1 /*
2  * Copyright (c) 2016, 2019, 2020-2022 Tracey Emery <tracey@traceyemery.net>
3  * Copyright (c) 2015 Mike Larkin <mlarkin@openbsd.org>
4  * Copyright (c) 2014 Reyk Floeter <reyk@openbsd.org>
5  * Copyright (c) 2013 David Gwynne <dlg@openbsd.org>
6  * Copyright (c) 2013 Florian Obser <florian@openbsd.org>
7  *
8  * Permission to use, copy, modify, and distribute this software for any
9  * purpose with or without fee is hereby granted, provided that the above
10  * copyright notice and this permission notice appear in all copies.
11  *
12  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
13  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
14  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
15  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
16  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
17  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
18  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
19  */
20 
21 #include <net/if.h>
22 #include <netinet/in.h>
23 #include <sys/queue.h>
24 #include <sys/stat.h>
25 #include <sys/types.h>
26 
27 #include <ctype.h>
28 #include <dirent.h>
29 #include <errno.h>
30 #include <event.h>
31 #include <fcntl.h>
32 #include <imsg.h>
33 #include <sha1.h>
34 #include <sha2.h>
35 #include <stdio.h>
36 #include <stdlib.h>
37 #include <string.h>
38 #include <unistd.h>
39 
40 #include "got_error.h"
41 #include "got_object.h"
42 #include "got_reference.h"
43 #include "got_repository.h"
44 #include "got_path.h"
45 #include "got_cancel.h"
46 #include "got_worktree.h"
47 #include "got_diff.h"
48 #include "got_commit_graph.h"
49 #include "got_blame.h"
50 #include "got_privsep.h"
51 
52 #include "gotwebd.h"
53 #include "log.h"
54 #include "tmpl.h"
55 
56 static const struct querystring_keys querystring_keys[] = {
57 	{ "action",		ACTION },
58 	{ "commit",		COMMIT },
59 	{ "file",		RFILE },
60 	{ "folder",		FOLDER },
61 	{ "headref",		HEADREF },
62 	{ "index_page",		INDEX_PAGE },
63 	{ "path",		PATH },
64 };
65 
66 static const struct action_keys action_keys[] = {
67 	{ "blame",	BLAME },
68 	{ "blob",	BLOB },
69 	{ "blobraw",	BLOBRAW },
70 	{ "briefs",	BRIEFS },
71 	{ "commits",	COMMITS },
72 	{ "diff",	DIFF },
73 	{ "error",	ERR },
74 	{ "index",	INDEX },
75 	{ "patch",	PATCH },
76 	{ "summary",	SUMMARY },
77 	{ "tag",	TAG },
78 	{ "tags",	TAGS },
79 	{ "tree",	TREE },
80 	{ "rss",	RSS },
81 };
82 
83 static const struct got_error *gotweb_init_querystring(struct querystring **);
84 static const struct got_error *gotweb_parse_querystring(struct querystring *,
85     char *);
86 static const struct got_error *gotweb_assign_querystring(struct querystring *,
87     char *, char *);
88 static int gotweb_render_index(struct template *);
89 static const struct got_error *gotweb_load_got_path(struct repo_dir **,
90     const char *, struct request *);
91 static const struct got_error *gotweb_get_repo_description(char **,
92     struct server *, const char *, int);
93 static const struct got_error *gotweb_get_clone_url(char **, struct server *,
94     const char *, int);
95 
96 static void gotweb_free_querystring(struct querystring *);
97 static void gotweb_free_repo_dir(struct repo_dir *);
98 
99 struct server *gotweb_get_server(const char *);
100 
101 static int
102 gotweb_reply(struct request *c, int status, const char *ctype,
103     struct gotweb_url *location)
104 {
105 	const char	*csp;
106 
107 	if (status != 200 && tp_writef(c->tp, "Status: %d\r\n", status) == -1)
108 		return -1;
109 
110 	if (location) {
111 		if (tp_writes(c->tp, "Location: ") == -1 ||
112 		    gotweb_render_url(c, location) == -1 ||
113 		    tp_writes(c->tp, "\r\n") == -1)
114 			return -1;
115 	}
116 
117 	csp = "Content-Security-Policy: default-src 'self'; "
118 	    "script-src 'none'; object-src 'none';\r\n";
119 	if (tp_writes(c->tp, csp) == -1)
120 		return -1;
121 
122 	if (ctype && tp_writef(c->tp, "Content-Type: %s\r\n", ctype) == -1)
123 		return -1;
124 
125 	return tp_writes(c->tp, "\r\n");
126 }
127 
128 static int
129 gotweb_reply_file(struct request *c, const char *ctype, const char *file,
130     const char *suffix)
131 {
132 	int r;
133 
134 	r = tp_writef(c->tp, "Content-Disposition: attachment; "
135 	    "filename=%s%s\r\n", file, suffix ? suffix : "");
136 	if (r == -1)
137 		return -1;
138 	return gotweb_reply(c, 200, ctype, NULL);
139 }
140 
141 void
142 gotweb_process_request(struct request *c)
143 {
144 	const struct got_error *error = NULL;
145 	struct server *srv = NULL;
146 	struct querystring *qs = NULL;
147 	struct repo_dir *repo_dir = NULL;
148 	const char *rss_ctype = "application/rss+xml;charset=utf-8";
149 	const uint8_t *buf;
150 	size_t len;
151 	int r, binary = 0;
152 
153 	/* init the transport */
154 	error = gotweb_init_transport(&c->t);
155 	if (error) {
156 		log_warnx("%s: %s", __func__, error->msg);
157 		return;
158 	}
159 	/* get the gotwebd server */
160 	srv = gotweb_get_server(c->server_name);
161 	if (srv == NULL) {
162 		log_warnx("%s: error server is NULL", __func__);
163 		goto err;
164 	}
165 	c->srv = srv;
166 	/* parse our querystring */
167 	error = gotweb_init_querystring(&qs);
168 	if (error) {
169 		log_warnx("%s: %s", __func__, error->msg);
170 		goto err;
171 	}
172 	c->t->qs = qs;
173 	error = gotweb_parse_querystring(qs, c->querystring);
174 	if (error) {
175 		log_warnx("%s: %s", __func__, error->msg);
176 		goto err;
177 	}
178 
179 	/*
180 	 * certain actions require a commit id in the querystring. this stops
181 	 * bad actors from exploiting this by manually manipulating the
182 	 * querystring.
183 	 */
184 
185 	if (qs->action == BLAME || qs->action == BLOB ||
186 	    qs->action == BLOBRAW || qs->action == DIFF ||
187 	    qs->action == PATCH) {
188 		if (qs->commit == NULL) {
189 			error = got_error(GOT_ERR_BAD_QUERYSTRING);
190 			goto err;
191 		}
192 	}
193 
194 	if (qs->action != INDEX) {
195 		error = gotweb_load_got_path(&repo_dir, qs->path, c);
196 		c->t->repo_dir = repo_dir;
197 		if (error && error->code != GOT_ERR_LONELY_PACKIDX)
198 			goto err;
199 	}
200 
201 	if (qs->action == BLOBRAW || qs->action == BLOB) {
202 		if (qs->folder == NULL || qs->file == NULL) {
203 			error = got_error(GOT_ERR_BAD_QUERYSTRING);
204 			goto err;
205 		}
206 
207 		error = got_get_repo_commits(c, 1);
208 		if (error)
209 			goto err;
210 
211 		error = got_open_blob_for_output(&c->t->blob, &c->t->fd,
212 		    &binary, c, qs->folder, qs->file, qs->commit);
213 		if (error)
214 			goto err;
215 	}
216 
217 	switch (qs->action) {
218 	case BLAME:
219 		if (qs->folder == NULL || qs->file == NULL) {
220 			error = got_error(GOT_ERR_BAD_QUERYSTRING);
221 			goto err;
222 		}
223 		error = got_get_repo_commits(c, 1);
224 		if (error) {
225 			log_warnx("%s: %s", __func__, error->msg);
226 			goto err;
227 		}
228 		if (gotweb_reply(c, 200, "text/html", NULL) == -1)
229 			return;
230 		gotweb_render_page(c->tp, gotweb_render_blame);
231 		return;
232 	case BLOB:
233 		if (binary) {
234 			struct gotweb_url url = {
235 				.index_page = -1,
236 				.action = BLOBRAW,
237 				.path = qs->path,
238 				.commit = qs->commit,
239 				.folder = qs->folder,
240 				.file = qs->file,
241 			};
242 
243 			gotweb_reply(c, 302, NULL, &url);
244 			return;
245 		}
246 
247 		if (gotweb_reply(c, 200, "text/html", NULL) == -1)
248 			return;
249 		gotweb_render_page(c->tp, gotweb_render_blob);
250 		return;
251 	case BLOBRAW:
252 		if (binary)
253 			r = gotweb_reply_file(c, "application/octet-stream",
254 			    qs->file, NULL);
255 		else
256 			r = gotweb_reply(c, 200, "text/plain", NULL);
257 		if (r == -1)
258 			return;
259 		if (template_flush(c->tp) == -1)
260 			return;
261 
262 		for (;;) {
263 			error = got_object_blob_read_block(&len, c->t->blob);
264 			if (error)
265 				break;
266 			if (len == 0)
267 				break;
268 			buf = got_object_blob_get_read_buf(c->t->blob);
269 			if (fcgi_write(c, buf, len) == -1)
270 				break;
271 		}
272 		return;
273 	case BRIEFS:
274 		error = got_get_repo_commits(c, srv->max_commits_display);
275 		if (error)
276 			goto err;
277 		if (gotweb_reply(c, 200, "text/html", NULL) == -1)
278 			return;
279 		gotweb_render_page(c->tp, gotweb_render_briefs);
280 		return;
281 	case COMMITS:
282 		error = got_get_repo_commits(c, srv->max_commits_display);
283 		if (error) {
284 			log_warnx("%s: %s", __func__, error->msg);
285 			goto err;
286 		}
287 		if (gotweb_reply(c, 200, "text/html", NULL) == -1)
288 			return;
289 		gotweb_render_page(c->tp, gotweb_render_commits);
290 		return;
291 	case DIFF:
292 		error = got_get_repo_commits(c, 1);
293 		if (error) {
294 			log_warnx("%s: %s", __func__, error->msg);
295 			goto err;
296 		}
297 		error = got_open_diff_for_output(&c->t->fp, c);
298 		if (error) {
299 			log_warnx("%s: %s", __func__, error->msg);
300 			goto err;
301 		}
302 		if (gotweb_reply(c, 200, "text/html", NULL) == -1)
303 			return;
304 		gotweb_render_page(c->tp, gotweb_render_diff);
305 		return;
306 	case INDEX:
307 		c->t->nrepos = scandir(srv->repos_path, &c->t->repos, NULL,
308 		    alphasort);
309 		if (c->t->nrepos == -1) {
310 			c->t->repos = NULL;
311 			error = got_error_from_errno2("scandir",
312 			    srv->repos_path);
313 			goto err;
314 		}
315 		if (gotweb_reply(c, 200, "text/html", NULL) == -1)
316 			return;
317 		gotweb_render_page(c->tp, gotweb_render_index);
318 		return;
319 	case PATCH:
320 		error = got_get_repo_commits(c, 1);
321 		if (error) {
322 			log_warnx("%s: %s", __func__, error->msg);
323 			goto err;
324 		}
325 		error = got_open_diff_for_output(&c->t->fp, c);
326 		if (error) {
327 			log_warnx("%s: %s", __func__, error->msg);
328 			goto err;
329 		}
330 		if (gotweb_reply(c, 200, "text/plain", NULL) == -1)
331 			return;
332 		gotweb_render_patch(c->tp);
333 		return;
334 	case RSS:
335 		error = got_get_repo_tags(c, D_MAXSLCOMMDISP);
336 		if (error)
337 			goto err;
338 		if (gotweb_reply_file(c, rss_ctype, repo_dir->name, ".rss")
339 		    == -1)
340 			return;
341 		gotweb_render_rss(c->tp);
342 		return;
343 	case SUMMARY:
344 		error = got_ref_list(&c->t->refs, c->t->repo, "refs/heads",
345 		    got_ref_cmp_by_name, NULL);
346 		if (error) {
347 			log_warnx("%s: got_ref_list: %s", __func__,
348 			    error->msg);
349 			goto err;
350 		}
351 		error = got_get_repo_commits(c, srv->summary_commits_display);
352 		if (error)
353 			goto err;
354 		qs->action = TAGS;
355 		error = got_get_repo_tags(c, srv->summary_tags_display);
356 		if (error) {
357 			log_warnx("%s: got_get_repo_tags: %s", __func__,
358 			    error->msg);
359 			goto err;
360 		}
361 		qs->action = SUMMARY;
362 		if (gotweb_reply(c, 200, "text/html", NULL) == -1)
363 			return;
364 		gotweb_render_page(c->tp, gotweb_render_summary);
365 		return;
366 	case TAG:
367 		error = got_get_repo_tags(c, 1);
368 		if (error) {
369 			log_warnx("%s: %s", __func__, error->msg);
370 			goto err;
371 		}
372 		if (c->t->tag_count == 0) {
373 			error = got_error_msg(GOT_ERR_BAD_OBJ_ID,
374 			    "bad commit id");
375 			goto err;
376 		}
377 		if (gotweb_reply(c, 200, "text/html", NULL) == -1)
378 			return;
379 		gotweb_render_page(c->tp, gotweb_render_tag);
380 		return;
381 	case TAGS:
382 		error = got_get_repo_tags(c, srv->max_commits_display);
383 		if (error) {
384 			log_warnx("%s: %s", __func__, error->msg);
385 			goto err;
386 		}
387 		if (gotweb_reply(c, 200, "text/html", NULL) == -1)
388 			return;
389 		gotweb_render_page(c->tp, gotweb_render_tags);
390 		return;
391 	case TREE:
392 		error = got_get_repo_commits(c, 1);
393 		if (error) {
394 			log_warnx("%s: %s", __func__, error->msg);
395 			goto err;
396 		}
397 		if (gotweb_reply(c, 200, "text/html", NULL) == -1)
398 			return;
399 		gotweb_render_page(c->tp, gotweb_render_tree);
400 		return;
401 	case ERR:
402 	default:
403 		error = got_error(GOT_ERR_BAD_QUERYSTRING);
404 	}
405 
406 err:
407 	c->t->error = error;
408 	if (gotweb_reply(c, 400, "text/html", NULL) == -1)
409 		return;
410 	gotweb_render_page(c->tp, gotweb_render_error);
411 }
412 
413 struct server *
414 gotweb_get_server(const char *server_name)
415 {
416 	struct server *srv;
417 
418 	/* check against the server name first */
419 	if (*server_name != '\0')
420 		TAILQ_FOREACH(srv, &gotwebd_env->servers, entry)
421 			if (strcmp(srv->name, server_name) == 0)
422 				return srv;
423 
424 	/* otherwise, use the first server */
425 	return TAILQ_FIRST(&gotwebd_env->servers);
426 };
427 
428 const struct got_error *
429 gotweb_init_transport(struct transport **t)
430 {
431 	const struct got_error *error = NULL;
432 
433 	*t = calloc(1, sizeof(**t));
434 	if (*t == NULL)
435 		return got_error_from_errno2(__func__, "calloc");
436 
437 	TAILQ_INIT(&(*t)->repo_commits);
438 	TAILQ_INIT(&(*t)->repo_tags);
439 	TAILQ_INIT(&(*t)->refs);
440 
441 	(*t)->fd = -1;
442 
443 	return error;
444 }
445 
446 static const struct got_error *
447 gotweb_init_querystring(struct querystring **qs)
448 {
449 	const struct got_error *error = NULL;
450 
451 	*qs = calloc(1, sizeof(**qs));
452 	if (*qs == NULL)
453 		return got_error_from_errno2(__func__, "calloc");
454 
455 	(*qs)->headref = strdup("HEAD");
456 	if ((*qs)->headref == NULL) {
457 		free(*qs);
458 		*qs = NULL;
459 		return got_error_from_errno2(__func__, "strdup");
460 	}
461 
462 	(*qs)->action = INDEX;
463 
464 	return error;
465 }
466 
467 static const struct got_error *
468 gotweb_parse_querystring(struct querystring *qs, char *qst)
469 {
470 	const struct got_error *error = NULL;
471 	char *tok1 = NULL, *tok1_pair = NULL, *tok1_end = NULL;
472 	char *tok2 = NULL, *tok2_pair = NULL, *tok2_end = NULL;
473 
474 	if (qst == NULL)
475 		return error;
476 
477 	tok1 = strdup(qst);
478 	if (tok1 == NULL)
479 		return got_error_from_errno2(__func__, "strdup");
480 
481 	tok1_pair = tok1;
482 	tok1_end = tok1;
483 
484 	while (tok1_pair != NULL) {
485 		strsep(&tok1_end, "&");
486 
487 		tok2 = strdup(tok1_pair);
488 		if (tok2 == NULL) {
489 			free(tok1);
490 			return got_error_from_errno2(__func__, "strdup");
491 		}
492 
493 		tok2_pair = tok2;
494 		tok2_end = tok2;
495 
496 		while (tok2_pair != NULL) {
497 			strsep(&tok2_end, "=");
498 			if (tok2_end) {
499 				error = gotweb_assign_querystring(qs, tok2_pair,
500 				    tok2_end);
501 				if (error)
502 					goto err;
503 			}
504 			tok2_pair = tok2_end;
505 		}
506 		free(tok2);
507 		tok1_pair = tok1_end;
508 	}
509 	free(tok1);
510 	return error;
511 err:
512 	free(tok2);
513 	free(tok1);
514 	return error;
515 }
516 
517 /*
518  * Adapted from usr.sbin/httpd/httpd.c url_decode.
519  */
520 static const struct got_error *
521 gotweb_urldecode(char *url)
522 {
523 	char		*p, *q;
524 	char		 hex[3];
525 	unsigned long	 x;
526 
527 	hex[2] = '\0';
528 	p = q = url;
529 
530 	while (*p != '\0') {
531 		switch (*p) {
532 		case '%':
533 			/* Encoding character is followed by two hex chars */
534 			if (!isxdigit((unsigned char)p[1]) ||
535 			    !isxdigit((unsigned char)p[2]) ||
536 			    (p[1] == '0' && p[2] == '0'))
537 				return got_error(GOT_ERR_BAD_QUERYSTRING);
538 
539 			hex[0] = p[1];
540 			hex[1] = p[2];
541 
542 			/*
543 			 * We don't have to validate "hex" because it is
544 			 * guaranteed to include two hex chars followed by nul.
545 			 */
546 			x = strtoul(hex, NULL, 16);
547 			*q = (char)x;
548 			p += 2;
549 			break;
550 		default:
551 			*q = *p;
552 			break;
553 		}
554 		p++;
555 		q++;
556 	}
557 	*q = '\0';
558 
559 	return NULL;
560 }
561 
562 static const struct got_error *
563 gotweb_assign_querystring(struct querystring *qs, char *key, char *value)
564 {
565 	const struct got_error *error = NULL;
566 	const char *errstr;
567 	int a_cnt, el_cnt;
568 
569 	error = gotweb_urldecode(value);
570 	if (error)
571 		return error;
572 
573 	for (el_cnt = 0; el_cnt < nitems(querystring_keys); el_cnt++) {
574 		if (strcmp(key, querystring_keys[el_cnt].name) != 0)
575 			continue;
576 
577 		switch (querystring_keys[el_cnt].element) {
578 		case ACTION:
579 			for (a_cnt = 0; a_cnt < nitems(action_keys); a_cnt++) {
580 				if (strcmp(value, action_keys[a_cnt].name) != 0)
581 					continue;
582 				qs->action = action_keys[a_cnt].action;
583 				goto qa_found;
584 			}
585 			qs->action = ERR;
586 qa_found:
587 			break;
588 		case COMMIT:
589 			qs->commit = strdup(value);
590 			if (qs->commit == NULL) {
591 				error = got_error_from_errno2(__func__,
592 				    "strdup");
593 				goto done;
594 			}
595 			break;
596 		case RFILE:
597 			qs->file = strdup(value);
598 			if (qs->file == NULL) {
599 				error = got_error_from_errno2(__func__,
600 				    "strdup");
601 				goto done;
602 			}
603 			break;
604 		case FOLDER:
605 			qs->folder = strdup(value);
606 			if (qs->folder == NULL) {
607 				error = got_error_from_errno2(__func__,
608 				    "strdup");
609 				goto done;
610 			}
611 			break;
612 		case HEADREF:
613 			free(qs->headref);
614 			qs->headref = strdup(value);
615 			if (qs->headref == NULL) {
616 				error = got_error_from_errno2(__func__,
617 				    "strdup");
618 				goto done;
619 			}
620 			break;
621 		case INDEX_PAGE:
622 			if (*value == '\0')
623 				break;
624 			qs->index_page = strtonum(value, INT64_MIN,
625 			    INT64_MAX, &errstr);
626 			if (errstr) {
627 				error = got_error_from_errno3(__func__,
628 				    "strtonum", errstr);
629 				goto done;
630 			}
631 			if (qs->index_page < 0)
632 				qs->index_page = 0;
633 			break;
634 		case PATH:
635 			qs->path = strdup(value);
636 			if (qs->path == NULL) {
637 				error = got_error_from_errno2(__func__,
638 				    "strdup");
639 				goto done;
640 			}
641 			break;
642 		}
643 
644 		/* entry found */
645 		break;
646 	}
647 done:
648 	return error;
649 }
650 
651 void
652 gotweb_free_repo_tag(struct repo_tag *rt)
653 {
654 	if (rt != NULL) {
655 		free(rt->commit_id);
656 		free(rt->tag_name);
657 		free(rt->tag_commit);
658 		free(rt->commit_msg);
659 		free(rt->tagger);
660 	}
661 	free(rt);
662 }
663 
664 void
665 gotweb_free_repo_commit(struct repo_commit *rc)
666 {
667 	if (rc != NULL) {
668 		free(rc->path);
669 		free(rc->refs_str);
670 		free(rc->commit_id);
671 		free(rc->parent_id);
672 		free(rc->tree_id);
673 		free(rc->author);
674 		free(rc->committer);
675 		free(rc->commit_msg);
676 	}
677 	free(rc);
678 }
679 
680 static void
681 gotweb_free_querystring(struct querystring *qs)
682 {
683 	if (qs != NULL) {
684 		free(qs->commit);
685 		free(qs->file);
686 		free(qs->folder);
687 		free(qs->headref);
688 		free(qs->path);
689 	}
690 	free(qs);
691 }
692 
693 static void
694 gotweb_free_repo_dir(struct repo_dir *repo_dir)
695 {
696 	if (repo_dir != NULL) {
697 		free(repo_dir->name);
698 		free(repo_dir->owner);
699 		free(repo_dir->description);
700 		free(repo_dir->url);
701 		free(repo_dir->path);
702 	}
703 	free(repo_dir);
704 }
705 
706 void
707 gotweb_free_transport(struct transport *t)
708 {
709 	const struct got_error *err;
710 	struct repo_commit *rc = NULL, *trc = NULL;
711 	struct repo_tag *rt = NULL, *trt = NULL;
712 	int i;
713 
714 	got_ref_list_free(&t->refs);
715 	TAILQ_FOREACH_SAFE(rc, &t->repo_commits, entry, trc) {
716 		TAILQ_REMOVE(&t->repo_commits, rc, entry);
717 		gotweb_free_repo_commit(rc);
718 	}
719 	TAILQ_FOREACH_SAFE(rt, &t->repo_tags, entry, trt) {
720 		TAILQ_REMOVE(&t->repo_tags, rt, entry);
721 		gotweb_free_repo_tag(rt);
722 	}
723 	gotweb_free_repo_dir(t->repo_dir);
724 	gotweb_free_querystring(t->qs);
725 	free(t->more_id);
726 	free(t->tags_more_id);
727 	if (t->blob)
728 		got_object_blob_close(t->blob);
729 	if (t->fp) {
730 		err = got_gotweb_closefile(t->fp);
731 		if (err)
732 			log_warnx("%s: got_gotweb_closefile failure: %s",
733 			    __func__, err->msg);
734 	}
735 	if (t->fd != -1 && close(t->fd) == -1)
736 		log_warn("%s: close", __func__);
737 	if (t->repos) {
738 		for (i = 0; i < t->nrepos; ++i)
739 			free(t->repos[i]);
740 		free(t->repos);
741 	}
742 	if (t->repo)
743 		got_repo_close(t->repo);
744 	free(t);
745 }
746 
747 void
748 gotweb_index_navs(struct request *c, struct gotweb_url *prev, int *have_prev,
749     struct gotweb_url *next, int *have_next)
750 {
751 	struct transport *t = c->t;
752 	struct querystring *qs = t->qs;
753 	struct server *srv = c->srv;
754 
755 	*have_prev = *have_next = 0;
756 
757 	if (qs->index_page > 0) {
758 		*have_prev = 1;
759 		*prev = (struct gotweb_url){
760 			.action = -1,
761 			.index_page = qs->index_page - 1,
762 		};
763 	}
764 	if (t->next_disp == srv->max_repos_display &&
765 	    t->repos_total != (qs->index_page + 1) *
766 	    srv->max_repos_display) {
767 		*have_next = 1;
768 		*next = (struct gotweb_url){
769 			.action = -1,
770 			.index_page = qs->index_page + 1,
771 		};
772 	}
773 }
774 
775 static int
776 gotweb_render_index(struct template *tp)
777 {
778 	const struct got_error *error = NULL;
779 	struct request *c = tp->tp_arg;
780 	struct server *srv = c->srv;
781 	struct transport *t = c->t;
782 	struct querystring *qs = t->qs;
783 	struct repo_dir *repo_dir = NULL;
784 	struct dirent **sd_dent = t->repos;
785 	unsigned int d_i, d_disp = 0;
786 	unsigned int d_skipped = 0;
787 	int type, r;
788 
789 	if (gotweb_render_repo_table_hdr(c->tp) == -1)
790 		return -1;
791 
792 	for (d_i = 0; d_i < t->nrepos; d_i++) {
793 		if (strcmp(sd_dent[d_i]->d_name, ".") == 0 ||
794 		    strcmp(sd_dent[d_i]->d_name, "..") == 0) {
795 			d_skipped++;
796 			continue;
797 		}
798 
799 		error = got_path_dirent_type(&type, srv->repos_path,
800 		    sd_dent[d_i]);
801 		if (error)
802 			continue;
803 		if (type != DT_DIR) {
804 			d_skipped++;
805 			continue;
806 		}
807 
808 		if (qs->index_page > 0 && (qs->index_page *
809 		    srv->max_repos_display) > t->prev_disp) {
810 			t->prev_disp++;
811 			continue;
812 		}
813 
814 		error = gotweb_load_got_path(&repo_dir, sd_dent[d_i]->d_name,
815 		    c);
816 		if (error && error->code != GOT_ERR_LONELY_PACKIDX) {
817 			if (error->code != GOT_ERR_NOT_GIT_REPO)
818 				log_warnx("%s: %s: %s", __func__,
819 				    sd_dent[d_i]->d_name, error->msg);
820 			gotweb_free_repo_dir(repo_dir);
821 			repo_dir = NULL;
822 			d_skipped++;
823 			continue;
824 		}
825 
826 		d_disp++;
827 		t->prev_disp++;
828 
829 		r = gotweb_render_repo_fragment(c->tp, repo_dir);
830 		gotweb_free_repo_dir(repo_dir);
831 		repo_dir = NULL;
832 		got_repo_close(t->repo);
833 		t->repo = NULL;
834 		if (r == -1)
835 			return -1;
836 
837 		t->next_disp++;
838 		if (d_disp == srv->max_repos_display)
839 			break;
840 	}
841 	t->repos_total = t->nrepos - d_skipped;
842 
843 	if (srv->max_repos_display == 0 ||
844 	    t->repos_total <= srv->max_repos_display)
845 		return 0;
846 
847 	if (gotweb_render_navs(c->tp) == -1)
848 		return -1;
849 
850 	return 0;
851 }
852 
853 static inline int
854 should_urlencode(int c)
855 {
856 	if (c <= ' ' || c >= 127)
857 		return 1;
858 
859 	switch (c) {
860 		/* gen-delim */
861 	case ':':
862 	case '/':
863 	case '?':
864 	case '#':
865 	case '[':
866 	case ']':
867 	case '@':
868 		/* sub-delims */
869 	case '!':
870 	case '$':
871 	case '&':
872 	case '\'':
873 	case '(':
874 	case ')':
875 	case '*':
876 	case '+':
877 	case ',':
878 	case ';':
879 	case '=':
880 		/* needed because the URLs are embedded into the HTML */
881 	case '\"':
882 		return 1;
883 	default:
884 		return 0;
885 	}
886 }
887 
888 static char *
889 gotweb_urlencode(const char *str)
890 {
891 	const char *s;
892 	char *escaped;
893 	size_t i, len;
894 	int a, b;
895 
896 	len = 0;
897 	for (s = str; *s; ++s) {
898 		len++;
899 		if (should_urlencode(*s))
900 			len += 2;
901 	}
902 
903 	escaped = calloc(1, len + 1);
904 	if (escaped == NULL)
905 		return NULL;
906 
907 	i = 0;
908 	for (s = str; *s; ++s) {
909 		if (should_urlencode(*s)) {
910 			a = (*s & 0xF0) >> 4;
911 			b = (*s & 0x0F);
912 
913 			escaped[i++] = '%';
914 			escaped[i++] = a <= 9 ? ('0' + a) : ('7' + a);
915 			escaped[i++] = b <= 9 ? ('0' + b) : ('7' + b);
916 		} else
917 			escaped[i++] = *s;
918 	}
919 
920 	return escaped;
921 }
922 
923 const char *
924 gotweb_action_name(int action)
925 {
926 	switch (action) {
927 	case BLAME:
928 		return "blame";
929 	case BLOB:
930 		return "blob";
931 	case BLOBRAW:
932 		return "blobraw";
933 	case BRIEFS:
934 		return "briefs";
935 	case COMMITS:
936 		return "commits";
937 	case DIFF:
938 		return "diff";
939 	case ERR:
940 		return "err";
941 	case INDEX:
942 		return "index";
943 	case PATCH:
944 		return "patch";
945 	case SUMMARY:
946 		return "summary";
947 	case TAG:
948 		return "tag";
949 	case TAGS:
950 		return "tags";
951 	case TREE:
952 		return "tree";
953 	case RSS:
954 		return "rss";
955 	default:
956 		return NULL;
957 	}
958 }
959 
960 int
961 gotweb_render_url(struct request *c, struct gotweb_url *url)
962 {
963 	const char *sep = "?", *action;
964 	char *tmp;
965 	int r;
966 
967 	action = gotweb_action_name(url->action);
968 	if (action != NULL) {
969 		if (tp_writef(c->tp, "?action=%s", action) == -1)
970 			return -1;
971 		sep = "&";
972 	}
973 
974 	if (url->commit) {
975 		if (tp_writef(c->tp, "%scommit=%s", sep, url->commit) == -1)
976 			return -1;
977 		sep = "&";
978 	}
979 
980 	if (url->file) {
981 		tmp = gotweb_urlencode(url->file);
982 		if (tmp == NULL)
983 			return -1;
984 		r = tp_writef(c->tp, "%sfile=%s", sep, tmp);
985 		free(tmp);
986 		if (r == -1)
987 			return -1;
988 		sep = "&";
989 	}
990 
991 	if (url->folder) {
992 		tmp = gotweb_urlencode(url->folder);
993 		if (tmp == NULL)
994 			return -1;
995 		r = tp_writef(c->tp, "%sfolder=%s", sep, tmp);
996 		free(tmp);
997 		if (r == -1)
998 			return -1;
999 		sep = "&";
1000 	}
1001 
1002 	if (url->headref) {
1003 		tmp = gotweb_urlencode(url->headref);
1004 		if (tmp == NULL)
1005 			return -1;
1006 		r = tp_writef(c->tp, "%sheadref=%s", sep, url->headref);
1007 		free(tmp);
1008 		if (r == -1)
1009 			return -1;
1010 		sep = "&";
1011 	}
1012 
1013 	if (url->index_page != -1) {
1014 		if (tp_writef(c->tp, "%sindex_page=%d", sep,
1015 		    url->index_page) == -1)
1016 			return -1;
1017 		sep = "&";
1018 	}
1019 
1020 	if (url->path) {
1021 		tmp = gotweb_urlencode(url->path);
1022 		if (tmp == NULL)
1023 			return -1;
1024 		r = tp_writef(c->tp, "%spath=%s", sep, tmp);
1025 		free(tmp);
1026 		if (r == -1)
1027 			return -1;
1028 		sep = "&";
1029 	}
1030 
1031 	return 0;
1032 }
1033 
1034 int
1035 gotweb_render_absolute_url(struct request *c, struct gotweb_url *url)
1036 {
1037 	struct template	*tp = c->tp;
1038 	const char	*proto = c->https ? "https" : "http";
1039 
1040 	if (tp_writes(tp, proto) == -1 ||
1041 	    tp_writes(tp, "://") == -1 ||
1042 	    tp_htmlescape(tp, c->server_name) == -1 ||
1043 	    tp_htmlescape(tp, c->document_uri) == -1)
1044 		return -1;
1045 
1046 	return gotweb_render_url(c, url);
1047 }
1048 
1049 static const struct got_error *
1050 gotweb_load_got_path(struct repo_dir **rp, const char *dir,
1051     struct request *c)
1052 {
1053 	const struct got_error *error = NULL;
1054 	struct server *srv = c->srv;
1055 	struct transport *t = c->t;
1056 	struct repo_dir *repo_dir;
1057 	DIR *dt;
1058 	char *dir_test;
1059 
1060 	*rp = calloc(1, sizeof(**rp));
1061 	if (*rp == NULL)
1062 		return got_error_from_errno("calloc");
1063 	repo_dir = *rp;
1064 
1065 	if (asprintf(&dir_test, "%s/%s/%s", srv->repos_path, dir,
1066 	    GOTWEB_GIT_DIR) == -1)
1067 		return got_error_from_errno("asprintf");
1068 
1069 	dt = opendir(dir_test);
1070 	if (dt == NULL) {
1071 		free(dir_test);
1072 		if (asprintf(&dir_test, "%s/%s", srv->repos_path, dir) == -1)
1073 			return got_error_from_errno("asprintf");
1074 		dt = opendir(dir_test);
1075 		if (dt == NULL) {
1076 			free(dir_test);
1077 			if (asprintf(&dir_test, "%s/%s%s", srv->repos_path,
1078 			    dir, GOTWEB_GIT_DIR) == -1)
1079 				return got_error_from_errno("asprintf");
1080 			dt = opendir(dir_test);
1081 			if (dt == NULL) {
1082 				free(dir_test);
1083 				return got_error_path(dir,
1084 				    GOT_ERR_NOT_GIT_REPO);
1085 			}
1086 		}
1087 	}
1088 
1089 	repo_dir->path = dir_test;
1090 	dir_test = NULL;
1091 
1092 	repo_dir->name = strdup(repo_dir->path + strlen(srv->repos_path) + 1);
1093 	if (repo_dir->name == NULL) {
1094 		error = got_error_from_errno("strdup");
1095 		goto err;
1096 	}
1097 
1098 	if (srv->respect_exportok &&
1099 	    faccessat(dirfd(dt), "git-daemon-export-ok", F_OK, 0) == -1) {
1100 		error = got_error_path(repo_dir->name, GOT_ERR_NOT_GIT_REPO);
1101 		goto err;
1102 	}
1103 
1104 	error = got_repo_open(&t->repo, repo_dir->path, NULL,
1105 	    gotwebd_env->pack_fds);
1106 	if (error)
1107 		goto err;
1108 	error = gotweb_get_repo_description(&repo_dir->description, srv,
1109 	    repo_dir->path, dirfd(dt));
1110 	if (error)
1111 		goto err;
1112 	error = got_get_repo_owner(&repo_dir->owner, c);
1113 	if (error)
1114 		goto err;
1115 	if (srv->show_repo_age) {
1116 		error = got_get_repo_age(&repo_dir->age, c, NULL);
1117 		if (error)
1118 			goto err;
1119 	}
1120 	error = gotweb_get_clone_url(&repo_dir->url, srv, repo_dir->path,
1121 	    dirfd(dt));
1122 err:
1123 	free(dir_test);
1124 	if (dt != NULL && closedir(dt) == EOF && error == NULL)
1125 		error = got_error_from_errno("closedir");
1126 	if (error && t->repo) {
1127 		got_repo_close(t->repo);
1128 		t->repo = NULL;
1129 	}
1130 	return error;
1131 }
1132 
1133 static const struct got_error *
1134 gotweb_get_repo_description(char **description, struct server *srv,
1135     const char *dirpath, int dir)
1136 {
1137 	const struct got_error *error = NULL;
1138 	struct stat sb;
1139 	int fd = -1;
1140 	off_t len;
1141 
1142 	*description = NULL;
1143 	if (srv->show_repo_description == 0)
1144 		return NULL;
1145 
1146 	fd = openat(dir, "description", O_RDONLY);
1147 	if (fd == -1) {
1148 		if (errno != ENOENT && errno != EACCES) {
1149 			error = got_error_from_errno_fmt("openat %s/%s",
1150 			    dirpath, "description");
1151 		}
1152 		goto done;
1153 	}
1154 
1155 	if (fstat(fd, &sb) == -1) {
1156 		error = got_error_from_errno_fmt("fstat %s/%s",
1157 		    dirpath, "description");
1158 		goto done;
1159 	}
1160 
1161 	len = sb.st_size;
1162 	if (len > GOTWEBD_MAXDESCRSZ - 1)
1163 		len = GOTWEBD_MAXDESCRSZ - 1;
1164 
1165 	*description = calloc(len + 1, sizeof(**description));
1166 	if (*description == NULL) {
1167 		error = got_error_from_errno("calloc");
1168 		goto done;
1169 	}
1170 
1171 	if (read(fd, *description, len) == -1)
1172 		error = got_error_from_errno("read");
1173 done:
1174 	if (fd != -1 && close(fd) == -1 && error == NULL)
1175 		error = got_error_from_errno("close");
1176 	return error;
1177 }
1178 
1179 static const struct got_error *
1180 gotweb_get_clone_url(char **url, struct server *srv, const char *dirpath,
1181     int dir)
1182 {
1183 	const struct got_error *error = NULL;
1184 	struct stat sb;
1185 	int fd = -1;
1186 	off_t len;
1187 
1188 	*url = NULL;
1189 	if (srv->show_repo_cloneurl == 0)
1190 		return NULL;
1191 
1192 	fd = openat(dir, "cloneurl", O_RDONLY);
1193 	if (fd == -1) {
1194 		if (errno != ENOENT && errno != EACCES) {
1195 			error = got_error_from_errno_fmt("openat %s/%s",
1196 			    dirpath, "cloneurl");
1197 		}
1198 		goto done;
1199 	}
1200 
1201 	if (fstat(fd, &sb) == -1) {
1202 		error = got_error_from_errno_fmt("fstat %s/%s",
1203 		    dirpath, "cloneurl");
1204 		goto done;
1205 	}
1206 
1207 	len = sb.st_size;
1208 	if (len > GOTWEBD_MAXCLONEURLSZ - 1)
1209 		len = GOTWEBD_MAXCLONEURLSZ - 1;
1210 
1211 	*url = calloc(len + 1, sizeof(**url));
1212 	if (*url == NULL) {
1213 		error = got_error_from_errno("calloc");
1214 		goto done;
1215 	}
1216 
1217 	if (read(fd, *url, len) == -1)
1218 		error = got_error_from_errno("read");
1219 done:
1220 	if (fd != -1 && close(fd) == -1 && error == NULL)
1221 		error = got_error_from_errno("close");
1222 	return error;
1223 }
1224 
1225 int
1226 gotweb_render_age(struct template *tp, time_t committer_time)
1227 {
1228 	struct request *c = tp->tp_arg;
1229 	long long diff_time;
1230 	const char *years = "years ago", *months = "months ago";
1231 	const char *weeks = "weeks ago", *days = "days ago";
1232 	const char *hours = "hours ago",  *minutes = "minutes ago";
1233 	const char *seconds = "seconds ago", *now = "right now";
1234 
1235 	diff_time = time(NULL) - committer_time;
1236 	if (diff_time > 60 * 60 * 24 * 365 * 2) {
1237 		if (tp_writef(c->tp, "%lld %s",
1238 		    (diff_time / 60 / 60 / 24 / 365), years) == -1)
1239 			return -1;
1240 	} else if (diff_time > 60 * 60 * 24 * (365 / 12) * 2) {
1241 		if (tp_writef(c->tp, "%lld %s",
1242 		    (diff_time / 60 / 60 / 24 / (365 / 12)),
1243 		    months) == -1)
1244 			return -1;
1245 	} else if (diff_time > 60 * 60 * 24 * 7 * 2) {
1246 		if (tp_writef(c->tp, "%lld %s",
1247 		    (diff_time / 60 / 60 / 24 / 7), weeks) == -1)
1248 			return -1;
1249 	} else if (diff_time > 60 * 60 * 24 * 2) {
1250 		if (tp_writef(c->tp, "%lld %s",
1251 		    (diff_time / 60 / 60 / 24), days) == -1)
1252 			return -1;
1253 	} else if (diff_time > 60 * 60 * 2) {
1254 		if (tp_writef(c->tp, "%lld %s",
1255 		    (diff_time / 60 / 60), hours) == -1)
1256 			return -1;
1257 	} else if (diff_time > 60 * 2) {
1258 		if (tp_writef(c->tp, "%lld %s", (diff_time / 60),
1259 		    minutes) == -1)
1260 			return -1;
1261 	} else if (diff_time > 2) {
1262 		if (tp_writef(c->tp, "%lld %s", diff_time,
1263 		    seconds) == -1)
1264 			return -1;
1265 	} else {
1266 		if (tp_writes(tp, now) == -1)
1267 			return -1;
1268 	}
1269 	return 0;
1270 }