1 /*
2  * Copyright (c) 2016, 2019, 2020-2022 Tracey Emery <tracey@traceyemery.net>
3  * Copyright (c) 2015 Mike Larkin <mlarkin@openbsd.org>
4  * Copyright (c) 2014 Reyk Floeter <reyk@openbsd.org>
5  * Copyright (c) 2013 David Gwynne <dlg@openbsd.org>
6  * Copyright (c) 2013 Florian Obser <florian@openbsd.org>
7  *
8  * Permission to use, copy, modify, and distribute this software for any
9  * purpose with or without fee is hereby granted, provided that the above
10  * copyright notice and this permission notice appear in all copies.
11  *
12  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
13  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
14  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
15  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
16  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
17  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
18  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
19  */
20 
21 #include <net/if.h>
22 #include <netinet/in.h>
23 #include <sys/queue.h>
24 #include <sys/stat.h>
25 #include <sys/types.h>
26 
27 #include <ctype.h>
28 #include <dirent.h>
29 #include <errno.h>
30 #include <event.h>
31 #include <fcntl.h>
32 #include <imsg.h>
33 #include <stdio.h>
34 #include <stdlib.h>
35 #include <string.h>
36 #include <unistd.h>
37 
38 #include "got_error.h"
39 #include "got_object.h"
40 #include "got_reference.h"
41 #include "got_repository.h"
42 #include "got_path.h"
43 #include "got_cancel.h"
44 #include "got_worktree.h"
45 #include "got_diff.h"
46 #include "got_commit_graph.h"
47 #include "got_blame.h"
48 #include "got_privsep.h"
49 
50 #include "got_compat.h"
51 
52 #include "proc.h"
53 #include "gotwebd.h"
54 #include "tmpl.h"
55 
56 static const struct querystring_keys querystring_keys[] = {
57 	{ "action",		ACTION },
58 	{ "commit",		COMMIT },
59 	{ "file",		RFILE },
60 	{ "folder",		FOLDER },
61 	{ "headref",		HEADREF },
62 	{ "index_page",		INDEX_PAGE },
63 	{ "path",		PATH },
64 	{ "page",		PAGE },
65 };
66 
67 static const struct action_keys action_keys[] = {
68 	{ "blame",	BLAME },
69 	{ "blob",	BLOB },
70 	{ "blobraw",	BLOBRAW },
71 	{ "briefs",	BRIEFS },
72 	{ "commits",	COMMITS },
73 	{ "diff",	DIFF },
74 	{ "error",	ERR },
75 	{ "index",	INDEX },
76 	{ "summary",	SUMMARY },
77 	{ "tag",	TAG },
78 	{ "tags",	TAGS },
79 	{ "tree",	TREE },
80 	{ "rss",	RSS },
81 };
82 
83 static const struct got_error *gotweb_init_querystring(struct querystring **);
84 static const struct got_error *gotweb_parse_querystring(struct querystring **,
85     char *);
86 static const struct got_error *gotweb_assign_querystring(struct querystring **,
87     char *, char *);
88 static const struct got_error *gotweb_render_index(struct request *);
89 static const struct got_error *gotweb_init_repo_dir(struct repo_dir **,
90     const char *);
91 static const struct got_error *gotweb_load_got_path(struct request *c,
92     struct repo_dir *);
93 static const struct got_error *gotweb_get_repo_description(char **,
94     struct server *, const char *, int);
95 static const struct got_error *gotweb_get_clone_url(char **, struct server *,
96     const char *, int);
97 static const struct got_error *gotweb_render_blame(struct request *);
98 static const struct got_error *gotweb_render_summary(struct request *);
99 static const struct got_error *gotweb_render_tag(struct request *);
100 static const struct got_error *gotweb_render_tags(struct request *);
101 static const struct got_error *gotweb_render_branches(struct request *);
102 
103 static void gotweb_free_querystring(struct querystring *);
104 static void gotweb_free_repo_dir(struct repo_dir *);
105 
106 struct server *gotweb_get_server(uint8_t *, uint8_t *);
107 
108 void
109 gotweb_process_request(struct request *c)
110 {
111 	const struct got_error *error = NULL, *error2 = NULL;
112 	struct got_blob_object *blob = NULL;
113 	struct server *srv = NULL;
114 	struct querystring *qs = NULL;
115 	struct repo_dir *repo_dir = NULL;
116 	FILE *fp = NULL;
117 	uint8_t err[] = "gotwebd experienced an error: ";
118 	int r, html = 0, fd = -1;
119 
120 	/* init the transport */
121 	error = gotweb_init_transport(&c->t);
122 	if (error) {
123 		log_warnx("%s: %s", __func__, error->msg);
124 		return;
125 	}
126 	/* don't process any further if client disconnected */
127 	if (c->sock->client_status == CLIENT_DISCONNECT)
128 		return;
129 	/* get the gotwebd server */
130 	srv = gotweb_get_server(c->server_name, c->http_host);
131 	if (srv == NULL) {
132 		log_warnx("%s: error server is NULL", __func__);
133 		goto err;
134 	}
135 	c->srv = srv;
136 	/* parse our querystring */
137 	error = gotweb_init_querystring(&qs);
138 	if (error) {
139 		log_warnx("%s: %s", __func__, error->msg);
140 		goto err;
141 	}
142 	c->t->qs = qs;
143 	error = gotweb_parse_querystring(&qs, c->querystring);
144 	if (error) {
145 		log_warnx("%s: %s", __func__, error->msg);
146 		goto err;
147 	}
148 
149 	/*
150 	 * certain actions require a commit id in the querystring. this stops
151 	 * bad actors from exploiting this by manually manipulating the
152 	 * querystring.
153 	 */
154 
155 	if (qs->action == BLAME || qs->action == BLOB ||
156 	    qs->action == BLOBRAW || qs->action == DIFF) {
157 		if (qs->commit == NULL) {
158 			error2 = got_error(GOT_ERR_QUERYSTRING);
159 			goto render;
160 		}
161 	}
162 
163 	if (qs->action != INDEX) {
164 		error = gotweb_init_repo_dir(&repo_dir, qs->path);
165 		if (error)
166 			goto done;
167 		error = gotweb_load_got_path(c, repo_dir);
168 		c->t->repo_dir = repo_dir;
169 		if (error && error->code != GOT_ERR_LONELY_PACKIDX)
170 			goto err;
171 	}
172 
173 	if (qs->action == BLOBRAW) {
174 		error = got_get_repo_commits(c, 1);
175 		if (error)
176 			goto done;
177 		error = got_output_file_blob(c);
178 		if (error) {
179 			log_warnx("%s: %s", __func__, error->msg);
180 			goto err;
181 		}
182 		goto done;
183 	}
184 
185 	if (qs->action == BLOB) {
186 		int binary;
187 		struct gotweb_url url = {
188 			.index_page = -1,
189 			.page = -1,
190 			.action = BLOBRAW,
191 			.path = qs->path,
192 			.commit = qs->commit,
193 			.folder = qs->folder,
194 			.file = qs->file,
195 		};
196 
197 		error = got_get_repo_commits(c, 1);
198 		if (error)
199 			goto done;
200 
201 		error2 = got_open_blob_for_output(&blob, &fd, &binary, c);
202 		if (error2)
203 			goto render;
204 		if (binary) {
205 			fcgi_puts(c->tp, "Status: 302\r\n");
206 			fcgi_puts(c->tp, "Location: ");
207 			gotweb_render_url(c, &url);
208 			fcgi_puts(c->tp, "\r\n\r\n");
209 			goto done;
210 		}
211 	}
212 
213 	if (qs->action == RSS) {
214 		error = gotweb_render_content_type_file(c,
215 		    "application/rss+xml;charset=utf-8",
216 		    repo_dir->name, ".rss");
217 		if (error) {
218 			log_warnx("%s: %s", __func__, error->msg);
219 			goto err;
220 		}
221 
222 		error = got_get_repo_tags(c, D_MAXSLCOMMDISP);
223 		if (error) {
224 			log_warnx("%s: %s", __func__, error->msg);
225 			goto err;
226 		}
227 		if (gotweb_render_rss(c->tp) == -1)
228 			goto err;
229 		goto done;
230 	}
231 
232 render:
233 	error = gotweb_render_content_type(c, "text/html");
234 	if (error) {
235 		log_warnx("%s: %s", __func__, error->msg);
236 		goto err;
237 	}
238 	html = 1;
239 
240 	if (gotweb_render_header(c->tp) == -1)
241 		goto err;
242 
243 	if (error2) {
244 		error = error2;
245 		goto err;
246 	}
247 
248 	switch(qs->action) {
249 	case BLAME:
250 		error = gotweb_render_blame(c);
251 		if (error) {
252 			log_warnx("%s: %s", __func__, error->msg);
253 			goto err;
254 		}
255 		break;
256 	case BLOB:
257 		if (gotweb_render_blob(c->tp, blob) == -1)
258 			goto err;
259 		break;
260 	case BRIEFS:
261 		if (gotweb_render_briefs(c->tp) == -1)
262 			goto err;
263 		break;
264 	case COMMITS:
265 		error = got_get_repo_commits(c, srv->max_commits_display);
266 		if (error) {
267 			log_warnx("%s: %s", __func__, error->msg);
268 			goto err;
269 		}
270 		if (gotweb_render_commits(c->tp) == -1)
271 			goto err;
272 		break;
273 	case DIFF:
274 		error = got_get_repo_commits(c, 1);
275 		if (error) {
276 			log_warnx("%s: %s", __func__, error->msg);
277 			goto err;
278 		}
279 		error = got_open_diff_for_output(&fp, &fd, c);
280 		if (error) {
281 			log_warnx("%s: %s", __func__, error->msg);
282 			goto err;
283 		}
284 		if (gotweb_render_diff(c->tp, fp) == -1)
285 			goto err;
286 		break;
287 	case INDEX:
288 		error = gotweb_render_index(c);
289 		if (error) {
290 			log_warnx("%s: %s", __func__, error->msg);
291 			goto err;
292 		}
293 		break;
294 	case SUMMARY:
295 		error = gotweb_render_summary(c);
296 		if (error) {
297 			log_warnx("%s: %s", __func__, error->msg);
298 			goto err;
299 		}
300 		break;
301 	case TAG:
302 		error = gotweb_render_tag(c);
303 		if (error) {
304 			log_warnx("%s: %s", __func__, error->msg);
305 			goto err;
306 		}
307 		break;
308 	case TAGS:
309 		error = gotweb_render_tags(c);
310 		if (error) {
311 			log_warnx("%s: %s", __func__, error->msg);
312 			goto err;
313 		}
314 		break;
315 	case TREE:
316 		error = got_get_repo_commits(c, 1);
317 		if (error) {
318 			log_warnx("%s: %s", __func__, error->msg);
319 			goto err;
320 		}
321 		if (gotweb_render_tree(c->tp) == -1)
322 			goto err;
323 		break;
324 	case ERR:
325 	default:
326 		r = fcgi_printf(c, "<div id='err_content'>%s</div>\n",
327 		    "Erorr: Bad Querystring");
328 		if (r == -1)
329 			goto err;
330 		break;
331 	}
332 
333 	goto done;
334 err:
335 	if (html && fcgi_printf(c, "<div id='err_content'>") == -1)
336 		return;
337 	if (fcgi_printf(c, "\n%s", err) == -1)
338 		return;
339 	if (error) {
340 		if (fcgi_printf(c, "%s", error->msg) == -1)
341 			return;
342 	} else {
343 		if (fcgi_printf(c, "see daemon logs for details") == -1)
344 			return;
345 	}
346 	if (html && fcgi_printf(c, "</div>\n") == -1)
347 		return;
348 done:
349 	if (blob)
350 		got_object_blob_close(blob);
351 	if (fp) {
352 		error = got_gotweb_flushfile(fp, fd);
353 		if (error)
354 			log_warnx("%s: got_gotweb_flushfile failure: %s",
355 			    __func__, error->msg);
356 		fd = -1;
357 	}
358 	if (fd != -1)
359 		close(fd);
360 	if (html && srv != NULL)
361 		gotweb_render_footer(c->tp);
362 }
363 
364 struct server *
365 gotweb_get_server(uint8_t *server_name, uint8_t *subdomain)
366 {
367 	struct server *srv = NULL;
368 
369 	/* check against the server name first */
370 	if (strlen(server_name) > 0)
371 		TAILQ_FOREACH(srv, &gotwebd_env->servers, entry)
372 			if (strcmp(srv->name, server_name) == 0)
373 				goto done;
374 
375 	/* check against subdomain second */
376 	if (strlen(subdomain) > 0)
377 		TAILQ_FOREACH(srv, &gotwebd_env->servers, entry)
378 			if (strcmp(srv->name, subdomain) == 0)
379 				goto done;
380 
381 	/* if those fail, send first server */
382 	TAILQ_FOREACH(srv, &gotwebd_env->servers, entry)
383 		if (srv != NULL)
384 			break;
385 done:
386 	return srv;
387 };
388 
389 const struct got_error *
390 gotweb_init_transport(struct transport **t)
391 {
392 	const struct got_error *error = NULL;
393 
394 	*t = calloc(1, sizeof(**t));
395 	if (*t == NULL)
396 		return got_error_from_errno2("%s: calloc", __func__);
397 
398 	TAILQ_INIT(&(*t)->repo_commits);
399 	TAILQ_INIT(&(*t)->repo_tags);
400 
401 	(*t)->repo = NULL;
402 	(*t)->repo_dir = NULL;
403 	(*t)->qs = NULL;
404 	(*t)->next_id = NULL;
405 	(*t)->prev_id = NULL;
406 	(*t)->next_disp = 0;
407 	(*t)->prev_disp = 0;
408 
409 	return error;
410 }
411 
412 static const struct got_error *
413 gotweb_init_querystring(struct querystring **qs)
414 {
415 	const struct got_error *error = NULL;
416 
417 	*qs = calloc(1, sizeof(**qs));
418 	if (*qs == NULL)
419 		return got_error_from_errno2("%s: calloc", __func__);
420 
421 	(*qs)->headref = strdup("HEAD");
422 	if ((*qs)->headref == NULL) {
423 		free(*qs);
424 		*qs = NULL;
425 		return got_error_from_errno2("%s: strdup", __func__);
426 	}
427 
428 	(*qs)->action = INDEX;
429 	(*qs)->commit = NULL;
430 	(*qs)->file = NULL;
431 	(*qs)->folder = NULL;
432 	(*qs)->index_page = 0;
433 	(*qs)->path = NULL;
434 
435 	return error;
436 }
437 
438 static const struct got_error *
439 gotweb_parse_querystring(struct querystring **qs, char *qst)
440 {
441 	const struct got_error *error = NULL;
442 	char *tok1 = NULL, *tok1_pair = NULL, *tok1_end = NULL;
443 	char *tok2 = NULL, *tok2_pair = NULL, *tok2_end = NULL;
444 
445 	if (qst == NULL)
446 		return error;
447 
448 	tok1 = strdup(qst);
449 	if (tok1 == NULL)
450 		return got_error_from_errno2("%s: strdup", __func__);
451 
452 	tok1_pair = tok1;
453 	tok1_end = tok1;
454 
455 	while (tok1_pair != NULL) {
456 		strsep(&tok1_end, "&");
457 
458 		tok2 = strdup(tok1_pair);
459 		if (tok2 == NULL) {
460 			free(tok1);
461 			return got_error_from_errno2("%s: strdup", __func__);
462 		}
463 
464 		tok2_pair = tok2;
465 		tok2_end = tok2;
466 
467 		while (tok2_pair != NULL) {
468 			strsep(&tok2_end, "=");
469 			if (tok2_end) {
470 				error = gotweb_assign_querystring(qs, tok2_pair,
471 				    tok2_end);
472 				if (error)
473 					goto err;
474 			}
475 			tok2_pair = tok2_end;
476 		}
477 		free(tok2);
478 		tok1_pair = tok1_end;
479 	}
480 	free(tok1);
481 	return error;
482 err:
483 	free(tok2);
484 	free(tok1);
485 	return error;
486 }
487 
488 /*
489  * Adapted from usr.sbin/httpd/httpd.c url_decode.
490  */
491 static const struct got_error *
492 gotweb_urldecode(char *url)
493 {
494 	char		*p, *q;
495 	char		 hex[3];
496 	unsigned long	 x;
497 
498 	hex[2] = '\0';
499 	p = q = url;
500 
501 	while (*p != '\0') {
502 		switch (*p) {
503 		case '%':
504 			/* Encoding character is followed by two hex chars */
505 			if (!isxdigit((unsigned char)p[1]) ||
506 			    !isxdigit((unsigned char)p[2]) ||
507 			    (p[1] == '0' && p[2] == '0'))
508 				return got_error(GOT_ERR_BAD_QUERYSTRING);
509 
510 			hex[0] = p[1];
511 			hex[1] = p[2];
512 
513 			/*
514 			 * We don't have to validate "hex" because it is
515 			 * guaranteed to include two hex chars followed by nul.
516 			 */
517 			x = strtoul(hex, NULL, 16);
518 			*q = (char)x;
519 			p += 2;
520 			break;
521 		default:
522 			*q = *p;
523 			break;
524 		}
525 		p++;
526 		q++;
527 	}
528 	*q = '\0';
529 
530 	return NULL;
531 }
532 
533 static const struct got_error *
534 gotweb_assign_querystring(struct querystring **qs, char *key, char *value)
535 {
536 	const struct got_error *error = NULL;
537 	const char *errstr;
538 	int a_cnt, el_cnt;
539 
540 	error = gotweb_urldecode(value);
541 	if (error)
542 		return error;
543 
544 	for (el_cnt = 0; el_cnt < QSELEM__MAX; el_cnt++) {
545 		if (strcmp(key, querystring_keys[el_cnt].name) != 0)
546 			continue;
547 
548 		switch (querystring_keys[el_cnt].element) {
549 		case ACTION:
550 			for (a_cnt = 0; a_cnt < ACTIONS__MAX; a_cnt++) {
551 				if (strcmp(value, action_keys[a_cnt].name) != 0)
552 					continue;
553 				else if (strcmp(value,
554 				    action_keys[a_cnt].name) == 0){
555 					(*qs)->action =
556 					    action_keys[a_cnt].action;
557 					goto qa_found;
558 				}
559 			}
560 			(*qs)->action = ERR;
561 qa_found:
562 			break;
563 		case COMMIT:
564 			(*qs)->commit = strdup(value);
565 			if ((*qs)->commit == NULL) {
566 				error = got_error_from_errno2("%s: strdup",
567 				    __func__);
568 				goto done;
569 			}
570 			break;
571 		case RFILE:
572 			(*qs)->file = strdup(value);
573 			if ((*qs)->file == NULL) {
574 				error = got_error_from_errno2("%s: strdup",
575 				    __func__);
576 				goto done;
577 			}
578 			break;
579 		case FOLDER:
580 			(*qs)->folder = strdup(value);
581 			if ((*qs)->folder == NULL) {
582 				error = got_error_from_errno2("%s: strdup",
583 				    __func__);
584 				goto done;
585 			}
586 			break;
587 		case HEADREF:
588 			free((*qs)->headref);
589 			(*qs)->headref = strdup(value);
590 			if ((*qs)->headref == NULL) {
591 				error = got_error_from_errno2("%s: strdup",
592 				    __func__);
593 				goto done;
594 			}
595 			break;
596 		case INDEX_PAGE:
597 			if (strlen(value) == 0)
598 				break;
599 			(*qs)->index_page = strtonum(value, INT64_MIN,
600 			    INT64_MAX, &errstr);
601 			if (errstr) {
602 				error = got_error_from_errno3("%s: strtonum %s",
603 				    __func__, errstr);
604 				goto done;
605 			}
606 			if ((*qs)->index_page < 0)
607 				(*qs)->index_page = 0;
608 			break;
609 		case PATH:
610 			(*qs)->path = strdup(value);
611 			if ((*qs)->path == NULL) {
612 				error = got_error_from_errno2("%s: strdup",
613 				    __func__);
614 				goto done;
615 			}
616 			break;
617 		case PAGE:
618 			if (strlen(value) == 0)
619 				break;
620 			(*qs)->page = strtonum(value, INT64_MIN,
621 			    INT64_MAX, &errstr);
622 			if (errstr) {
623 				error = got_error_from_errno3("%s: strtonum %s",
624 				    __func__, errstr);
625 				goto done;
626 			}
627 			if ((*qs)->page < 0)
628 				(*qs)->page = 0;
629 			break;
630 		default:
631 			break;
632 		}
633 	}
634 done:
635 	return error;
636 }
637 
638 void
639 gotweb_free_repo_tag(struct repo_tag *rt)
640 {
641 	if (rt != NULL) {
642 		free(rt->commit_id);
643 		free(rt->tag_name);
644 		free(rt->tag_commit);
645 		free(rt->commit_msg);
646 		free(rt->tagger);
647 	}
648 	free(rt);
649 }
650 
651 void
652 gotweb_free_repo_commit(struct repo_commit *rc)
653 {
654 	if (rc != NULL) {
655 		free(rc->path);
656 		free(rc->refs_str);
657 		free(rc->commit_id);
658 		free(rc->parent_id);
659 		free(rc->tree_id);
660 		free(rc->author);
661 		free(rc->committer);
662 		free(rc->commit_msg);
663 	}
664 	free(rc);
665 }
666 
667 static void
668 gotweb_free_querystring(struct querystring *qs)
669 {
670 	if (qs != NULL) {
671 		free(qs->commit);
672 		free(qs->file);
673 		free(qs->folder);
674 		free(qs->headref);
675 		free(qs->path);
676 	}
677 	free(qs);
678 }
679 
680 static void
681 gotweb_free_repo_dir(struct repo_dir *repo_dir)
682 {
683 	if (repo_dir != NULL) {
684 		free(repo_dir->name);
685 		free(repo_dir->owner);
686 		free(repo_dir->description);
687 		free(repo_dir->url);
688 		free(repo_dir->age);
689 		free(repo_dir->path);
690 	}
691 	free(repo_dir);
692 }
693 
694 void
695 gotweb_free_transport(struct transport *t)
696 {
697 	struct repo_commit *rc = NULL, *trc = NULL;
698 	struct repo_tag *rt = NULL, *trt = NULL;
699 
700 	TAILQ_FOREACH_SAFE(rc, &t->repo_commits, entry, trc) {
701 		TAILQ_REMOVE(&t->repo_commits, rc, entry);
702 		gotweb_free_repo_commit(rc);
703 	}
704 	TAILQ_FOREACH_SAFE(rt, &t->repo_tags, entry, trt) {
705 		TAILQ_REMOVE(&t->repo_tags, rt, entry);
706 		gotweb_free_repo_tag(rt);
707 	}
708 	gotweb_free_repo_dir(t->repo_dir);
709 	gotweb_free_querystring(t->qs);
710 	free(t->next_id);
711 	free(t->prev_id);
712 	free(t);
713 }
714 
715 const struct got_error *
716 gotweb_render_content_type(struct request *c, const char *type)
717 {
718 	const char *csp = "default-src 'self'; script-src 'none'; "
719 		"object-src 'none';";
720 
721 	fcgi_printf(c,
722 	    "Content-Security-Policy: %s\r\n"
723 	    "Content-Type: %s\r\n\r\n",
724 	    csp, type);
725 	return NULL;
726 }
727 
728 const struct got_error *
729 gotweb_render_content_type_file(struct request *c, const char *type,
730     const char *file, const char *suffix)
731 {
732 	fcgi_printf(c, "Content-type: %s\r\n"
733 	    "Content-disposition: attachment; filename=%s%s\r\n\r\n",
734 	    type, file, suffix ? suffix : "");
735 	return NULL;
736 }
737 
738 void
739 gotweb_get_navs(struct request *c, struct gotweb_url *prev, int *have_prev,
740     struct gotweb_url *next, int *have_next)
741 {
742 	struct transport *t = c->t;
743 	struct querystring *qs = t->qs;
744 	struct server *srv = c->srv;
745 
746 	*have_prev = *have_next = 0;
747 
748 	switch(qs->action) {
749 	case INDEX:
750 		if (qs->index_page > 0) {
751 			*have_prev = 1;
752 			*prev = (struct gotweb_url){
753 				.action = -1,
754 				.index_page = qs->index_page - 1,
755 				.page = -1,
756 			};
757 		}
758 		if (t->next_disp == srv->max_repos_display &&
759 		    t->repos_total != (qs->index_page + 1) *
760 		    srv->max_repos_display) {
761 			*have_next = 1;
762 			*next = (struct gotweb_url){
763 				.action = -1,
764 				.index_page = qs->index_page + 1,
765 				.page = -1,
766 			};
767 		}
768 		break;
769 	case BRIEFS:
770 		if (t->prev_id && qs->commit != NULL &&
771 		    strcmp(qs->commit, t->prev_id) != 0) {
772 			*have_prev = 1;
773 			*prev = (struct gotweb_url){
774 				.action = BRIEFS,
775 				.index_page = -1,
776 				.page = qs->page - 1,
777 				.path = qs->path,
778 				.commit = t->prev_id,
779 				.headref = qs->headref,
780 			};
781 		}
782 		if (t->next_id) {
783 			*have_next = 1;
784 			*next = (struct gotweb_url){
785 				.action = BRIEFS,
786 				.index_page = -1,
787 				.page = qs->page + 1,
788 				.path = qs->path,
789 				.commit = t->next_id,
790 				.headref = qs->headref,
791 			};
792 		}
793 		break;
794 	case COMMITS:
795 		if (t->prev_id && qs->commit != NULL &&
796 		    strcmp(qs->commit, t->prev_id) != 0) {
797 			*have_prev = 1;
798 			*prev = (struct gotweb_url){
799 				.action = COMMITS,
800 				.index_page = -1,
801 				.page = qs->page - 1,
802 				.path = qs->path,
803 				.commit = t->prev_id,
804 				.headref = qs->headref,
805 				.folder = qs->folder,
806 				.file = qs->file,
807 			};
808 		}
809 		if (t->next_id) {
810 			*have_next = 1;
811 			*next = (struct gotweb_url){
812 				.action = COMMITS,
813 				.index_page = -1,
814 				.page = qs->page + 1,
815 				.path = qs->path,
816 				.commit = t->next_id,
817 				.headref = qs->headref,
818 				.folder = qs->folder,
819 				.file = qs->file,
820 			};
821 		}
822 		break;
823 	case TAGS:
824 		if (t->prev_id && qs->commit != NULL &&
825 		    strcmp(qs->commit, t->prev_id) != 0) {
826 			*have_prev = 1;
827 			*prev = (struct gotweb_url){
828 				.action = TAGS,
829 				.index_page = -1,
830 				.page = qs->page - 1,
831 				.path = qs->path,
832 				.commit = t->prev_id,
833 				.headref = qs->headref,
834 			};
835 		}
836 		if (t->next_id) {
837 			*have_next = 1;
838 			*next = (struct gotweb_url){
839 				.action = TAGS,
840 				.index_page = -1,
841 				.page = qs->page + 1,
842 				.path = qs->path,
843 				.commit = t->next_id,
844 				.headref = qs->headref,
845 			};
846 		}
847 		break;
848 	}
849 }
850 
851 static const struct got_error *
852 gotweb_render_index(struct request *c)
853 {
854 	const struct got_error *error = NULL;
855 	struct server *srv = c->srv;
856 	struct transport *t = c->t;
857 	struct querystring *qs = t->qs;
858 	struct repo_dir *repo_dir = NULL;
859 	DIR *d;
860 	struct dirent **sd_dent = NULL;
861 	unsigned int d_cnt, d_i, d_disp = 0;
862 	unsigned int d_skipped = 0;
863 	int type;
864 
865 	d = opendir(srv->repos_path);
866 	if (d == NULL) {
867 		error = got_error_from_errno2("opendir", srv->repos_path);
868 		return error;
869 	}
870 
871 	d_cnt = scandir(srv->repos_path, &sd_dent, NULL, alphasort);
872 	if (d_cnt == -1) {
873 		sd_dent = NULL;
874 		error = got_error_from_errno2("scandir", srv->repos_path);
875 		goto done;
876 	}
877 
878 	if (gotweb_render_repo_table_hdr(c->tp) == -1)
879 		goto done;
880 
881 	for (d_i = 0; d_i < d_cnt; d_i++) {
882 		if (srv->max_repos > 0 && t->prev_disp == srv->max_repos)
883 			break;
884 
885 		if (strcmp(sd_dent[d_i]->d_name, ".") == 0 ||
886 		    strcmp(sd_dent[d_i]->d_name, "..") == 0) {
887 			d_skipped++;
888 			continue;
889 		}
890 
891 		error = got_path_dirent_type(&type, srv->repos_path,
892 		    sd_dent[d_i]);
893 		if (error)
894 			goto done;
895 		if (type != DT_DIR) {
896 			d_skipped++;
897 			continue;
898 		}
899 
900 		if (qs->index_page > 0 && (qs->index_page *
901 		    srv->max_repos_display) > t->prev_disp) {
902 			t->prev_disp++;
903 			continue;
904 		}
905 
906 		error = gotweb_init_repo_dir(&repo_dir, sd_dent[d_i]->d_name);
907 		if (error)
908 			goto done;
909 
910 		error = gotweb_load_got_path(c, repo_dir);
911 		if (error && error->code == GOT_ERR_NOT_GIT_REPO) {
912 			error = NULL;
913 			gotweb_free_repo_dir(repo_dir);
914 			repo_dir = NULL;
915 			d_skipped++;
916 			continue;
917 		}
918 		if (error && error->code != GOT_ERR_LONELY_PACKIDX)
919 			goto done;
920 
921 		d_disp++;
922 		t->prev_disp++;
923 
924 		if (gotweb_render_repo_fragment(c->tp, repo_dir) == -1)
925 			goto done;
926 
927 		gotweb_free_repo_dir(repo_dir);
928 		repo_dir = NULL;
929 		t->next_disp++;
930 		if (d_disp == srv->max_repos_display)
931 			break;
932 	}
933 	t->repos_total = d_cnt - d_skipped;
934 
935 	if (srv->max_repos_display == 0)
936 		goto done;
937 	if (srv->max_repos > 0 && srv->max_repos < srv->max_repos_display)
938 		goto done;
939 	if (t->repos_total <= srv->max_repos ||
940 	    t->repos_total <= srv->max_repos_display)
941 		goto done;
942 
943 	if (gotweb_render_navs(c->tp) == -1)
944 		goto done;
945 done:
946 	if (sd_dent) {
947 		for (d_i = 0; d_i < d_cnt; d_i++)
948 			free(sd_dent[d_i]);
949 		free(sd_dent);
950 	}
951 	if (d != NULL && closedir(d) == EOF && error == NULL)
952 		error = got_error_from_errno("closedir");
953 	return error;
954 }
955 
956 static const struct got_error *
957 gotweb_render_blame(struct request *c)
958 {
959 	const struct got_error *error = NULL;
960 	struct transport *t = c->t;
961 	struct repo_commit *rc = NULL;
962 	char *age = NULL, *msg = NULL;
963 	int r;
964 
965 	error = got_get_repo_commits(c, 1);
966 	if (error)
967 		return error;
968 
969 	rc = TAILQ_FIRST(&t->repo_commits);
970 
971 	error = gotweb_get_time_str(&age, rc->committer_time, TM_LONG);
972 	if (error)
973 		goto done;
974 	error = gotweb_escape_html(&msg, rc->commit_msg);
975 	if (error)
976 		goto done;
977 
978 	r = fcgi_printf(c, "<div id='blame_title_wrapper'>\n"
979 	    "<div id='blame_title'>Blame</div>\n"
980 	    "</div>\n"		/* #blame_title_wrapper */
981 	    "<div id='blame_content'>\n"
982 	    "<div id='blame_header_wrapper'>\n"
983 	    "<div id='blame_header'>\n"
984 	    "<div class='header_age_title'>Date:</div>\n"
985 	    "<div class='header_age'>%s</div>\n"
986 	    "<div id='header_commit_msg_title'>Message:</div>\n"
987 	    "<div id='header_commit_msg'>%s</div>\n"
988 	    "</div>\n"		/* #blame_header */
989 	    "</div>\n"		/* #blame_header_wrapper */
990 	    "<div class='dotted_line'></div>\n"
991 	    "<div id='blame'>\n",
992 	    age,
993 	    msg);
994 	if (r == -1)
995 		goto done;
996 
997 	error = got_output_file_blame(c);
998 	if (error)
999 		goto done;
1000 
1001 	fcgi_printf(c, "</div>\n"	/* #blame */
1002 	    "</div>\n");		/* #blame_content */
1003 done:
1004 	free(age);
1005 	free(msg);
1006 	return error;
1007 }
1008 
1009 static const struct got_error *
1010 gotweb_render_branches(struct request *c)
1011 {
1012 	const struct got_error *error = NULL;
1013 	struct got_reflist_head refs;
1014 	struct got_reflist_entry *re;
1015 	struct transport *t = c->t;
1016 	struct querystring *qs = t->qs;
1017 	struct got_repository *repo = t->repo;
1018 	char *escaped_refname = NULL;
1019 	char *age = NULL;
1020 	int r;
1021 
1022 	TAILQ_INIT(&refs);
1023 
1024 	error = got_ref_list(&refs, repo, "refs/heads",
1025 	    got_ref_cmp_by_name, NULL);
1026 	if (error)
1027 		goto done;
1028 
1029 	r = fcgi_printf(c, "<div id='branches_title_wrapper'>\n"
1030 	    "<div id='branches_title'>Branches</div>\n"
1031 	    "</div>\n"	/* #branches_title_wrapper */
1032 	    "<div id='branches_content'>\n");
1033 	if (r == -1)
1034 		goto done;
1035 
1036 	TAILQ_FOREACH(re, &refs, entry) {
1037 		const char *refname = NULL;
1038 
1039 		if (got_ref_is_symbolic(re->ref))
1040 			continue;
1041 
1042 		refname = got_ref_get_name(re->ref);
1043 		if (refname == NULL) {
1044 			error = got_error_from_errno("strdup");
1045 			goto done;
1046 		}
1047 		if (strncmp(refname, "refs/heads/", 11) != 0)
1048 			continue;
1049 
1050 		error = got_get_repo_age(&age, c, refname, TM_DIFF);
1051 		if (error)
1052 			goto done;
1053 
1054 		if (strncmp(refname, "refs/heads/", 11) == 0)
1055 			refname += 11;
1056 		error = gotweb_escape_html(&escaped_refname, refname);
1057 		if (error)
1058 			goto done;
1059 
1060 		r = fcgi_printf(c, "<div class='branches_wrapper'>\n"
1061 		    "<div class='branches_age'>%s</div>\n"
1062 		    "<div class='branches_space'>&nbsp;</div>\n"
1063 		    "<div class='branch'>", age);
1064 		if (r == -1)
1065 			goto done;
1066 
1067 		r = gotweb_link(c, &(struct gotweb_url){
1068 			.action = SUMMARY,
1069 			.index_page = -1,
1070 			.page = -1,
1071 			.path = qs->path,
1072 			.headref = refname,
1073 		    }, "%s", escaped_refname);
1074 		if (r == -1)
1075 			goto done;
1076 
1077 		if (fcgi_printf(c, "</div>\n"	/* .branch */
1078 		    "<div class='navs_wrapper'>\n"
1079 		    "<div class='navs'>") == -1)
1080 			goto done;
1081 
1082 		r = gotweb_link(c, &(struct gotweb_url){
1083 			.action = SUMMARY,
1084 			.index_page = -1,
1085 			.page = -1,
1086 			.path = qs->path,
1087 			.headref = refname,
1088 		    }, "summary");
1089 		if (r == -1)
1090 			goto done;
1091 
1092 		if (fcgi_printf(c, " | ") == -1)
1093 			goto done;
1094 
1095 		r = gotweb_link(c, &(struct gotweb_url){
1096 			.action = BRIEFS,
1097 			.index_page = -1,
1098 			.page = -1,
1099 			.path = qs->path,
1100 			.headref = refname,
1101 		    }, "commit briefs");
1102 		if (r == -1)
1103 			goto done;
1104 
1105 		if (fcgi_printf(c, " | ") == -1)
1106 			goto done;
1107 
1108 		r = gotweb_link(c, &(struct gotweb_url){
1109 			.action = COMMITS,
1110 			.index_page = -1,
1111 			.page = -1,
1112 			.path = qs->path,
1113 			.headref = refname,
1114 		    }, "commits");
1115 		if (r == -1)
1116 			goto done;
1117 
1118 		r = fcgi_printf(c, "</div>\n"	/* .navs */
1119 		    "</div>\n"			/* .navs_wrapper */
1120 		    "<div class='dotted_line'></div>\n"
1121 		    "</div>\n");		/* .branches_wrapper */
1122 		if (r == -1)
1123 			goto done;
1124 
1125 		free(age);
1126 		age = NULL;
1127 		free(escaped_refname);
1128 		escaped_refname = NULL;
1129 	}
1130 	fcgi_printf(c, "</div>\n"); /* #branches_content */
1131 done:
1132 	free(age);
1133 	free(escaped_refname);
1134 	got_ref_list_free(&refs);
1135 	return error;
1136 }
1137 
1138 static const struct got_error *
1139 gotweb_render_summary(struct request *c)
1140 {
1141 	const struct got_error *error = NULL;
1142 	struct transport *t = c->t;
1143 	struct server *srv = c->srv;
1144 	int r;
1145 
1146 	if (fcgi_printf(c, "<div id='summary_wrapper'>\n") == -1)
1147 		goto done;
1148 
1149 	if (srv->show_repo_description) {
1150 		r = fcgi_printf(c,
1151 		    "<div id='description_title'>Description:</div>\n"
1152 		    "<div id='description'>%s</div>\n",
1153 		    t->repo_dir->description ? t->repo_dir->description : "");
1154 		if (r == -1)
1155 			goto done;
1156 	}
1157 
1158 	if (srv->show_repo_owner) {
1159 		r = fcgi_printf(c,
1160 		    "<div id='repo_owner_title'>Owner:</div>\n"
1161 		    "<div id='repo_owner'>%s</div>\n",
1162 		    t->repo_dir->owner ? t->repo_dir->owner : "");
1163 		if (r == -1)
1164 			goto done;
1165 	}
1166 
1167 	if (srv->show_repo_age) {
1168 		r = fcgi_printf(c,
1169 		    "<div id='last_change_title'>Last Change:</div>\n"
1170 		    "<div id='last_change'>%s</div>\n",
1171 		    t->repo_dir->age);
1172 		if (r == -1)
1173 			goto done;
1174 	}
1175 
1176 	if (srv->show_repo_cloneurl) {
1177 		r = fcgi_printf(c,
1178 		    "<div id='cloneurl_title'>Clone URL:</div>\n"
1179 		    "<div id='cloneurl'>%s</div>\n",
1180 		    t->repo_dir->url ? t->repo_dir->url : "");
1181 		if (r == -1)
1182 			goto done;
1183 	}
1184 
1185 	r = fcgi_printf(c, "</div>\n"); /* #summary_wrapper */
1186 	if (r == -1)
1187 		goto done;
1188 
1189 	if (gotweb_render_briefs(c->tp) == -1)
1190 		goto done;
1191 
1192 	error = gotweb_render_tags(c);
1193 	if (error) {
1194 		log_warnx("%s: %s", __func__, error->msg);
1195 		goto done;
1196 	}
1197 
1198 	error = gotweb_render_branches(c);
1199 	if (error)
1200 		log_warnx("%s: %s", __func__, error->msg);
1201 done:
1202 	return error;
1203 }
1204 
1205 static const struct got_error *
1206 gotweb_render_tag(struct request *c)
1207 {
1208 	const struct got_error *error = NULL;
1209 	struct repo_tag *rt = NULL;
1210 	struct transport *t = c->t;
1211 	char *tagname = NULL, *age = NULL, *author = NULL, *msg = NULL;
1212 
1213 	error = got_get_repo_tags(c, 1);
1214 	if (error)
1215 		goto done;
1216 
1217 	if (t->tag_count == 0) {
1218 		error = got_error_set_errno(GOT_ERR_BAD_OBJ_ID,
1219 		    "bad commit id");
1220 		goto done;
1221 	}
1222 
1223 	rt = TAILQ_LAST(&t->repo_tags, repo_tags_head);
1224 
1225 	error = gotweb_get_time_str(&age, rt->tagger_time, TM_LONG);
1226 	if (error)
1227 		goto done;
1228 	error = gotweb_escape_html(&author, rt->tagger);
1229 	if (error)
1230 		goto done;
1231 	error = gotweb_escape_html(&msg, rt->commit_msg);
1232 	if (error)
1233 		goto done;
1234 
1235 	tagname = rt->tag_name;
1236 	if (strncmp(tagname, "refs/", 5) == 0)
1237 		tagname += 5;
1238 	error = gotweb_escape_html(&tagname, tagname);
1239 	if (error)
1240 		goto done;
1241 
1242 	fcgi_printf(c, "<div id='tags_title_wrapper'>\n"
1243 	    "<div id='tags_title'>Tag</div>\n"
1244 	    "</div>\n"		/* #tags_title_wrapper */
1245 	    "<div id='tags_content'>\n"
1246 	    "<div id='tag_header_wrapper'>\n"
1247 	    "<div id='tag_header'>\n"
1248 	    "<div class='header_commit_title'>Commit:</div>\n"
1249 	    "<div class='header_commit'>%s"
1250 	    " <span class='refs_str'>(%s)</span></div>\n"
1251 	    "<div class='header_author_title'>Tagger:</div>\n"
1252 	    "<div class='header_author'>%s</div>\n"
1253 	    "<div class='header_age_title'>Date:</div>\n"
1254 	    "<div class='header_age'>%s</div>\n"
1255 	    "<div id='header_commit_msg_title'>Message:</div>\n"
1256 	    "<div id='header_commit_msg'>%s</div>\n"
1257 	    "</div>\n"		/* #tag_header */
1258 	    "<div class='dotted_line'></div>\n"
1259 	    "<div id='tag_commit'>\n%s</div>"
1260 	    "</div>"		/* #tag_header_wrapper */
1261 	    "</div>",		/* #tags_content */
1262 	    rt->commit_id,
1263 	    tagname,
1264 	    author,
1265 	    age,
1266 	    msg,
1267 	    rt->tag_commit);
1268 
1269 done:
1270 	free(age);
1271 	free(author);
1272 	free(msg);
1273 	return error;
1274 }
1275 
1276 static const struct got_error *
1277 gotweb_render_tags(struct request *c)
1278 {
1279 	const struct got_error *error = NULL;
1280 	struct repo_tag *rt = NULL;
1281 	struct server *srv = c->srv;
1282 	struct transport *t = c->t;
1283 	struct querystring *qs = t->qs;
1284 	struct repo_dir *repo_dir = t->repo_dir;
1285 	char *age = NULL, *tagname = NULL, *msg = NULL, *newline;
1286 	int r, commit_found = 0;
1287 
1288 	if (qs->action == BRIEFS) {
1289 		qs->action = TAGS;
1290 		error = got_get_repo_tags(c, D_MAXSLCOMMDISP);
1291 	} else
1292 		error = got_get_repo_tags(c, srv->max_commits_display);
1293 	if (error)
1294 		goto done;
1295 
1296 	r = fcgi_printf(c, "<div id='tags_title_wrapper'>\n"
1297 	    "<div id='tags_title'>Tags</div>\n"
1298 	    "</div>\n"		/* #tags_title_wrapper */
1299 	    "<div id='tags_content'>\n");
1300 	if (r == -1)
1301 		goto done;
1302 
1303 	if (t->tag_count == 0) {
1304 		r = fcgi_printf(c, "<div id='err_content'>%s\n</div>\n",
1305 		    "This repository contains no tags");
1306 		if (r == -1)
1307 			goto done;
1308 	}
1309 
1310 	TAILQ_FOREACH(rt, &t->repo_tags, entry) {
1311 		if (commit_found == 0 && qs->commit != NULL) {
1312 			if (strcmp(qs->commit, rt->commit_id) != 0)
1313 				continue;
1314 			else
1315 				commit_found = 1;
1316 		}
1317 		error = gotweb_get_time_str(&age, rt->tagger_time, TM_DIFF);
1318 		if (error)
1319 			goto done;
1320 
1321 		tagname = rt->tag_name;
1322 		if (strncmp(tagname, "refs/tags/", 10) == 0)
1323 			tagname += 10;
1324 		error = gotweb_escape_html(&tagname, tagname);
1325 		if (error)
1326 			goto done;
1327 
1328 		if (rt->tag_commit != NULL) {
1329 			newline = strchr(rt->tag_commit, '\n');
1330 			if (newline)
1331 				*newline = '\0';
1332 			error = gotweb_escape_html(&msg, rt->tag_commit);
1333 			if (error)
1334 				goto done;
1335 		}
1336 
1337 		if (fcgi_printf(c, "<div class='tag_age'>%s</div>\n"
1338 		    "<div class='tag'>%s</div>\n"
1339 		    "<div class='tag_log'>", age, tagname) == -1)
1340 			goto done;
1341 
1342 		r = gotweb_link(c, &(struct gotweb_url){
1343 			.action = TAG,
1344 			.index_page = -1,
1345 			.page = -1,
1346 			.path = repo_dir->name,
1347 			.commit = rt->commit_id,
1348 		    }, "%s", msg ? msg : "");
1349 		if (r == -1)
1350 			goto done;
1351 
1352 		if (fcgi_printf(c, "</div>\n"	/* .tag_log */
1353 		    "<div class='navs_wrapper'>\n"
1354 		    "<div class='navs'>") == -1)
1355 			goto done;
1356 
1357 		r = gotweb_link(c, &(struct gotweb_url){
1358 			.action = TAG,
1359 			.index_page = -1,
1360 			.page = -1,
1361 			.path = repo_dir->name,
1362 			.commit = rt->commit_id,
1363 		    }, "tag");
1364 		if (r == -1)
1365 			goto done;
1366 
1367 		if (fcgi_printf(c, " | ") == -1)
1368 			goto done;
1369 
1370 		r = gotweb_link(c, &(struct gotweb_url){
1371 			.action = BRIEFS,
1372 			.index_page = -1,
1373 			.page = -1,
1374 			.path = repo_dir->name,
1375 			.commit = rt->commit_id,
1376 		    }, "commit briefs");
1377 		if (r == -1)
1378 			goto done;
1379 
1380 		if (fcgi_printf(c, " | ") == -1)
1381 			goto done;
1382 
1383 		r = gotweb_link(c, &(struct gotweb_url){
1384 			.action = COMMITS,
1385 			.index_page = -1,
1386 			.page = -1,
1387 			.path = repo_dir->name,
1388 			.commit = rt->commit_id,
1389 		    }, "commits");
1390 		if (r == -1)
1391 			goto done;
1392 
1393 		r = fcgi_printf(c,
1394 		    "</div>\n"	/* .navs */
1395 		    "</div>\n"	/* .navs_wrapper */
1396 		    "<div class='dotted_line'></div>\n");
1397 		if (r == -1)
1398 			goto done;
1399 
1400 		free(age);
1401 		age = NULL;
1402 		free(tagname);
1403 		tagname = NULL;
1404 		free(msg);
1405 		msg = NULL;
1406 	}
1407 	if (t->next_id || t->prev_id) {
1408 		if (gotweb_render_navs(c->tp) == -1)
1409 			goto done;
1410 	}
1411 	fcgi_printf(c, "</div>\n"); /* #tags_content */
1412 done:
1413 	free(age);
1414 	free(tagname);
1415 	free(msg);
1416 	return error;
1417 }
1418 
1419 const struct got_error *
1420 gotweb_escape_html(char **escaped_html, const char *orig_html)
1421 {
1422 	const struct got_error *error = NULL;
1423 	struct escape_pair {
1424 		char c;
1425 		const char *s;
1426 	} esc[] = {
1427 		{ '>', "&gt;" },
1428 		{ '<', "&lt;" },
1429 		{ '&', "&amp;" },
1430 		{ '"', "&quot;" },
1431 		{ '\'', "&apos;" },
1432 		{ '\n', "<br />" },
1433 	};
1434 	size_t orig_len, len;
1435 	int i, j, x;
1436 
1437 	orig_len = strlen(orig_html);
1438 	len = orig_len;
1439 	for (i = 0; i < orig_len; i++) {
1440 		for (j = 0; j < nitems(esc); j++) {
1441 			if (orig_html[i] != esc[j].c)
1442 				continue;
1443 			len += strlen(esc[j].s) - 1 /* escaped char */;
1444 		}
1445 	}
1446 
1447 	*escaped_html = calloc(len + 1 /* NUL */, sizeof(**escaped_html));
1448 	if (*escaped_html == NULL)
1449 		return got_error_from_errno("calloc");
1450 
1451 	x = 0;
1452 	for (i = 0; i < orig_len; i++) {
1453 		int escaped = 0;
1454 		for (j = 0; j < nitems(esc); j++) {
1455 			if (orig_html[i] != esc[j].c)
1456 				continue;
1457 
1458 			if (strlcat(*escaped_html, esc[j].s, len + 1)
1459 			    >= len + 1) {
1460 				error = got_error(GOT_ERR_NO_SPACE);
1461 				goto done;
1462 			}
1463 			x += strlen(esc[j].s);
1464 			escaped = 1;
1465 			break;
1466 		}
1467 		if (!escaped) {
1468 			(*escaped_html)[x] = orig_html[i];
1469 			x++;
1470 		}
1471 	}
1472 done:
1473 	if (error) {
1474 		free(*escaped_html);
1475 		*escaped_html = NULL;
1476 	} else {
1477 		(*escaped_html)[x] = '\0';
1478 	}
1479 
1480 	return error;
1481 }
1482 
1483 static inline int
1484 should_urlencode(int c)
1485 {
1486 	if (c <= ' ' || c >= 127)
1487 		return 1;
1488 
1489 	switch (c) {
1490 		/* gen-delim */
1491 	case ':':
1492 	case '/':
1493 	case '?':
1494 	case '#':
1495 	case '[':
1496 	case ']':
1497 	case '@':
1498 		/* sub-delims */
1499 	case '!':
1500 	case '$':
1501 	case '&':
1502 	case '\'':
1503 	case '(':
1504 	case ')':
1505 	case '*':
1506 	case '+':
1507 	case ',':
1508 	case ';':
1509 	case '=':
1510 		/* needed because the URLs are embedded into the HTML */
1511 	case '\"':
1512 		return 1;
1513 	default:
1514 		return 0;
1515 	}
1516 }
1517 
1518 static char *
1519 gotweb_urlencode(const char *str)
1520 {
1521 	const char *s;
1522 	char *escaped;
1523 	size_t i, len;
1524 	int a, b;
1525 
1526 	len = 0;
1527 	for (s = str; *s; ++s) {
1528 		len++;
1529 		if (should_urlencode(*s))
1530 			len += 2;
1531 	}
1532 
1533 	escaped = calloc(1, len + 1);
1534 	if (escaped == NULL)
1535 		return NULL;
1536 
1537 	i = 0;
1538 	for (s = str; *s; ++s) {
1539 		if (should_urlencode(*s)) {
1540 			a = (*s & 0xF0) >> 4;
1541 			b = (*s & 0x0F);
1542 
1543 			escaped[i++] = '%';
1544 			escaped[i++] = a <= 9 ? ('0' + a) : ('7' + a);
1545 			escaped[i++] = b <= 9 ? ('0' + b) : ('7' + b);
1546 		} else
1547 			escaped[i++] = *s;
1548 	}
1549 
1550 	return escaped;
1551 }
1552 
1553 const char *
1554 gotweb_action_name(int action)
1555 {
1556 	switch (action) {
1557 	case BLAME:
1558 		return "blame";
1559 	case BLOB:
1560 		return "blob";
1561 	case BLOBRAW:
1562 		return "blobraw";
1563 	case BRIEFS:
1564 		return "briefs";
1565 	case COMMITS:
1566 		return "commits";
1567 	case DIFF:
1568 		return "diff";
1569 	case ERR:
1570 		return "err";
1571 	case INDEX:
1572 		return "index";
1573 	case SUMMARY:
1574 		return "summary";
1575 	case TAG:
1576 		return "tag";
1577 	case TAGS:
1578 		return "tags";
1579 	case TREE:
1580 		return "tree";
1581 	case RSS:
1582 		return "rss";
1583 	default:
1584 		return NULL;
1585 	}
1586 }
1587 
1588 int
1589 gotweb_render_url(struct request *c, struct gotweb_url *url)
1590 {
1591 	const char *sep = "?", *action;
1592 	char *tmp;
1593 	int r;
1594 
1595 	action = gotweb_action_name(url->action);
1596 	if (action != NULL) {
1597 		if (fcgi_printf(c, "?action=%s", action) == -1)
1598 			return -1;
1599 		sep = "&";
1600 	}
1601 
1602 	if (url->commit) {
1603 		if (fcgi_printf(c, "%scommit=%s", sep, url->commit) == -1)
1604 			return -1;
1605 		sep = "&";
1606 	}
1607 
1608 	if (url->previd) {
1609 		if (fcgi_printf(c, "%sprevid=%s", sep, url->previd) == -1)
1610 			return -1;
1611 		sep = "&";
1612 	}
1613 
1614 	if (url->prevset) {
1615 		if (fcgi_printf(c, "%sprevset=%s", sep, url->prevset) == -1)
1616 			return -1;
1617 		sep = "&";
1618 	}
1619 
1620 	if (url->file) {
1621 		tmp = gotweb_urlencode(url->file);
1622 		if (tmp == NULL)
1623 			return -1;
1624 		r = fcgi_printf(c, "%sfile=%s", sep, tmp);
1625 		free(tmp);
1626 		if (r == -1)
1627 			return -1;
1628 		sep = "&";
1629 	}
1630 
1631 	if (url->folder) {
1632 		tmp = gotweb_urlencode(url->folder);
1633 		if (tmp == NULL)
1634 			return -1;
1635 		r = fcgi_printf(c, "%sfolder=%s", sep, tmp);
1636 		free(tmp);
1637 		if (r == -1)
1638 			return -1;
1639 		sep = "&";
1640 	}
1641 
1642 	if (url->headref) {
1643 		tmp = gotweb_urlencode(url->headref);
1644 		if (tmp == NULL)
1645 			return -1;
1646 		r = fcgi_printf(c, "%sheadref=%s", sep, url->headref);
1647 		free(tmp);
1648 		if (r == -1)
1649 			return -1;
1650 		sep = "&";
1651 	}
1652 
1653 	if (url->index_page != -1) {
1654 		if (fcgi_printf(c, "%sindex_page=%d", sep,
1655 		    url->index_page) == -1)
1656 			return -1;
1657 		sep = "&";
1658 	}
1659 
1660 	if (url->path) {
1661 		tmp = gotweb_urlencode(url->path);
1662 		if (tmp == NULL)
1663 			return -1;
1664 		r = fcgi_printf(c, "%spath=%s", sep, tmp);
1665 		free(tmp);
1666 		if (r == -1)
1667 			return -1;
1668 		sep = "&";
1669 	}
1670 
1671 	if (url->page != -1) {
1672 		if (fcgi_printf(c, "%spage=%d", sep, url->page) == -1)
1673 			return -1;
1674 		sep = "&";
1675 	}
1676 
1677 	return 0;
1678 }
1679 
1680 int
1681 gotweb_render_absolute_url(struct request *c, struct gotweb_url *url)
1682 {
1683 	struct template	*tp = c->tp;
1684 	const char	*proto = c->https ? "https" : "http";
1685 
1686 	if (fcgi_puts(tp, proto) == -1 ||
1687 	    fcgi_puts(tp, "://") == -1 ||
1688 	    tp_htmlescape(tp, c->server_name) == -1 ||
1689 	    tp_htmlescape(tp, c->document_uri) == -1)
1690 		return -1;
1691 
1692 	return gotweb_render_url(c, url);
1693 }
1694 
1695 int
1696 gotweb_link(struct request *c, struct gotweb_url *url, const char *fmt, ...)
1697 {
1698 	va_list ap;
1699 	int r;
1700 
1701 	if (fcgi_printf(c, "<a href='") == -1)
1702 		return -1;
1703 
1704 	if (gotweb_render_url(c, url) == -1)
1705 		return -1;
1706 
1707 	if (fcgi_printf(c, "'>") == -1)
1708 		return -1;
1709 
1710 	va_start(ap, fmt);
1711 	r = fcgi_vprintf(c, fmt, ap);
1712 	va_end(ap);
1713 	if (r == -1)
1714 		return -1;
1715 
1716 	if (fcgi_printf(c, "</a>"))
1717 		return -1;
1718 	return 0;
1719 }
1720 
1721 static struct got_repository *
1722 find_cached_repo(struct server *srv, const char *path)
1723 {
1724 	int i;
1725 
1726 	for (i = 0; i < srv->ncached_repos; i++) {
1727 		if (strcmp(srv->cached_repos[i].path, path) == 0)
1728 			return srv->cached_repos[i].repo;
1729 	}
1730 
1731 	return NULL;
1732 }
1733 
1734 static const struct got_error *
1735 cache_repo(struct got_repository **new, struct server *srv,
1736     struct repo_dir *repo_dir, struct socket *sock)
1737 {
1738 	const struct got_error *error = NULL;
1739 	struct got_repository *repo;
1740 	struct cached_repo *cr;
1741 	int evicted = 0;
1742 
1743 	if (srv->ncached_repos >= GOTWEBD_REPO_CACHESIZE) {
1744 		cr = &srv->cached_repos[srv->ncached_repos - 1];
1745 		error = got_repo_close(cr->repo);
1746 		memset(cr, 0, sizeof(*cr));
1747 		srv->ncached_repos--;
1748 		if (error)
1749 			return error;
1750 		memmove(&srv->cached_repos[1], &srv->cached_repos[0],
1751 		    srv->ncached_repos * sizeof(srv->cached_repos[0]));
1752 		cr = &srv->cached_repos[0];
1753 		evicted = 1;
1754 	} else {
1755 		cr = &srv->cached_repos[srv->ncached_repos];
1756 	}
1757 
1758 	error = got_repo_open(&repo, repo_dir->path, NULL, sock->pack_fds);
1759 	if (error) {
1760 		if (evicted) {
1761 			memmove(&srv->cached_repos[0], &srv->cached_repos[1],
1762 			    srv->ncached_repos * sizeof(srv->cached_repos[0]));
1763 		}
1764 		return error;
1765 	}
1766 
1767 	if (strlcpy(cr->path, repo_dir->path, sizeof(cr->path))
1768 	    >= sizeof(cr->path)) {
1769 		if (evicted) {
1770 			memmove(&srv->cached_repos[0], &srv->cached_repos[1],
1771 			    srv->ncached_repos * sizeof(srv->cached_repos[0]));
1772 		}
1773 		return got_error(GOT_ERR_NO_SPACE);
1774 	}
1775 
1776 	cr->repo = repo;
1777 	srv->ncached_repos++;
1778 	*new = repo;
1779 	return NULL;
1780 }
1781 
1782 static const struct got_error *
1783 gotweb_load_got_path(struct request *c, struct repo_dir *repo_dir)
1784 {
1785 	const struct got_error *error = NULL;
1786 	struct socket *sock = c->sock;
1787 	struct server *srv = c->srv;
1788 	struct transport *t = c->t;
1789 	struct got_repository *repo = NULL;
1790 	DIR *dt;
1791 	char *dir_test;
1792 
1793 	if (asprintf(&dir_test, "%s/%s/%s", srv->repos_path, repo_dir->name,
1794 	    GOTWEB_GIT_DIR) == -1)
1795 		return got_error_from_errno("asprintf");
1796 
1797 	dt = opendir(dir_test);
1798 	if (dt == NULL) {
1799 		free(dir_test);
1800 	} else {
1801 		repo_dir->path = dir_test;
1802 		dir_test = NULL;
1803 		goto done;
1804 	}
1805 
1806 	if (asprintf(&dir_test, "%s/%s", srv->repos_path,
1807 	    repo_dir->name) == -1)
1808 		return got_error_from_errno("asprintf");
1809 
1810 	dt = opendir(dir_test);
1811 	if (dt == NULL) {
1812 		error = got_error_path(repo_dir->name, GOT_ERR_NOT_GIT_REPO);
1813 		goto err;
1814 	} else {
1815 		repo_dir->path = dir_test;
1816 		dir_test = NULL;
1817 	}
1818 
1819 done:
1820 	if (srv->respect_exportok &&
1821 	    faccessat(dirfd(dt), "git-daemon-export-ok", F_OK, 0) == -1) {
1822 		error = got_error_path(repo_dir->name, GOT_ERR_NOT_GIT_REPO);
1823 		goto err;
1824 	}
1825 
1826 	repo = find_cached_repo(srv, repo_dir->path);
1827 	if (repo == NULL) {
1828 		error = cache_repo(&repo, srv, repo_dir, sock);
1829 		if (error)
1830 			goto err;
1831 	}
1832 	t->repo = repo;
1833 	error = gotweb_get_repo_description(&repo_dir->description, srv,
1834 	    repo_dir->path, dirfd(dt));
1835 	if (error)
1836 		goto err;
1837 	error = got_get_repo_owner(&repo_dir->owner, c);
1838 	if (error)
1839 		goto err;
1840 	error = got_get_repo_age(&repo_dir->age, c, NULL, TM_DIFF);
1841 	if (error)
1842 		goto err;
1843 	error = gotweb_get_clone_url(&repo_dir->url, srv, repo_dir->path,
1844 	    dirfd(dt));
1845 err:
1846 	free(dir_test);
1847 	if (dt != NULL && closedir(dt) == EOF && error == NULL)
1848 		error = got_error_from_errno("closedir");
1849 	return error;
1850 }
1851 
1852 static const struct got_error *
1853 gotweb_init_repo_dir(struct repo_dir **repo_dir, const char *dir)
1854 {
1855 	const struct got_error *error;
1856 
1857 	*repo_dir = calloc(1, sizeof(**repo_dir));
1858 	if (*repo_dir == NULL)
1859 		return got_error_from_errno("calloc");
1860 
1861 	if (asprintf(&(*repo_dir)->name, "%s", dir) == -1) {
1862 		error = got_error_from_errno("asprintf");
1863 		free(*repo_dir);
1864 		*repo_dir = NULL;
1865 		return error;
1866 	}
1867 	(*repo_dir)->owner = NULL;
1868 	(*repo_dir)->description = NULL;
1869 	(*repo_dir)->url = NULL;
1870 	(*repo_dir)->age = NULL;
1871 	(*repo_dir)->path = NULL;
1872 
1873 	return NULL;
1874 }
1875 
1876 static const struct got_error *
1877 gotweb_get_repo_description(char **description, struct server *srv,
1878     const char *dirpath, int dir)
1879 {
1880 	const struct got_error *error = NULL;
1881 	struct stat sb;
1882 	int fd = -1;
1883 	off_t len;
1884 
1885 	*description = NULL;
1886 	if (srv->show_repo_description == 0)
1887 		return NULL;
1888 
1889 	fd = openat(dir, "description", O_RDONLY);
1890 	if (fd == -1) {
1891 		if (errno != ENOENT && errno != EACCES) {
1892 			error = got_error_from_errno_fmt("openat %s/%s",
1893 			    dirpath, "description");
1894 		}
1895 		goto done;
1896 	}
1897 
1898 	if (fstat(fd, &sb) == -1) {
1899 		error = got_error_from_errno_fmt("fstat %s/%s",
1900 		    dirpath, "description");
1901 		goto done;
1902 	}
1903 
1904 	len = sb.st_size;
1905 	if (len > GOTWEBD_MAXDESCRSZ - 1)
1906 		len = GOTWEBD_MAXDESCRSZ - 1;
1907 
1908 	*description = calloc(len + 1, sizeof(**description));
1909 	if (*description == NULL) {
1910 		error = got_error_from_errno("calloc");
1911 		goto done;
1912 	}
1913 
1914 	if (read(fd, *description, len) == -1)
1915 		error = got_error_from_errno("read");
1916 done:
1917 	if (fd != -1 && close(fd) == -1 && error == NULL)
1918 		error = got_error_from_errno("close");
1919 	return error;
1920 }
1921 
1922 static const struct got_error *
1923 gotweb_get_clone_url(char **url, struct server *srv, const char *dirpath,
1924     int dir)
1925 {
1926 	const struct got_error *error = NULL;
1927 	struct stat sb;
1928 	int fd = -1;
1929 	off_t len;
1930 
1931 	*url = NULL;
1932 	if (srv->show_repo_cloneurl == 0)
1933 		return NULL;
1934 
1935 	fd = openat(dir, "cloneurl", O_RDONLY);
1936 	if (fd == -1) {
1937 		if (errno != ENOENT && errno != EACCES) {
1938 			error = got_error_from_errno_fmt("openat %s/%s",
1939 			    dirpath, "cloneurl");
1940 		}
1941 		goto done;
1942 	}
1943 
1944 	if (fstat(fd, &sb) == -1) {
1945 		error = got_error_from_errno_fmt("fstat %s/%s",
1946 		    dirpath, "cloneurl");
1947 		goto done;
1948 	}
1949 
1950 	len = sb.st_size;
1951 	if (len > GOTWEBD_MAXCLONEURLSZ - 1)
1952 		len = GOTWEBD_MAXCLONEURLSZ - 1;
1953 
1954 	*url = calloc(len + 1, sizeof(**url));
1955 	if (*url == NULL) {
1956 		error = got_error_from_errno("calloc");
1957 		goto done;
1958 	}
1959 
1960 	if (read(fd, *url, len) == -1)
1961 		error = got_error_from_errno("read");
1962 done:
1963 	if (fd != -1 && close(fd) == -1 && error == NULL)
1964 		error = got_error_from_errno("close");
1965 	return error;
1966 }
1967 
1968 const struct got_error *
1969 gotweb_get_time_str(char **repo_age, time_t committer_time, int ref_tm)
1970 {
1971 	struct tm tm;
1972 	long long diff_time;
1973 	const char *years = "years ago", *months = "months ago";
1974 	const char *weeks = "weeks ago", *days = "days ago";
1975 	const char *hours = "hours ago",  *minutes = "minutes ago";
1976 	const char *seconds = "seconds ago", *now = "right now";
1977 	char *s;
1978 	char datebuf[64];
1979 	size_t r;
1980 
1981 	*repo_age = NULL;
1982 
1983 	switch (ref_tm) {
1984 	case TM_DIFF:
1985 		diff_time = time(NULL) - committer_time;
1986 		if (diff_time > 60 * 60 * 24 * 365 * 2) {
1987 			if (asprintf(repo_age, "%lld %s",
1988 			    (diff_time / 60 / 60 / 24 / 365), years) == -1)
1989 				return got_error_from_errno("asprintf");
1990 		} else if (diff_time > 60 * 60 * 24 * (365 / 12) * 2) {
1991 			if (asprintf(repo_age, "%lld %s",
1992 			    (diff_time / 60 / 60 / 24 / (365 / 12)),
1993 			    months) == -1)
1994 				return got_error_from_errno("asprintf");
1995 		} else if (diff_time > 60 * 60 * 24 * 7 * 2) {
1996 			if (asprintf(repo_age, "%lld %s",
1997 			    (diff_time / 60 / 60 / 24 / 7), weeks) == -1)
1998 				return got_error_from_errno("asprintf");
1999 		} else if (diff_time > 60 * 60 * 24 * 2) {
2000 			if (asprintf(repo_age, "%lld %s",
2001 			    (diff_time / 60 / 60 / 24), days) == -1)
2002 				return got_error_from_errno("asprintf");
2003 		} else if (diff_time > 60 * 60 * 2) {
2004 			if (asprintf(repo_age, "%lld %s",
2005 			    (diff_time / 60 / 60), hours) == -1)
2006 				return got_error_from_errno("asprintf");
2007 		} else if (diff_time > 60 * 2) {
2008 			if (asprintf(repo_age, "%lld %s", (diff_time / 60),
2009 			    minutes) == -1)
2010 				return got_error_from_errno("asprintf");
2011 		} else if (diff_time > 2) {
2012 			if (asprintf(repo_age, "%lld %s", diff_time,
2013 			    seconds) == -1)
2014 				return got_error_from_errno("asprintf");
2015 		} else {
2016 			if (asprintf(repo_age, "%s", now) == -1)
2017 				return got_error_from_errno("asprintf");
2018 		}
2019 		break;
2020 	case TM_LONG:
2021 		if (gmtime_r(&committer_time, &tm) == NULL)
2022 			return got_error_from_errno("gmtime_r");
2023 
2024 		s = asctime_r(&tm, datebuf);
2025 		if (s == NULL)
2026 			return got_error_from_errno("asctime_r");
2027 
2028 		if (asprintf(repo_age, "%s UTC", datebuf) == -1)
2029 			return got_error_from_errno("asprintf");
2030 		break;
2031 	case TM_RFC822:
2032 		if (gmtime_r(&committer_time, &tm) == NULL)
2033 			return got_error_from_errno("gmtime_r");
2034 
2035 		r = strftime(datebuf, sizeof(datebuf),
2036 		    "%a, %d %b %Y %H:%M:%S GMT", &tm);
2037 		if (r == 0)
2038 			return got_error(GOT_ERR_NO_SPACE);
2039 
2040 		*repo_age = strdup(datebuf);
2041 		if (*repo_age == NULL)
2042 			return got_error_from_errno("asprintf");
2043 		break;
2044 	}
2045 	return NULL;
2046 }