error *gotweb_get_clone_url(char **, struct server *,
95     const char *, int);
96 
97 static void gotweb_free_querystring(struct querystring *);
98 static void gotweb_free_repo_dir(struct repo_dir *);
99 
100 struct server *gotweb_get_server(uint8_t *, uint8_t *);
101 
102 static int
103 gotweb_reply(struct request *c, int status, const char *ctype,
104     struct gotweb_url *location)
105 {
106 	const char	*csp;
107 
108 	if (status != 200 && fcgi_printf(c, "Status: %d\r\n", status) == -1)
109 		return -1;
110 
111 	if (location) {
112 		if (fcgi_puts(c->tp, "Location: ") == -1 ||
113 		    gotweb_render_url(c, location) == -1 ||
114 		    fcgi_puts(c->tp, "\r\n") == -1)
115 			return -1;
116 	}
117 
118 	csp = "Content-Security-Policy: default-src 'self'; "
119 	    "script-src 'none'; object-src 'none';\r\n";
120 	if (fcgi_puts(c->tp, csp) == -1)
121 		return -1;
122 
123 	if (ctype && fcgi_printf(c, "Content-Type: %s\r\n", ctype) == -1)
124 		return -1;
125 
126 	return fcgi_puts(c->tp, "\r\n");
127 }
128 
129 static int
130 gotweb_reply_file(struct request *c, const char *ctype, const char *file,
131     const char *suffix)
132 {
133 	int r;
134 
135 	r = fcgi_printf(c, "Content-Disposition: attachment; "
136 	    "filename=%s%s\r\n", file, suffix ? suffix : "");
137 	if (r == -1)
138 		return -1;
139 	return gotweb_reply(c, 200, ctype, NULL);
140 }
141 
142 void
143 gotweb_process_request(struct request *c)
144 {
145 	const struct got_error *error = NULL;
146 	struct server *srv = NULL;
147 	struct querystring *qs = NULL;
148 	struct repo_dir *repo_dir = NULL;
149 
150 	/* init the transport */
151 	error = gotweb_init_transport(&c->t);
152 	if (error) {
153 		log_warnx("%s: %s", __func__, error->msg);
154 		return;
155 	}
156 	/* don't process any further if client disconnected */
157 	if (c->sock->client_status == CLIENT_DISCONNECT)
158 		return;
159 	/* get the gotwebd server */
160 	srv = gotweb_get_server(c->server_name, c->http_host);
161 	if (srv == NULL) {
162 		log_warnx("%s: error server is NULL", __func__);
163 		goto err;
164 	}
165 	c->srv = srv;
166 	/* parse our querystring */
167 	error = gotweb_init_querystring(&qs);
168 	if (error) {
169 		log_warnx("%s: %s", __func__, error->msg);
170 		goto err;
171 	}
172 	c->t->qs = qs;
173 	error = gotweb_parse_querystring(&qs, c->querystring);
174 	if (error) {
175 		log_warnx("%s: %s", __func__, error->msg);
176 		goto err;
177 	}
178 
179 	/*
180 	 * certain actions require a commit id in the querystring. this stops
181 	 * bad actors from exploiting this by manually manipulating the
182 	 * querystring.
183 	 */
184 
185 	if (qs->action == BLAME || qs->action == BLOB ||
186 	    qs->action == BLOBRAW || qs->action == DIFF) {
187 		if (qs->commit == NULL) {
188 			error = got_error(GOT_ERR_QUERYSTRING);
189 			goto err;
190 		}
191 	}
192 
193 	if (qs->action != INDEX) {
194 		error = gotweb_init_repo_dir(&repo_dir, qs->path);
195 		if (error)
196 			goto err;
197 		error = gotweb_load_got_path(c, repo_dir);
198 		c->t->repo_dir = repo_dir;
199 		if (error && error->code != GOT_ERR_LONELY_PACKIDX)
200 			goto err;
201 	}
202 
203 	if (qs->action == BLOBRAW) {
204 		const uint8_t *buf;
205 		size_t len;
206 		int binary, r;
207 
208 		error = got_get_repo_commits(c, 1);
209 		if (error)
210 			goto err;
211 
212 		error = got_open_blob_for_output(&c->t->blob, &c->t->fd,
213 		    &binary, c);
214 		if (error)
215 			goto err;
216 
217 		if (binary)
218 			r = gotweb_reply_file(c, "application/octet-stream",
219 			    qs->file, NULL);
220 		else
221 			r = gotweb_reply(c, 200, "text/plain", NULL);
222 		if (r == -1)
223 			return;
224 
225 		for (;;) {
226 			error = got_object_blob_read_block(&len, c->t->blob);
227 			if (error)
228 				break;
229 			if (len == 0)
230 				break;
231 			buf = got_object_blob_get_read_buf(c->t->blob);
232 			if (fcgi_gen_binary_response(c, buf, len) == -1)
233 				break;
234 		}
235 
236 		return;
237 	}
238 
239 	if (qs->action == BLOB) {
240 		int binary;
241 		struct gotweb_url url = {
242 			.index_page = -1,
243 			.page = -1,
244 			.action = BLOBRAW,
245 			.path = qs->path,
246 			.commit = qs->commit,
247 			.folder = qs->folder,
248 			.file = qs->file,
249 		};
250 
251 		error = got_get_repo_commits(c, 1);
252 		if (error)
253 			goto err;
254 
255 		error = got_open_blob_for_output(&c->t->blob, &c->t->fd,
256 		    &binary, c);
257 		if (error)
258 			goto err;
259 		if (binary) {
260 			gotweb_reply(c, 302, NULL, &url);
261 			return;
262 		}
263 	}
264 
265 	if (qs->action == RSS) {
266 		const char *ctype = "application/rss+xml;charset=utf-8";
267 
268 		if (gotweb_reply_file(c, ctype, repo_dir->name, ".rss") == -1)
269 			return;
270 
271 		error = got_get_repo_tags(c, D_MAXSLCOMMDISP);
272 		if (error) {
273 			log_warnx("%s: %s", __func__, error->msg);
274 			return;
275 		}
276 		gotweb_render_rss(c->tp);
277 		return;
278 	}
279 
280 	switch(qs->action) {
281 	case BLAME:
282 		error = got_get_repo_commits(c, 1);
283 		if (error) {
284 			log_warnx("%s: %s", __func__, error->msg);
285 			goto err;
286 		}
287 		if (gotweb_reply(c, 200, "text/html", NULL) == -1)
288 			return;
289 		gotweb_render_page(c->tp, gotweb_render_blame);
290 		return;
291 	case BLOB:
292 		if (gotweb_reply(c, 200, "text/html", NULL) == -1)
293 			return;
294 		gotweb_render_page(c->tp, gotweb_render_blob);
295 		return;
296 	case BRIEFS:
297 		if (gotweb_reply(c, 200, "text/html", NULL) == -1)
298 			return;
299 		gotweb_render_page(c->tp, gotweb_render_briefs);
300 		return;
301 	case COMMITS:
302 		error = got_get_repo_commits(c, srv->max_commits_display);
303 		if (error) {
304 			log_warnx("%s: %s", __func__, error->msg);
305 			goto err;
306 		}
307 		if (gotweb_reply(c, 200, "text/html", NULL) == -1)
308 			return;
309 		gotweb_render_page(c->tp, gotweb_render_commits);
310 		return;
311 	case DIFF:
312 		error = got_get_repo_commits(c, 1);
313 		if (error) {
314 			log_warnx("%s: %s", __func__, error->msg);
315 			goto err;
316 		}
317 		error = got_open_diff_for_output(&c->t->fp, &c->t->fd, c);
318 		if (error) {
319 			log_warnx("%s: %s", __func__, error->msg);
320 			goto err;
321 		}
322 		if (gotweb_reply(c, 200, "text/html", NULL) == -1)
323 			return;
324 		gotweb_render_page(c->tp, gotweb_render_diff);
325 		return;
326 	case INDEX:
327 		c->t->nrepos = scandir(srv->repos_path, &c->t->repos, NULL,
328 		    alphasort);
329 		if (c->t->nrepos == -1) {
330 			c->t->repos = NULL;
331 			error = got_error_from_errno2("scandir",
332 			    srv->repos_path);
333 			goto err;
334 		}
335 		if (gotweb_reply(c, 200, "text/html", NULL) == -1)
336 			return;
337 		gotweb_render_page(c->tp, gotweb_render_index);
338 		return;
339 	case SUMMARY:
340 		error = got_ref_list(&c->t->refs, c->t->repo, "refs/heads",
341 		    got_ref_cmp_by_name, NULL);
342 		if (error) {
343 			log_warnx("%s: got_ref_list: %s", __func__,
344 			    error->msg);
345 			goto err;
346 		}
347 		qs->action = TAGS;
348 		error = got_get_repo_tags(c, D_MAXSLCOMMDISP);
349 		if (error) {
350 			log_warnx("%s: got_get_repo_tags: %s", __func__,
351 			    error->msg);
352 			goto err;
353 		}
354 		qs->action = SUMMARY;
355 		if (gotweb_reply(c, 200, "text/html", NULL) == -1)
356 			return;
357 		gotweb_render_page(c->tp, gotweb_render_summary);
358 		return;
359 	case TAG:
360 		error = got_get_repo_tags(c, 1);
361 		if (error) {
362 			log_warnx("%s: %s", __func__, error->msg);
363 			goto err;
364 		}
365 		if (c->t->tag_count == 0) {
366 			error = got_error_msg(GOT_ERR_BAD_OBJ_ID,
367 			    "bad commit id");
368 			goto err;
369 		}
370 		if (gotweb_reply(c, 200, "text/html", NULL) == -1)
371 			return;
372 		gotweb_render_page(c->tp, gotweb_render_tag);
373 		return;
374 	case TAGS:
375 		error = got_get_repo_tags(c, srv->max_commits_display);
376 		if (error) {
377 			log_warnx("%s: %s", __func__, error->msg);
378 			goto err;
379 		}
380 		if (gotweb_reply(c, 200, "text/html", NULL) == -1)
381 			return;
382 		gotweb_render_page(c->tp, gotweb_render_tags);
383 		return;
384 	case TREE:
385 		error = got_get_repo_commits(c, 1);
386 		if (error) {
387 			log_warnx("%s: %s", __func__, error->msg);
388 			goto err;
389 		}
390 		if (gotweb_reply(c, 200, "text/html", NULL) == -1)
391 			return;
392 		gotweb_render_page(c->tp, gotweb_render_tree);
393 		return;
394 	case ERR:
395 	default:
396 		error = got_error(GOT_ERR_BAD_QUERYSTRING);
397 	}
398 
399 err:
400 	c->t->error = error;
401 	if (gotweb_reply(c, 400, "text/html", NULL) == -1)
402 		return;
403 	gotweb_render_page(c->tp, gotweb_render_error);
404 }
405 
406 struct server *
407 gotweb_get_server(uint8_t *server_name, uint8_t *subdomain)
408 {
409 	struct server *srv = NULL;
410 
411 	/* check against the server name first */
412 	if (strlen(server_name) > 0)
413 		TAILQ_FOREACH(srv, &gotwebd_env->servers, entry)
414 			if (strcmp(srv->name, server_name) == 0)
415 				goto done;
416 
417 	/* check against subdomain second */
418 	if (strlen(subdomain) > 0)
419 		TAILQ_FOREACH(srv, &gotwebd_env->servers, entry)
420 			if (strcmp(srv->name, subdomain) == 0)
421 				goto done;
422 
423 	/* if those fail, send first server */
424 	TAILQ_FOREACH(srv, &gotwebd_env->servers, entry)
425 		if (srv != NULL)
426 			break;
427 done:
428 	return srv;
429 };
430 
431 const struct got_error *
432 gotweb_init_transport(struct transport **t)
433 {
434 	const struct got_error *error = NULL;
435 
436 	*t = calloc(1, sizeof(**t));
437 	if (*t == NULL)
438 		return got_error_from_errno2("%s: calloc", __func__);
439 
440 	TAILQ_INIT(&(*t)->repo_commits);
441 	TAILQ_INIT(&(*t)->repo_tags);
442 	TAILQ_INIT(&(*t)->refs);
443 
444 	(*t)->repo = NULL;
445 	(*t)->repo_dir = NULL;
446 	(*t)->qs = NULL;
447 	(*t)->next_id = NULL;
448 	(*t)->prev_id = NULL;
449 	(*t)->next_disp = 0;
450 	(*t)->prev_disp = 0;
451 
452 	(*t)->fd = -1;
453 
454 	return error;
455 }
456 
457 static const struct got_error *
458 gotweb_init_querystring(struct querystring **qs)
459 {
460 	const struct got_error *error = NULL;
461 
462 	*qs = calloc(1, sizeof(**qs));
463 	if (*qs == NULL)
464 		return got_error_from_errno2("%s: calloc", __func__);
465 
466 	(*qs)->headref = strdup("HEAD");
467 	if ((*qs)->headref == NULL) {
468 		free(*qs);
469 		*qs = NULL;
470 		return got_error_from_errno2("%s: strdup", __func__);
471 	}
472 
473 	(*qs)->action = INDEX;
474 	(*qs)->commit = NULL;
475 	(*qs)->file = NULL;
476 	(*qs)->folder = NULL;
477 	(*qs)->index_page = 0;
478 	(*qs)->path = NULL;
479 
480 	return error;
481 }
482 
483 static const struct got_error *
484 gotweb_parse_querystring(struct querystring **qs, char *qst)
485 {
486 	const struct got_error *error = NULL;
487 	char *tok1 = NULL, *tok1_pair = NULL, *tok1_end = NULL;
488 	char *tok2 = NULL, *tok2_pair = NULL, *tok2_end = NULL;
489 
490 	if (qst == NULL)
491 		return error;
492 
493 	tok1 = strdup(qst);
494 	if (tok1 == NULL)
495 		return got_error_from_errno2("%s: strdup", __func__);
496 
497 	tok1_pair = tok1;
498 	tok1_end = tok1;
499 
500 	while (tok1_pair != NULL) {
501 		strsep(&tok1_end, "&");
502 
503 		tok2 = strdup(tok1_pair);
504 		if (tok2 == NULL) {
505 			free(tok1);
506 			return got_error_from_errno2("%s: strdup", __func__);
507 		}
508 
509 		tok2_pair = tok2;
510 		tok2_end = tok2;
511 
512 		while (tok2_pair != NULL) {
513 			strsep(&tok2_end, "=");
514 			if (tok2_end) {
515 				error = gotweb_assign_querystring(qs, tok2_pair,
516 				    tok2_end);
517 				if (error)
518 					goto err;
519 			}
520 			tok2_pair = tok2_end;
521 		}
522 		free(tok2);
523 		tok1_pair = tok1_end;
524 	}
525 	free(tok1);
526 	return error;
527 err:
528 	free(tok2);
529 	free(tok1);
530 	return error;
531 }
532 
533 /*
534  * Adapted from usr.sbin/httpd/httpd.c url_decode.
535  */
536 static const struct got_error *
537 gotweb_urldecode(char *url)
538 {
539 	char		*p, *q;
540 	char		 hex[3];
541 	unsigned long	 x;
542 
543 	hex[2] = '\0';
544 	p = q = url;
545 
546 	while (*p != '\0') {
547 		switch (*p) {
548 		case '%':
549 			/* Encoding character is followed by two hex chars */
550 			if (!isxdigit((unsigned char)p[1]) ||
551 			    !isxdigit((unsigned char)p[2]) ||
552 			    (p[1] == '0' && p[2] == '0'))
553 				return got_error(GOT_ERR_BAD_QUERYSTRING);
554 
555 			hex[0] = p[1];
556 			hex[1] = p[2];
557 
558 			/*
559 			 * We don't have to validate "hex" because it is
560 			 * guaranteed to include two hex chars followed by nul.
561 			 */
562 			x = strtoul(hex, NULL, 16);
563 			*q = (char)x;
564 			p += 2;
565 			break;
566 		default:
567 			*q = *p;
568 			break;
569 		}
570 		p++;
571 		q++;
572 	}
573 	*q = '\0';
574 
575 	return NULL;
576 }
577 
578 static const struct got_error *
579 gotweb_assign_querystring(struct querystring **qs, char *key, char *value)
580 {
581 	const struct got_error *error = NULL;
582 	const char *errstr;
583 	int a_cnt, el_cnt;
584 
585 	error = gotweb_urldecode(value);
586 	if (error)
587 		return error;
588 
589 	for (el_cnt = 0; el_cnt < QSELEM__MAX; el_cnt++) {
590 		if (strcmp(key, querystring_keys[el_cnt].name) != 0)
591 			continue;
592 
593 		switch (querystring_keys[el_cnt].element) {
594 		case ACTION:
595 			for (a_cnt = 0; a_cnt < ACTIONS__MAX; a_cnt++) {
596 				if (strcmp(value, action_keys[a_cnt].name) != 0)
597 					continue;
598 				else if (strcmp(value,
599 				    action_keys[a_cnt].name) == 0){
600 					(*qs)->action =
601 					    action_keys[a_cnt].action;
602 					goto qa_found;
603 				}
604 			}
605 			(*qs)->action = ERR;
606 qa_found:
607 			break;
608 		case COMMIT:
609 			(*qs)->commit = strdup(value);
610 			if ((*qs)->commit == NULL) {
611 				error = got_error_from_errno2("%s: strdup",
612 				    __func__);
613 				goto done;
614 			}
615 			break;
616 		case RFILE:
617 			(*qs)->file = strdup(value);
618 			if ((*qs)->file == NULL) {
619 				error = got_error_from_errno2("%s: strdup",
620 				    __func__);
621 				goto done;
622 			}
623 			break;
624 		case FOLDER:
625 			(*qs)->folder = strdup(value);
626 			if ((*qs)->folder == NULL) {
627 				error = got_error_from_errno2("%s: strdup",
628 				    __func__);
629 				goto done;
630 			}
631 			break;
632 		case HEADREF:
633 			free((*qs)->headref);
634 			(*qs)->headref = strdup(value);
635 			if ((*qs)->headref == NULL) {
636 				error = got_error_from_errno2("%s: strdup",
637 				    __func__);
638 				goto done;
639 			}
640 			break;
641 		case INDEX_PAGE:
642 			if (strlen(value) == 0)
643 				break;
644 			(*qs)->index_page = strtonum(value, INT64_MIN,
645 			    INT64_MAX, &errstr);
646 			if (errstr) {
647 				error = got_error_from_errno3("%s: strtonum %s",
648 				    __func__, errstr);
649 				goto done;
650 			}
651 			if ((*qs)->index_page < 0)
652 				(*qs)->index_page = 0;
653 			break;
654 		case PATH:
655 			(*qs)->path = strdup(value);
656 			if ((*qs)->path == NULL) {
657 				error = got_error_from_errno2("%s: strdup",
658 				    __func__);
659 				goto done;
660 			}
661 			break;
662 		case PAGE:
663 			if (strlen(value) == 0)
664 				break;
665 			(*qs)->page = strtonum(value, INT64_MIN,
666 			    INT64_MAX, &errstr);
667 			if (errstr) {
668 				error = got_error_from_errno3("%s: strtonum %s",
669 				    __func__, errstr);
670 				goto done;
671 			}
672 			if ((*qs)->page < 0)
673 				(*qs)->page = 0;
674 			break;
675 		default:
676 			break;
677 		}
678 	}
679 done:
680 	return error;
681 }
682 
683 void
684 gotweb_free_repo_tag(struct repo_tag *rt)
685 {
686 	if (rt != NULL) {
687 		free(rt->commit_id);
688 		free(rt->tag_name);
689 		free(rt->tag_commit);
690 		free(rt->commit_msg);
691 		free(rt->tagger);
692 	}
693 	free(rt);
694 }
695 
696 void
697 gotweb_free_repo_commit(struct repo_commit *rc)
698 {
699 	if (rc != NULL) {
700 		free(rc->path);
701 		free(rc->refs_str);
702 		free(rc->commit_id);
703 		free(rc->parent_id);
704 		free(rc->tree_id);
705 		free(rc->author);
706 		free(rc->committer);
707 		free(rc->commit_msg);
708 	}
709 	free(rc);
710 }
711 
712 static void
713 gotweb_free_querystring(struct querystring *qs)
714 {
715 	if (qs != NULL) {
716 		free(qs->commit);
717 		free(qs->file);
718 		free(qs->folder);
719 		free(qs->headref);
720 		free(qs->path);
721 	}
722 	free(qs);
723 }
724 
725 static void
726 gotweb_free_repo_dir(struct repo_dir *repo_dir)
727 {
728 	if (repo_dir != NULL) {
729 		free(repo_dir->name);
730 		free(repo_dir->owner);
731 		free(repo_dir->description);
732 		free(repo_dir->url);
733 		free(repo_dir->path);
734 	}
735 	free(repo_dir);
736 }
737 
738 void
739 gotweb_free_transport(struct transport *t)
740 {
741 	const struct got_error *err;
742 	struct repo_commit *rc = NULL, *trc = NULL;
743 	struct repo_tag *rt = NULL, *trt = NULL;
744 	int i;
745 
746 	got_ref_list_free(&t->refs);
747 	TAILQ_FOREACH_SAFE(rc, &t->repo_commits, entry, trc) {
748 		TAILQ_REMOVE(&t->repo_commits, rc, entry);
749 		gotweb_free_repo_commit(rc);
750 	}
751 	TAILQ_FOREACH_SAFE(rt, &t->repo_tags, entry, trt) {
752 		TAILQ_REMOVE(&t->repo_tags, rt, entry);
753 		gotweb_free_repo_tag(rt);
754 	}
755 	gotweb_free_repo_dir(t->repo_dir);
756 	gotweb_free_querystring(t->qs);
757 	free(t->more_id);
758 	free(t->next_id);
759 	free(t->prev_id);
760 	if (t->blob)
761 		got_object_blob_close(t->blob);
762 	if (t->fp) {
763 		err = got_gotweb_flushfile(t->fp, t->fd);
764 		if (err)
765 			log_warnx("%s: got_gotweb_flushfile failure: %s",
766 			    __func__, err->msg);
767 		t->fd = -1;
768 	}
769 	if (t->fd != -1)
770 		close(t->fd);
771 	if (t->repos) {
772 		for (i = 0; i < t->nrepos; ++i)
773 			free(t->repos[i]);
774 		free(t->repos);
775 	}
776 	free(t);
777 }
778 
779 void
780 gotweb_get_navs(struct request *c, struct gotweb_url *prev, int *have_prev,
781     struct gotweb_url *next, int *have_next)
782 {
783 	struct transport *t = c->t;
784 	struct querystring *qs = t->qs;
785 	struct server *srv = c->srv;
786 
787 	*have_prev = *have_next = 0;
788 
789 	switch(qs->action) {
790 	case INDEX:
791 		if (qs->index_page > 0) {
792 			*have_prev = 1;
793 			*prev = (struct gotweb_url){
794 				.action = -1,
795 				.index_page = qs->index_page - 1,
796 				.page = -1,
797 			};
798 		}
799 		if (t->next_disp == srv->max_repos_display &&
800 		    t->repos_total != (qs->index_page + 1) *
801 		    srv->max_repos_display) {
802 			*have_next = 1;
803 			*next = (struct gotweb_url){
804 				.action = -1,
805 				.index_page = qs->index_page + 1,
806 				.page = -1,
807 			};
808 		}
809 		break;
810 	case TAGS:
811 		if (t->prev_id && qs->commit != NULL &&
812 		    strcmp(qs->commit, t->prev_id) != 0) {
813 			*have_prev = 1;
814 			*prev = (struct gotweb_url){
815 				.action = TAGS,
816 				.index_page = -1,
817 				.page = qs->page - 1,
818 				.path = qs->path,
819 				.commit = t->prev_id,
820 				.headref = qs->headref,
821 			};
822 		}
823 		if (t->next_id) {
824 			*have_next = 1;
825 			*next = (struct gotweb_url){
826 				.action = TAGS,
827 				.index_page = -1,
828 				.page = qs->page + 1,
829 				.path = qs->path,
830 				.commit = t->next_id,
831 				.headref = qs->headref,
832 			};
833 		}
834 		break;
835 	}
836 }
837 
838 static int
839 gotweb_render_index(struct template *tp)
840 {
841 	const struct got_error *error = NULL;
842 	struct request *c = tp->tp_arg;
843 	struct server *srv = c->srv;
844 	struct transport *t = c->t;
845 	struct querystring *qs = t->qs;
846 	struct repo_dir *repo_dir = NULL;
847 	struct dirent **sd_dent = t->repos;
848 	unsigned int d_i, d_disp = 0;
849 	unsigned int d_skipped = 0;
850 	int type, r;
851 
852 	if (gotweb_render_repo_table_hdr(c->tp) == -1)
853 		return -1;
854 
855 	for (d_i = 0; d_i < t->nrepos; d_i++) {
856 		if (srv->max_repos > 0 && t->prev_disp == srv->max_repos)
857 			break;
858 
859 		if (strcmp(sd_dent[d_i]->d_name, ".") == 0 ||
860 		    strcmp(sd_dent[d_i]->d_name, "..") == 0) {
861 			d_skipped++;
862 			continue;
863 		}
864 
865 		error = got_path_dirent_type(&type, srv->repos_path,
866 		    sd_dent[d_i]);
867 		if (error)
868 			continue;
869 		if (type != DT_DIR) {
870 			d_skipped++;
871 			continue;
872 		}
873 
874 		if (qs->index_page > 0 && (qs->index_page *
875 		    srv->max_repos_display) > t->prev_disp) {
876 			t->prev_disp++;
877 			continue;
878 		}
879 
880 		error = gotweb_init_repo_dir(&repo_dir, sd_dent[d_i]->d_name);
881 		if (error)
882 			continue;
883 
884 		error = gotweb_load_got_path(c, repo_dir);
885 		if (error && error->code == GOT_ERR_LONELY_PACKIDX) {
886 			if (error->code != GOT_ERR_NOT_GIT_REPO)
887 				log_warnx("%s: %s: %s", __func__,
888 				    sd_dent[d_i]->d_name, error->msg);
889 			gotweb_free_repo_dir(repo_dir);
890 			repo_dir = NULL;
891 			d_skipped++;
892 			continue;
893 		}
894 
895 		d_disp++;
896 		t->prev_disp++;
897 
898 		r = gotweb_render_repo_fragment(c->tp, repo_dir);
899 		gotweb_free_repo_dir(repo_dir);
900 		if (r == -1)
901 			return -1;
902 
903 		t->next_disp++;
904 		if (d_disp == srv->max_repos_display)
905 			break;
906 	}
907 	t->repos_total = t->nrepos - d_skipped;
908 
909 	if (srv->max_repos_display == 0)
910 		return 0;
911 	if (srv->max_repos > 0 && srv->max_repos < srv->max_repos_display)
912 		return 0;
913 	if (t->repos_total <= srv->max_repos ||
914 	    t->repos_total <= srv->max_repos_display)
915 		return 0;
916 
917 	if (gotweb_render_navs(c->tp) == -1)
918 		return -1;
919 
920 	return 0;
921 }
922 
923 static inline int
924 should_urlencode(int c)
925 {
926 	if (c <= ' ' || c >= 127)
927 		return 1;
928 
929 	switch (c) {
930 		/* gen-delim */
931 	case ':':
932 	case '/':
933 	case '?':
934 	case '#':
935 	case '[':
936 	case ']':
937 	case '@':
938 		/* sub-delims */
939 	case '!':
940 	case '$':
941 	case '&':
942 	case '\'':
943 	case '(':
944 	case ')':
945 	case '*':
946 	case '+':
947 	case ',':
948 	case ';':
949 	case '=':
950 		/* needed because the URLs are embedded into the HTML */
951 	case '\"':
952 		return 1;
953 	default:
954 		return 0;
955 	}
956 }
957 
958 static char *
959 gotweb_urlencode(const char *str)
960 {
961 	const char *s;
962 	char *escaped;
963 	size_t i, len;
964 	int a, b;
965 
966 	len = 0;
967 	for (s = str; *s; ++s) {
968 		len++;
969 		if (should_urlencode(*s))
970 			len += 2;
971 	}
972 
973 	escaped = calloc(1, len + 1);
974 	if (escaped == NULL)
975 		return NULL;
976 
977 	i = 0;
978 	for (s = str; *s; ++s) {
979 		if (should_urlencode(*s)) {
980 			a = (*s & 0xF0) >> 4;
981 			b = (*s & 0x0F);
982 
983 			escaped[i++] = '%';
984 			escaped[i++] = a <= 9 ? ('0' + a) : ('7' + a);
985 			escaped[i++] = b <= 9 ? ('0' + b) : ('7' + b);
986 		} else
987 			escaped[i++] = *s;
988 	}
989 
990 	return escaped;
991 }
992 
993 const char *
994 gotweb_action_name(int action)
995 {
996 	switch (action) {
997 	case BLAME:
998 		return "blame";
999 	case BLOB:
1000 		return "blob";
1001 	case BLOBRAW:
1002 		return "blobraw";
1003 	case BRIEFS:
1004 		return "briefs";
1005 	case COMMITS:
1006 		return "commits";
1007 	case DIFF:
1008 		return "diff";
1009 	case ERR:
1010 		return "err";
1011 	case INDEX:
1012 		return "index";
1013 	case SUMMARY:
1014 		return "summary";
1015 	case TAG:
1016 		return "tag";
1017 	case TAGS:
1018 		return "tags";
1019 	case TREE:
1020 		return "tree";
1021 	case RSS:
1022 		return "rss";
1023 	default:
1024 		return NULL;
1025 	}
1026 }
1027 
1028 int
1029 gotweb_render_url(struct request *c, struct gotweb_url *url)
1030 {
1031 	const char *sep = "?", *action;
1032 	char *tmp;
1033 	int r;
1034 
1035 	action = gotweb_action_name(url->action);
1036 	if (action != NULL) {
1037 		if (fcgi_printf(c, "?action=%s", action) == -1)
1038 			return -1;
1039 		sep = "&";
1040 	}
1041 
1042 	if (url->commit) {
1043 		if (fcgi_printf(c, "%scommit=%s", sep, url->commit) == -1)
1044 			return -1;
1045 		sep = "&";
1046 	}
1047 
1048 	if (url->previd) {
1049 		if (fcgi_printf(c, "%sprevid=%s", sep, url->previd) == -1)
1050 			return -1;
1051 		sep = "&";
1052 	}
1053 
1054 	if (url->prevset) {
1055 		if (fcgi_printf(c, "%sprevset=%s", sep, url->prevset) == -1)
1056 			return -1;
1057 		sep = "&";
1058 	}
1059 
1060 	if (url->file) {
1061 		tmp = gotweb_urlencode(url->file);
1062 		if (tmp == NULL)
1063 			return -1;
1064 		r = fcgi_printf(c, "%sfile=%s", sep, tmp);
1065 		free(tmp);
1066 		if (r == -1)
1067 			return -1;
1068 		sep = "&";
1069 	}
1070 
1071 	if (url->folder) {
1072 		tmp = gotweb_urlencode(url->folder);
1073 		if (tmp == NULL)
1074 			return -1;
1075 		r = fcgi_printf(c, "%sfolder=%s", sep, tmp);
1076 		free(tmp);
1077 		if (r == -1)
1078 			return -1;
1079 		sep = "&";
1080 	}
1081 
1082 	if (url->headref) {
1083 		tmp = gotweb_urlencode(url->headref);
1084 		if (tmp == NULL)
1085 			return -1;
1086 		r = fcgi_printf(c, "%sheadref=%s", sep, url->headref);
1087 		free(tmp);
1088 		if (r == -1)
1089 			return -1;
1090 		sep = "&";
1091 	}
1092 
1093 	if (url->index_page != -1) {
1094 		if (fcgi_printf(c, "%sindex_page=%d", sep,
1095 		    url->index_page) == -1)
1096 			return -1;
1097 		sep = "&";
1098 	}
1099 
1100 	if (url->path) {
1101 		tmp = gotweb_urlencode(url->path);
1102 		if (tmp == NULL)
1103 			return -1;
1104 		r = fcgi_printf(c, "%spath=%s", sep, tmp);
1105 		free(tmp);
1106 		if (r == -1)
1107 			return -1;
1108 		sep = "&";
1109 	}
1110 
1111 	if (url->page != -1) {
1112 		if (fcgi_printf(c, "%spage=%d", sep, url->page) == -1)
1113 			return -1;
1114 		sep = "&";
1115 	}
1116 
1117 	return 0;
1118 }
1119 
1120 int
1121 gotweb_render_absolute_url(struct request *c, struct gotweb_url *url)
1122 {
1123 	struct template	*tp = c->tp;
1124 	const char	*proto = c->https ? "https" : "http";
1125 
1126 	if (fcgi_puts(tp, proto) == -1 ||
1127 	    fcgi_puts(tp, "://") == -1 ||
1128 	    tp_htmlescape(tp, c->server_name) == -1 ||
1129 	    tp_htmlescape(tp, c->document_uri) == -1)
1130 		return -1;
1131 
1132 	return gotweb_render_url(c, url);
1133 }
1134 
1135 static struct got_repository *
1136 find_cached_repo(struct server *srv, const char *path)
1137 {
1138 	int i;
1139 
1140 	for (i = 0; i < srv->ncached_repos; i++) {
1141 		if (strcmp(srv->cached_repos[i].path, path) == 0)
1142 			return srv->cached_repos[i].repo;
1143 	}
1144 
1145 	return NULL;
1146 }
1147 
1148 static const struct got_error *
1149 cache_repo(struct got_repository **new, struct server *srv,
1150     struct repo_dir *repo_dir, struct socket *sock)
1151 {
1152 	const struct got_error *error = NULL;
1153 	struct got_repository *repo;
1154 	struct cached_repo *cr;
1155 	int evicted = 0;
1156 
1157 	if (srv->ncached_repos >= GOTWEBD_REPO_CACHESIZE) {
1158 		cr = &srv->cached_repos[srv->ncached_repos - 1];
1159 		error = got_repo_close(cr->repo);
1160 		memset(cr, 0, sizeof(*cr));
1161 		srv->ncached_repos--;
1162 		if (error)
1163 			return error;
1164 		memmove(&srv->cached_repos[1], &srv->cached_repos[0],
1165 		    srv->ncached_repos * sizeof(srv->cached_repos[0]));
1166 		cr = &srv->cached_repos[0];
1167 		evicted = 1;
1168 	} else {
1169 		cr = &srv->cached_repos[srv->ncached_repos];
1170 	}
1171 
1172 	error = got_repo_open(&repo, repo_dir->path, NULL, sock->pack_fds);
1173 	if (error) {
1174 		if (evicted) {
1175 			memmove(&srv->cached_repos[0], &srv->cached_repos[1],
1176 			    srv->ncached_repos * sizeof(srv->cached_repos[0]));
1177 		}
1178 		return error;
1179 	}
1180 
1181 	if (strlcpy(cr->path, repo_dir->path, sizeof(cr->path))
1182 	    >= sizeof(cr->path)) {
1183 		if (evicted) {
1184 			memmove(&srv->cached_repos[0], &srv->cached_repos[1],
1185 			    srv->ncached_repos * sizeof(srv->cached_repos[0]));
1186 		}
1187 		return got_error(GOT_ERR_NO_SPACE);
1188 	}
1189 
1190 	cr->repo = repo;
1191 	srv->ncached_repos++;
1192 	*new = repo;
1193 	return NULL;
1194 }
1195 
1196 static const struct got_error *
1197 gotweb_load_got_path(struct request *c, struct repo_dir *repo_dir)
1198 {
1199 	const struct got_error *error = NULL;
1200 	struct socket *sock = c->sock;
1201 	struct server *srv = c->srv;
1202 	struct transport *t = c->t;
1203 	struct got_repository *repo = NULL;
1204 	DIR *dt;
1205 	char *dir_test;
1206 
1207 	if (asprintf(&dir_test, "%s/%s/%s", srv->repos_path, repo_dir->name,
1208 	    GOTWEB_GIT_DIR) == -1)
1209 		return got_error_from_errno("asprintf");
1210 
1211 	dt = opendir(dir_test);
1212 	if (dt == NULL) {
1213 		free(dir_test);
1214 	} else {
1215 		repo_dir->path = dir_test;
1216 		dir_test = NULL;
1217 		goto done;
1218 	}
1219 
1220 	if (asprintf(&dir_test, "%s/%s", srv->repos_path,
1221 	    repo_dir->name) == -1)
1222 		return got_error_from_errno("asprintf");
1223 
1224 	dt = opendir(dir_test);
1225 	if (dt == NULL) {
1226 		error = got_error_path(repo_dir->name, GOT_ERR_NOT_GIT_REPO);
1227 		goto err;
1228 	} else {
1229 		repo_dir->path = dir_test;
1230 		dir_test = NULL;
1231 	}
1232 
1233 done:
1234 	if (srv->respect_exportok &&
1235 	    faccessat(dirfd(dt), "git-daemon-export-ok", F_OK, 0) == -1) {
1236 		error = got_error_path(repo_dir->name, GOT_ERR_NOT_GIT_REPO);
1237 		goto err;
1238 	}
1239 
1240 	repo = find_cached_repo(srv, repo_dir->path);
1241 	if (repo == NULL) {
1242 		error = cache_repo(&repo, srv, repo_dir, sock);
1243 		if (error)
1244 			goto err;
1245 	}
1246 	t->repo = repo;
1247 	error = gotweb_get_repo_description(&repo_dir->description, srv,
1248 	    repo_dir->path, dirfd(dt));
1249 	if (error)
1250 		goto err;
1251 	error = got_get_repo_owner(&repo_dir->owner, c);
1252 	if (error)
1253 		goto err;
1254 	error = got_get_repo_age(&repo_dir->age, c, NULL);
1255 	if (error)
1256 		goto err;
1257 	error = gotweb_get_clone_url(&repo_dir->url, srv, repo_dir->path,
1258 	    dirfd(dt));
1259 err:
1260 	free(dir_test);
1261 	if (dt != NULL && closedir(dt) == EOF && error == NULL)
1262 		error = got_error_from_errno("closedir");
1263 	return error;
1264 }
1265 
1266 static const struct got_error *
1267 gotweb_init_repo_dir(struct repo_dir **repo_dir, const char *dir)
1268 {
1269 	const struct got_error *error;
1270 
1271 	*repo_dir = calloc(1, sizeof(**repo_dir));
1272 	if (*repo_dir == NULL)
1273 		return got_error_from_errno("calloc");
1274 
1275 	if (asprintf(&(*repo_dir)->name, "%s", dir) == -1) {
1276 		error = got_error_from_errno("asprintf");
1277 		free(*repo_dir);
1278 		*repo_dir = NULL;
1279 		return error;
1280 	}
1281 	(*repo_dir)->owner = NULL;
1282 	(*repo_dir)->description = NULL;
1283 	(*repo_dir)->url = NULL;
1284 	(*repo_dir)->path = NULL;
1285 
1286 	return NULL;
1287 }
1288 
1289 static const struct got_error *
1290 gotweb_get_repo_description(char **description, struct server *srv,
1291     const char *dirpath, int dir)
1292 {
1293 	const struct got_error *error = NULL;
1294 	struct stat sb;
1295 	int fd = -1;
1296 	off_t len;
1297 
1298 	*description = NULL;
1299 	if (srv->show_repo_description == 0)
1300 		return NULL;
1301 
1302 	fd = openat(dir, "description", O_RDONLY);
1303 	if (fd == -1) {
1304 		if (errno != ENOENT && errno != EACCES) {
1305 			error = got_error_from_errno_fmt("openat %s/%s",
1306 			    dirpath, "description");
1307 		}
1308 		goto done;
1309 	}
1310 
1311 	if (fstat(fd, &sb) == -1) {
1312 		error = got_error_from_errno_fmt("fstat %s/%s",
1313 		    dirpath, "description");
1314 		goto done;
1315 	}
1316 
1317 	len = sb.st_size;
1318 	if (len > GOTWEBD_MAXDESCRSZ - 1)
1319 		len = GOTWEBD_MAXDESCRSZ - 1;
1320 
1321 	*description = calloc(len + 1, sizeof(**description));
1322 	if (*description == NULL) {
1323 		error = got_error_from_errno("calloc");
1324 		goto done;
1325 	}
1326 
1327 	if (read(fd, *description, len) == -1)
1328 		error = got_error_from_errno("read");
1329 done:
1330 	if (fd != -1 && close(fd) == -1 && error == NULL)
1331 		error = got_error_from_errno("close");
1332 	return error;
1333 }
1334 
1335 static const struct got_error *
1336 gotweb_get_clone_url(char **url, struct server *srv, const char *dirpath,
1337     int dir)
1338 {
1339 	const struct got_error *error = NULL;
1340 	struct stat sb;
1341 	int fd = -1;
1342 	off_t len;
1343 
1344 	*url = NULL;
1345 	if (srv->show_repo_cloneurl == 0)
1346 		return NULL;
1347 
1348 	fd = openat(dir, "cloneurl", O_RDONLY);
1349 	if (fd == -1) {
1350 		if (errno != ENOENT && errno != EACCES) {
1351 			error = got_error_from_errno_fmt("openat %s/%s",
1352 			    dirpath, "cloneurl");
1353 		}
1354 		goto done;
1355 	}
1356 
1357 	if (fstat(fd, &sb) == -1) {
1358 		error = got_error_from_errno_fmt("fstat %s/%s",
1359 		    dirpath, "cloneurl");
1360 		goto done;
1361 	}
1362 
1363 	len = sb.st_size;
1364 	if (len > GOTWEBD_MAXCLONEURLSZ - 1)
1365 		len = GOTWEBD_MAXCLONEURLSZ - 1;
1366 
1367 	*url = calloc(len + 1, sizeof(**url));
1368 	if (*url == NULL) {
1369 		error = got_error_from_errno("calloc");
1370 		goto done;
1371 	}
1372 
1373 	if (read(fd, *url, len) == -1)
1374 		error = got_error_from_errno("read");
1375 done:
1376 	if (fd != -1 && close(fd) == -1 && error == NULL)
1377 		error = got_error_from_errno("close");
1378 	return error;
1379 }
1380 
1381 int
1382 gotweb_render_age(struct template *tp, time_t committer_time, int ref_tm)
1383 {
1384 	struct request *c = tp->tp_arg;
1385 	struct tm tm;
1386 	long long diff_time;
1387 	const char *years = "years ago", *months = "months ago";
1388 	const char *weeks = "weeks ago", *days = "days ago";
1389 	const char *hours = "hours ago",  *minutes = "minutes ago";
1390 	const char *seconds = "seconds ago", *now = "right now";
1391 	char *s;
1392 	char datebuf[64];
1393 	size_t r;
1394 
1395 	switch (ref_tm) {
1396 	case TM_DIFF:
1397 		diff_time = time(NULL) - committer_time;
1398 		if (diff_time > 60 * 60 * 24 * 365 * 2) {
1399 			if (fcgi_printf(c, "%lld %s",
1400 			    (diff_time / 60 / 60 / 24 / 365), years) == -1)
1401 				return -1;
1402 		} else if (diff_time > 60 * 60 * 24 * (365 / 12) * 2) {
1403 			if (fcgi_printf(c, "%lld %s",
1404 			    (diff_time / 60 / 60 / 24 / (365 / 12)),
1405 			    months) == -1)
1406 				return -1;
1407 		} else if (diff_time > 60 * 60 * 24 * 7 * 2) {
1408 			if (fcgi_printf(c, "%lld %s",
1409 			    (diff_time / 60 / 60 / 24 / 7), weeks) == -1)
1410 				return -1;
1411 		} else if (diff_time > 60 * 60 * 24 * 2) {
1412 			if (fcgi_printf(c, "%lld %s",
1413 			    (diff_time / 60 / 60 / 24), days) == -1)
1414 				return -1;
1415 		} else if (diff_time > 60 * 60 * 2) {
1416 			if (fcgi_printf(c, "%lld %s",
1417 			    (diff_time / 60 / 60), hours) == -1)
1418 				return -1;
1419 		} else if (diff_time > 60 * 2) {
1420 			if (fcgi_printf(c, "%lld %s", (diff_time / 60),
1421 			    minutes) == -1)
1422 				return -1;
1423 		} else if (diff_time > 2) {
1424 			if (fcgi_printf(c, "%lld %s", diff_time,
1425 			    seconds) == -1)
1426 				return -1;
1427 		} else {
1428 			if (fcgi_puts(tp, now) == -1)
1429 				return -1;
1430 		}
1431 		break;
1432 	case TM_LONG:
1433 		if (gmtime_r(&committer_time, &tm) == NULL)
1434 			return -1;
1435 
1436 		s = asctime_r(&tm, datebuf);
1437 		if (s == NULL)
1438 			return -1;
1439 
1440 		if (fcgi_puts(tp, datebuf) == -1 ||
1441 		    fcgi_puts(tp, " UTC") == -1)
1442 			return -1;
1443 		break;
1444 	case TM_RFC822:
1445 		if (gmtime_r(&committer_time, &tm) == NULL)
1446 			return -1;
1447 
1448 		r = strftime(datebuf, sizeof(datebuf),
1449 		    "%a, %d %b %Y %H:%M:%S GMT", &tm);
1450 		if (r == 0)
1451 			return -1;
1452 
1453 		if (fcgi_puts(tp, datebuf) == -1)
1454 			return -1;
1455 		break;
1456 	}
1457 	return 0;
1458 }