1 /*
2  * Copyright (c) 2016, 2019, 2020-2022 Tracey Emery <tracey@traceyemery.net>
3  * Copyright (c) 2015 Mike Larkin <mlarkin@openbsd.org>
4  * Copyright (c) 2014 Reyk Floeter <reyk@openbsd.org>
5  * Copyright (c) 2013 David Gwynne <dlg@openbsd.org>
6  * Copyright (c) 2013 Florian Obser <florian@openbsd.org>
7  *
8  * Permission to use, copy, modify, and distribute this software for any
9  * purpose with or without fee is hereby granted, provided that the above
10  * copyright notice and this permission notice appear in all copies.
11  *
12  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
13  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
14  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
15  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
16  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
17  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
18  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
19  */
20 
21 #include <net/if.h>
22 #include <netinet/in.h>
23 #include <sys/queue.h>
24 #include <sys/stat.h>
25 #include <sys/types.h>
26 
27 #include <ctype.h>
28 #include <dirent.h>
29 #include <errno.h>
30 #include <event.h>
31 #include <fcntl.h>
32 #include <imsg.h>
33 #include <sha1.h>
34 #include <sha2.h>
35 #include <stdio.h>
36 #include <stdlib.h>
37 #include <string.h>
38 #include <unistd.h>
39 
40 #include "got_error.h"
41 #include "got_object.h"
42 #include "got_reference.h"
43 #include "got_repository.h"
44 #include "got_path.h"
45 #include "got_cancel.h"
46 #include "got_worktree.h"
47 #include "got_diff.h"
48 #include "got_commit_graph.h"
49 #include "got_blame.h"
50 #include "got_privsep.h"
51 
52 #include "gotwebd.h"
53 #include "tmpl.h"
54 
55 static const struct querystring_keys querystring_keys[] = {
56 	{ "action",		ACTION },
57 	{ "commit",		COMMIT },
58 	{ "file",		RFILE },
59 	{ "folder",		FOLDER },
60 	{ "headref",		HEADREF },
61 	{ "index_page",		INDEX_PAGE },
62 	{ "path",		PATH },
63 	{ "page",		PAGE },
64 };
65 
66 static const struct action_keys action_keys[] = {
67 	{ "blame",	BLAME },
68 	{ "blob",	BLOB },
69 	{ "blobraw",	BLOBRAW },
70 	{ "briefs",	BRIEFS },
71 	{ "commits",	COMMITS },
72 	{ "diff",	DIFF },
73 	{ "error",	ERR },
74 	{ "index",	INDEX },
75 	{ "patch",	PATCH },
76 	{ "summary",	SUMMARY },
77 	{ "tag",	TAG },
78 	{ "tags",	TAGS },
79 	{ "tree",	TREE },
80 	{ "rss",	RSS },
81 };
82 
83 static const struct got_error *gotweb_init_querystring(struct querystring **);
84 static const struct got_error *gotweb_parse_querystring(struct querystring **,
85     char *);
86 static const struct got_error *gotweb_assign_querystring(struct querystring **,
87     char *, char *);
88 static int gotweb_render_index(struct template *);
89 static const struct got_error *gotweb_init_repo_dir(struct repo_dir **,
90     const char *);
91 static const struct got_error *gotweb_load_got_path(struct request *c,
92     struct repo_dir *);
93 static const struct got_error *gotweb_get_repo_description(char **,
94     struct server *, const char *, int);
95 static const struct got_error *gotweb_get_clone_url(char **, struct server *,
96     const char *, int);
97 
98 static void gotweb_free_querystring(struct querystring *);
99 static void gotweb_free_repo_dir(struct repo_dir *);
100 
101 struct server *gotweb_get_server(const char *);
102 
103 static int
104 gotweb_reply(struct request *c, int status, const char *ctype,
105     struct gotweb_url *location)
106 {
107 	const char	*csp;
108 
109 	if (status != 200 && tp_writef(c->tp, "Status: %d\r\n", status) == -1)
110 		return -1;
111 
112 	if (location) {
113 		if (tp_writes(c->tp, "Location: ") == -1 ||
114 		    gotweb_render_url(c, location) == -1 ||
115 		    tp_writes(c->tp, "\r\n") == -1)
116 			return -1;
117 	}
118 
119 	csp = "Content-Security-Policy: default-src 'self'; "
120 	    "script-src 'none'; object-src 'none';\r\n";
121 	if (tp_writes(c->tp, csp) == -1)
122 		return -1;
123 
124 	if (ctype && tp_writef(c->tp, "Content-Type: %s\r\n", ctype) == -1)
125 		return -1;
126 
127 	return tp_writes(c->tp, "\r\n");
128 }
129 
130 static int
131 gotweb_reply_file(struct request *c, const char *ctype, const char *file,
132     const char *suffix)
133 {
134 	int r;
135 
136 	r = tp_writef(c->tp, "Content-Disposition: attachment; "
137 	    "filename=%s%s\r\n", file, suffix ? suffix : "");
138 	if (r == -1)
139 		return -1;
140 	return gotweb_reply(c, 200, ctype, NULL);
141 }
142 
143 void
144 gotweb_process_request(struct request *c)
145 {
146 	const struct got_error *error = NULL;
147 	struct server *srv = NULL;
148 	struct querystring *qs = NULL;
149 	struct repo_dir *repo_dir = NULL;
150 	const char *rss_ctype = "application/rss+xml;charset=utf-8";
151 	const uint8_t *buf;
152 	size_t len;
153 	int r, binary = 0;
154 
155 	/* init the transport */
156 	error = gotweb_init_transport(&c->t);
157 	if (error) {
158 		log_warnx("%s: %s", __func__, error->msg);
159 		return;
160 	}
161 	/* don't process any further if client disconnected */
162 	if (c->sock->client_status == CLIENT_DISCONNECT)
163 		return;
164 	/* get the gotwebd server */
165 	srv = gotweb_get_server(c->server_name);
166 	if (srv == NULL) {
167 		log_warnx("%s: error server is NULL", __func__);
168 		goto err;
169 	}
170 	c->srv = srv;
171 	/* parse our querystring */
172 	error = gotweb_init_querystring(&qs);
173 	if (error) {
174 		log_warnx("%s: %s", __func__, error->msg);
175 		goto err;
176 	}
177 	c->t->qs = qs;
178 	error = gotweb_parse_querystring(&qs, c->querystring);
179 	if (error) {
180 		log_warnx("%s: %s", __func__, error->msg);
181 		goto err;
182 	}
183 
184 	/*
185 	 * certain actions require a commit id in the querystring. this stops
186 	 * bad actors from exploiting this by manually manipulating the
187 	 * querystring.
188 	 */
189 
190 	if (qs->action == BLAME || qs->action == BLOB ||
191 	    qs->action == BLOBRAW || qs->action == DIFF ||
192 	    qs->action == PATCH) {
193 		if (qs->commit == NULL) {
194 			error = got_error(GOT_ERR_BAD_QUERYSTRING);
195 			goto err;
196 		}
197 	}
198 
199 	if (qs->action != INDEX) {
200 		error = gotweb_init_repo_dir(&repo_dir, qs->path);
201 		if (error)
202 			goto err;
203 		error = gotweb_load_got_path(c, repo_dir);
204 		c->t->repo_dir = repo_dir;
205 		if (error && error->code != GOT_ERR_LONELY_PACKIDX)
206 			goto err;
207 	}
208 
209 	if (qs->action == BLOBRAW || qs->action == BLOB) {
210 		error = got_get_repo_commits(c, 1);
211 		if (error)
212 			goto err;
213 
214 		error = got_open_blob_for_output(&c->t->blob, &c->t->fd,
215 		    &binary, c, qs->folder, qs->file, qs->commit);
216 		if (error)
217 			goto err;
218 	}
219 
220 	switch (qs->action) {
221 	case BLAME:
222 		error = got_get_repo_commits(c, 1);
223 		if (error) {
224 			log_warnx("%s: %s", __func__, error->msg);
225 			goto err;
226 		}
227 		if (gotweb_reply(c, 200, "text/html", NULL) == -1)
228 			return;
229 		gotweb_render_page(c->tp, gotweb_render_blame);
230 		return;
231 	case BLOB:
232 		if (binary) {
233 			struct gotweb_url url = {
234 				.index_page = -1,
235 				.page = -1,
236 				.action = BLOBRAW,
237 				.path = qs->path,
238 				.commit = qs->commit,
239 				.folder = qs->folder,
240 				.file = qs->file,
241 			};
242 
243 			gotweb_reply(c, 302, NULL, &url);
244 			return;
245 		}
246 
247 		if (gotweb_reply(c, 200, "text/html", NULL) == -1)
248 			return;
249 		gotweb_render_page(c->tp, gotweb_render_blob);
250 		return;
251 	case BLOBRAW:
252 		if (binary)
253 			r = gotweb_reply_file(c, "application/octet-stream",
254 			    qs->file, NULL);
255 		else
256 			r = gotweb_reply(c, 200, "text/plain", NULL);
257 		if (r == -1)
258 			return;
259 		if (template_flush(c->tp) == -1)
260 			return;
261 
262 		for (;;) {
263 			error = got_object_blob_read_block(&len, c->t->blob);
264 			if (error)
265 				break;
266 			if (len == 0)
267 				break;
268 			buf = got_object_blob_get_read_buf(c->t->blob);
269 			if (fcgi_write(c, buf, len) == -1)
270 				break;
271 		}
272 		return;
273 	case BRIEFS:
274 		error = got_get_repo_commits(c, srv->max_commits_display);
275 		if (error)
276 			goto err;
277 		if (gotweb_reply(c, 200, "text/html", NULL) == -1)
278 			return;
279 		gotweb_render_page(c->tp, gotweb_render_briefs);
280 		return;
281 	case COMMITS:
282 		error = got_get_repo_commits(c, srv->max_commits_display);
283 		if (error) {
284 			log_warnx("%s: %s", __func__, error->msg);
285 			goto err;
286 		}
287 		if (gotweb_reply(c, 200, "text/html", NULL) == -1)
288 			return;
289 		gotweb_render_page(c->tp, gotweb_render_commits);
290 		return;
291 	case DIFF:
292 		error = got_get_repo_commits(c, 1);
293 		if (error) {
294 			log_warnx("%s: %s", __func__, error->msg);
295 			goto err;
296 		}
297 		error = got_open_diff_for_output(&c->t->fp, c);
298 		if (error) {
299 			log_warnx("%s: %s", __func__, error->msg);
300 			goto err;
301 		}
302 		if (gotweb_reply(c, 200, "text/html", NULL) == -1)
303 			return;
304 		gotweb_render_page(c->tp, gotweb_render_diff);
305 		return;
306 	case INDEX:
307 		c->t->nrepos = scandir(srv->repos_path, &c->t->repos, NULL,
308 		    alphasort);
309 		if (c->t->nrepos == -1) {
310 			c->t->repos = NULL;
311 			error = got_error_from_errno2("scandir",
312 			    srv->repos_path);
313 			goto err;
314 		}
315 		if (gotweb_reply(c, 200, "text/html", NULL) == -1)
316 			return;
317 		gotweb_render_page(c->tp, gotweb_render_index);
318 		return;
319 	case PATCH:
320 		error = got_get_repo_commits(c, 1);
321 		if (error) {
322 			log_warnx("%s: %s", __func__, error->msg);
323 			goto err;
324 		}
325 		error = got_open_diff_for_output(&c->t->fp, c);
326 		if (error) {
327 			log_warnx("%s: %s", __func__, error->msg);
328 			goto err;
329 		}
330 		if (gotweb_reply(c, 200, "text/plain", NULL) == -1)
331 			return;
332 		gotweb_render_patch(c->tp);
333 		return;
334 	case RSS:
335 		error = got_get_repo_tags(c, D_MAXSLCOMMDISP);
336 		if (error)
337 			goto err;
338 		if (gotweb_reply_file(c, rss_ctype, repo_dir->name, ".rss")
339 		    == -1)
340 			return;
341 		gotweb_render_rss(c->tp);
342 		return;
343 	case SUMMARY:
344 		error = got_ref_list(&c->t->refs, c->t->repo, "refs/heads",
345 		    got_ref_cmp_by_name, NULL);
346 		if (error) {
347 			log_warnx("%s: got_ref_list: %s", __func__,
348 			    error->msg);
349 			goto err;
350 		}
351 		error = got_get_repo_commits(c, D_MAXSLCOMMDISP);
352 		if (error)
353 			goto err;
354 		qs->action = TAGS;
355 		error = got_get_repo_tags(c, D_MAXSLCOMMDISP);
356 		if (error) {
357 			log_warnx("%s: got_get_repo_tags: %s", __func__,
358 			    error->msg);
359 			goto err;
360 		}
361 		qs->action = SUMMARY;
362 		if (gotweb_reply(c, 200, "text/html", NULL) == -1)
363 			return;
364 		gotweb_render_page(c->tp, gotweb_render_summary);
365 		return;
366 	case TAG:
367 		error = got_get_repo_tags(c, 1);
368 		if (error) {
369 			log_warnx("%s: %s", __func__, error->msg);
370 			goto err;
371 		}
372 		if (c->t->tag_count == 0) {
373 			error = got_error_msg(GOT_ERR_BAD_OBJ_ID,
374 			    "bad commit id");
375 			goto err;
376 		}
377 		if (gotweb_reply(c, 200, "text/html", NULL) == -1)
378 			return;
379 		gotweb_render_page(c->tp, gotweb_render_tag);
380 		return;
381 	case TAGS:
382 		error = got_get_repo_tags(c, srv->max_commits_display);
383 		if (error) {
384 			log_warnx("%s: %s", __func__, error->msg);
385 			goto err;
386 		}
387 		if (gotweb_reply(c, 200, "text/html", NULL) == -1)
388 			return;
389 		gotweb_render_page(c->tp, gotweb_render_tags);
390 		return;
391 	case TREE:
392 		error = got_get_repo_commits(c, 1);
393 		if (error) {
394 			log_warnx("%s: %s", __func__, error->msg);
395 			goto err;
396 		}
397 		if (gotweb_reply(c, 200, "text/html", NULL) == -1)
398 			return;
399 		gotweb_render_page(c->tp, gotweb_render_tree);
400 		return;
401 	case ERR:
402 	default:
403 		error = got_error(GOT_ERR_BAD_QUERYSTRING);
404 	}
405 
406 err:
407 	c->t->error = error;
408 	if (gotweb_reply(c, 400, "text/html", NULL) == -1)
409 		return;
410 	gotweb_render_page(c->tp, gotweb_render_error);
411 }
412 
413 struct server *
414 gotweb_get_server(const char *server_name)
415 {
416 	struct server *srv;
417 
418 	/* check against the server name first */
419 	if (*server_name != '\0')
420 		TAILQ_FOREACH(srv, &gotwebd_env->servers, entry)
421 			if (strcmp(srv->name, server_name) == 0)
422 				return srv;
423 
424 	/* otherwise, use the first server */
425 	return TAILQ_FIRST(&gotwebd_env->servers);
426 };
427 
428 const struct got_error *
429 gotweb_init_transport(struct transport **t)
430 {
431 	const struct got_error *error = NULL;
432 
433 	*t = calloc(1, sizeof(**t));
434 	if (*t == NULL)
435 		return got_error_from_errno2(__func__, "calloc");
436 
437 	TAILQ_INIT(&(*t)->repo_commits);
438 	TAILQ_INIT(&(*t)->repo_tags);
439 	TAILQ_INIT(&(*t)->refs);
440 
441 	(*t)->fd = -1;
442 
443 	return error;
444 }
445 
446 static const struct got_error *
447 gotweb_init_querystring(struct querystring **qs)
448 {
449 	const struct got_error *error = NULL;
450 
451 	*qs = calloc(1, sizeof(**qs));
452 	if (*qs == NULL)
453 		return got_error_from_errno2(__func__, "calloc");
454 
455 	(*qs)->headref = strdup("HEAD");
456 	if ((*qs)->headref == NULL) {
457 		free(*qs);
458 		*qs = NULL;
459 		return got_error_from_errno2(__func__, "strdup");
460 	}
461 
462 	(*qs)->action = INDEX;
463 	(*qs)->commit = NULL;
464 	(*qs)->file = NULL;
465 	(*qs)->folder = NULL;
466 	(*qs)->index_page = 0;
467 	(*qs)->path = NULL;
468 
469 	return error;
470 }
471 
472 static const struct got_error *
473 gotweb_parse_querystring(struct querystring **qs, char *qst)
474 {
475 	const struct got_error *error = NULL;
476 	char *tok1 = NULL, *tok1_pair = NULL, *tok1_end = NULL;
477 	char *tok2 = NULL, *tok2_pair = NULL, *tok2_end = NULL;
478 
479 	if (qst == NULL)
480 		return error;
481 
482 	tok1 = strdup(qst);
483 	if (tok1 == NULL)
484 		return got_error_from_errno2(__func__, "strdup");
485 
486 	tok1_pair = tok1;
487 	tok1_end = tok1;
488 
489 	while (tok1_pair != NULL) {
490 		strsep(&tok1_end, "&");
491 
492 		tok2 = strdup(tok1_pair);
493 		if (tok2 == NULL) {
494 			free(tok1);
495 			return got_error_from_errno2(__func__, "strdup");
496 		}
497 
498 		tok2_pair = tok2;
499 		tok2_end = tok2;
500 
501 		while (tok2_pair != NULL) {
502 			strsep(&tok2_end, "=");
503 			if (tok2_end) {
504 				error = gotweb_assign_querystring(qs, tok2_pair,
505 				    tok2_end);
506 				if (error)
507 					goto err;
508 			}
509 			tok2_pair = tok2_end;
510 		}
511 		free(tok2);
512 		tok1_pair = tok1_end;
513 	}
514 	free(tok1);
515 	return error;
516 err:
517 	free(tok2);
518 	free(tok1);
519 	return error;
520 }
521 
522 /*
523  * Adapted from usr.sbin/httpd/httpd.c url_decode.
524  */
525 static const struct got_error *
526 gotweb_urldecode(char *url)
527 {
528 	char		*p, *q;
529 	char		 hex[3];
530 	unsigned long	 x;
531 
532 	hex[2] = '\0';
533 	p = q = url;
534 
535 	while (*p != '\0') {
536 		switch (*p) {
537 		case '%':
538 			/* Encoding character is followed by two hex chars */
539 			if (!isxdigit((unsigned char)p[1]) ||
540 			    !isxdigit((unsigned char)p[2]) ||
541 			    (p[1] == '0' && p[2] == '0'))
542 				return got_error(GOT_ERR_BAD_QUERYSTRING);
543 
544 			hex[0] = p[1];
545 			hex[1] = p[2];
546 
547 			/*
548 			 * We don't have to validate "hex" because it is
549 			 * guaranteed to include two hex chars followed by nul.
550 			 */
551 			x = strtoul(hex, NULL, 16);
552 			*q = (char)x;
553 			p += 2;
554 			break;
555 		default:
556 			*q = *p;
557 			break;
558 		}
559 		p++;
560 		q++;
561 	}
562 	*q = '\0';
563 
564 	return NULL;
565 }
566 
567 static const struct got_error *
568 gotweb_assign_querystring(struct querystring **qs, char *key, char *value)
569 {
570 	const struct got_error *error = NULL;
571 	const char *errstr;
572 	int a_cnt, el_cnt;
573 
574 	error = gotweb_urldecode(value);
575 	if (error)
576 		return error;
577 
578 	for (el_cnt = 0; el_cnt < nitems(querystring_keys); el_cnt++) {
579 		if (strcmp(key, querystring_keys[el_cnt].name) != 0)
580 			continue;
581 
582 		switch (querystring_keys[el_cnt].element) {
583 		case ACTION:
584 			for (a_cnt = 0; a_cnt < ACTIONS__MAX; a_cnt++) {
585 				if (strcmp(value, action_keys[a_cnt].name) != 0)
586 					continue;
587 				else if (strcmp(value,
588 				    action_keys[a_cnt].name) == 0){
589 					(*qs)->action =
590 					    action_keys[a_cnt].action;
591 					goto qa_found;
592 				}
593 			}
594 			(*qs)->action = ERR;
595 qa_found:
596 			break;
597 		case COMMIT:
598 			(*qs)->commit = strdup(value);
599 			if ((*qs)->commit == NULL) {
600 				error = got_error_from_errno2(__func__,
601 				    "strdup");
602 				goto done;
603 			}
604 			break;
605 		case RFILE:
606 			(*qs)->file = strdup(value);
607 			if ((*qs)->file == NULL) {
608 				error = got_error_from_errno2(__func__,
609 				    "strdup");
610 				goto done;
611 			}
612 			break;
613 		case FOLDER:
614 			(*qs)->folder = strdup(value);
615 			if ((*qs)->folder == NULL) {
616 				error = got_error_from_errno2(__func__,
617 				    "strdup");
618 				goto done;
619 			}
620 			break;
621 		case HEADREF:
622 			free((*qs)->headref);
623 			(*qs)->headref = strdup(value);
624 			if ((*qs)->headref == NULL) {
625 				error = got_error_from_errno2(__func__,
626 				    "strdup");
627 				goto done;
628 			}
629 			break;
630 		case INDEX_PAGE:
631 			if (*value == '\0')
632 				break;
633 			(*qs)->index_page = strtonum(value, INT64_MIN,
634 			    INT64_MAX, &errstr);
635 			if (errstr) {
636 				error = got_error_from_errno3(__func__,
637 				    "strtonum", errstr);
638 				goto done;
639 			}
640 			if ((*qs)->index_page < 0)
641 				(*qs)->index_page = 0;
642 			break;
643 		case PATH:
644 			(*qs)->path = strdup(value);
645 			if ((*qs)->path == NULL) {
646 				error = got_error_from_errno2(__func__,
647 				    "strdup");
648 				goto done;
649 			}
650 			break;
651 		case PAGE:
652 			if (*value == '\0')
653 				break;
654 			(*qs)->page = strtonum(value, INT64_MIN,
655 			    INT64_MAX, &errstr);
656 			if (errstr) {
657 				error = got_error_from_errno3(__func__,
658 				    "strtonum", errstr);
659 				goto done;
660 			}
661 			if ((*qs)->page < 0)
662 				(*qs)->page = 0;
663 			break;
664 		}
665 
666 		/* entry found */
667 		break;
668 	}
669 done:
670 	return error;
671 }
672 
673 void
674 gotweb_free_repo_tag(struct repo_tag *rt)
675 {
676 	if (rt != NULL) {
677 		free(rt->commit_id);
678 		free(rt->tag_name);
679 		free(rt->tag_commit);
680 		free(rt->commit_msg);
681 		free(rt->tagger);
682 	}
683 	free(rt);
684 }
685 
686 void
687 gotweb_free_repo_commit(struct repo_commit *rc)
688 {
689 	if (rc != NULL) {
690 		free(rc->path);
691 		free(rc->refs_str);
692 		free(rc->commit_id);
693 		free(rc->parent_id);
694 		free(rc->tree_id);
695 		free(rc->author);
696 		free(rc->committer);
697 		free(rc->commit_msg);
698 	}
699 	free(rc);
700 }
701 
702 static void
703 gotweb_free_querystring(struct querystring *qs)
704 {
705 	if (qs != NULL) {
706 		free(qs->commit);
707 		free(qs->file);
708 		free(qs->folder);
709 		free(qs->headref);
710 		free(qs->path);
711 	}
712 	free(qs);
713 }
714 
715 static void
716 gotweb_free_repo_dir(struct repo_dir *repo_dir)
717 {
718 	if (repo_dir != NULL) {
719 		free(repo_dir->name);
720 		free(repo_dir->owner);
721 		free(repo_dir->description);
722 		free(repo_dir->url);
723 		free(repo_dir->path);
724 	}
725 	free(repo_dir);
726 }
727 
728 void
729 gotweb_free_transport(struct transport *t)
730 {
731 	const struct got_error *err;
732 	struct repo_commit *rc = NULL, *trc = NULL;
733 	struct repo_tag *rt = NULL, *trt = NULL;
734 	int i;
735 
736 	got_ref_list_free(&t->refs);
737 	TAILQ_FOREACH_SAFE(rc, &t->repo_commits, entry, trc) {
738 		TAILQ_REMOVE(&t->repo_commits, rc, entry);
739 		gotweb_free_repo_commit(rc);
740 	}
741 	TAILQ_FOREACH_SAFE(rt, &t->repo_tags, entry, trt) {
742 		TAILQ_REMOVE(&t->repo_tags, rt, entry);
743 		gotweb_free_repo_tag(rt);
744 	}
745 	gotweb_free_repo_dir(t->repo_dir);
746 	gotweb_free_querystring(t->qs);
747 	free(t->more_id);
748 	free(t->next_id);
749 	free(t->prev_id);
750 	if (t->blob)
751 		got_object_blob_close(t->blob);
752 	if (t->fp) {
753 		err = got_gotweb_closefile(t->fp);
754 		if (err)
755 			log_warnx("%s: got_gotweb_closefile failure: %s",
756 			    __func__, err->msg);
757 	}
758 	if (t->fd != -1 && close(t->fd) == -1)
759 		log_warn("%s: close", __func__);
760 	if (t->repos) {
761 		for (i = 0; i < t->nrepos; ++i)
762 			free(t->repos[i]);
763 		free(t->repos);
764 	}
765 	if (t->repo)
766 		got_repo_close(t->repo);
767 	free(t);
768 }
769 
770 void
771 gotweb_get_navs(struct request *c, struct gotweb_url *prev, int *have_prev,
772     struct gotweb_url *next, int *have_next)
773 {
774 	struct transport *t = c->t;
775 	struct querystring *qs = t->qs;
776 	struct server *srv = c->srv;
777 
778 	*have_prev = *have_next = 0;
779 
780 	switch(qs->action) {
781 	case INDEX:
782 		if (qs->index_page > 0) {
783 			*have_prev = 1;
784 			*prev = (struct gotweb_url){
785 				.action = -1,
786 				.index_page = qs->index_page - 1,
787 				.page = -1,
788 			};
789 		}
790 		if (t->next_disp == srv->max_repos_display &&
791 		    t->repos_total != (qs->index_page + 1) *
792 		    srv->max_repos_display) {
793 			*have_next = 1;
794 			*next = (struct gotweb_url){
795 				.action = -1,
796 				.index_page = qs->index_page + 1,
797 				.page = -1,
798 			};
799 		}
800 		break;
801 	case TAGS:
802 		if (t->prev_id && qs->commit != NULL &&
803 		    strcmp(qs->commit, t->prev_id) != 0) {
804 			*have_prev = 1;
805 			*prev = (struct gotweb_url){
806 				.action = TAGS,
807 				.index_page = -1,
808 				.page = qs->page - 1,
809 				.path = qs->path,
810 				.commit = t->prev_id,
811 				.headref = qs->headref,
812 			};
813 		}
814 		if (t->next_id) {
815 			*have_next = 1;
816 			*next = (struct gotweb_url){
817 				.action = TAGS,
818 				.index_page = -1,
819 				.page = qs->page + 1,
820 				.path = qs->path,
821 				.commit = t->next_id,
822 				.headref = qs->headref,
823 			};
824 		}
825 		break;
826 	}
827 }
828 
829 static int
830 gotweb_render_index(struct template *tp)
831 {
832 	const struct got_error *error = NULL;
833 	struct request *c = tp->tp_arg;
834 	struct server *srv = c->srv;
835 	struct transport *t = c->t;
836 	struct querystring *qs = t->qs;
837 	struct repo_dir *repo_dir = NULL;
838 	struct dirent **sd_dent = t->repos;
839 	unsigned int d_i, d_disp = 0;
840 	unsigned int d_skipped = 0;
841 	int type, r;
842 
843 	if (gotweb_render_repo_table_hdr(c->tp) == -1)
844 		return -1;
845 
846 	for (d_i = 0; d_i < t->nrepos; d_i++) {
847 		if (srv->max_repos > 0 && t->prev_disp == srv->max_repos)
848 			break;
849 
850 		if (strcmp(sd_dent[d_i]->d_name, ".") == 0 ||
851 		    strcmp(sd_dent[d_i]->d_name, "..") == 0) {
852 			d_skipped++;
853 			continue;
854 		}
855 
856 		error = got_path_dirent_type(&type, srv->repos_path,
857 		    sd_dent[d_i]);
858 		if (error)
859 			continue;
860 		if (type != DT_DIR) {
861 			d_skipped++;
862 			continue;
863 		}
864 
865 		if (qs->index_page > 0 && (qs->index_page *
866 		    srv->max_repos_display) > t->prev_disp) {
867 			t->prev_disp++;
868 			continue;
869 		}
870 
871 		error = gotweb_init_repo_dir(&repo_dir, sd_dent[d_i]->d_name);
872 		if (error)
873 			continue;
874 
875 		error = gotweb_load_got_path(c, repo_dir);
876 		if (error && error->code != GOT_ERR_LONELY_PACKIDX) {
877 			if (error->code != GOT_ERR_NOT_GIT_REPO)
878 				log_warnx("%s: %s: %s", __func__,
879 				    sd_dent[d_i]->d_name, error->msg);
880 			gotweb_free_repo_dir(repo_dir);
881 			repo_dir = NULL;
882 			d_skipped++;
883 			continue;
884 		}
885 
886 		d_disp++;
887 		t->prev_disp++;
888 
889 		r = gotweb_render_repo_fragment(c->tp, repo_dir);
890 		gotweb_free_repo_dir(repo_dir);
891 		repo_dir = NULL;
892 		got_repo_close(t->repo);
893 		t->repo = NULL;
894 		if (r == -1)
895 			return -1;
896 
897 		t->next_disp++;
898 		if (d_disp == srv->max_repos_display)
899 			break;
900 	}
901 	t->repos_total = t->nrepos - d_skipped;
902 
903 	if (srv->max_repos_display == 0)
904 		return 0;
905 	if (srv->max_repos > 0 && srv->max_repos < srv->max_repos_display)
906 		return 0;
907 	if (t->repos_total <= srv->max_repos ||
908 	    t->repos_total <= srv->max_repos_display)
909 		return 0;
910 
911 	if (gotweb_render_navs(c->tp) == -1)
912 		return -1;
913 
914 	return 0;
915 }
916 
917 static inline int
918 should_urlencode(int c)
919 {
920 	if (c <= ' ' || c >= 127)
921 		return 1;
922 
923 	switch (c) {
924 		/* gen-delim */
925 	case ':':
926 	case '/':
927 	case '?':
928 	case '#':
929 	case '[':
930 	case ']':
931 	case '@':
932 		/* sub-delims */
933 	case '!':
934 	case '$':
935 	case '&':
936 	case '\'':
937 	case '(':
938 	case ')':
939 	case '*':
940 	case '+':
941 	case ',':
942 	case ';':
943 	case '=':
944 		/* needed because the URLs are embedded into the HTML */
945 	case '\"':
946 		return 1;
947 	default:
948 		return 0;
949 	}
950 }
951 
952 static char *
953 gotweb_urlencode(const char *str)
954 {
955 	const char *s;
956 	char *escaped;
957 	size_t i, len;
958 	int a, b;
959 
960 	len = 0;
961 	for (s = str; *s; ++s) {
962 		len++;
963 		if (should_urlencode(*s))
964 			len += 2;
965 	}
966 
967 	escaped = calloc(1, len + 1);
968 	if (escaped == NULL)
969 		return NULL;
970 
971 	i = 0;
972 	for (s = str; *s; ++s) {
973 		if (should_urlencode(*s)) {
974 			a = (*s & 0xF0) >> 4;
975 			b = (*s & 0x0F);
976 
977 			escaped[i++] = '%';
978 			escaped[i++] = a <= 9 ? ('0' + a) : ('7' + a);
979 			escaped[i++] = b <= 9 ? ('0' + b) : ('7' + b);
980 		} else
981 			escaped[i++] = *s;
982 	}
983 
984 	return escaped;
985 }
986 
987 const char *
988 gotweb_action_name(int action)
989 {
990 	switch (action) {
991 	case BLAME:
992 		return "blame";
993 	case BLOB:
994 		return "blob";
995 	case BLOBRAW:
996 		return "blobraw";
997 	case BRIEFS:
998 		return "briefs";
999 	case COMMITS:
1000 		return "commits";
1001 	case DIFF:
1002 		return "diff";
1003 	case ERR:
1004 		return "err";
1005 	case INDEX:
1006 		return "index";
1007 	case PATCH:
1008 		return "patch";
1009 	case SUMMARY:
1010 		return "summary";
1011 	case TAG:
1012 		return "tag";
1013 	case TAGS:
1014 		return "tags";
1015 	case TREE:
1016 		return "tree";
1017 	case RSS:
1018 		return "rss";
1019 	default:
1020 		return NULL;
1021 	}
1022 }
1023 
1024 int
1025 gotweb_render_url(struct request *c, struct gotweb_url *url)
1026 {
1027 	const char *sep = "?", *action;
1028 	char *tmp;
1029 	int r;
1030 
1031 	action = gotweb_action_name(url->action);
1032 	if (action != NULL) {
1033 		if (tp_writef(c->tp, "?action=%s", action) == -1)
1034 			return -1;
1035 		sep = "&";
1036 	}
1037 
1038 	if (url->commit) {
1039 		if (tp_writef(c->tp, "%scommit=%s", sep, url->commit) == -1)
1040 			return -1;
1041 		sep = "&";
1042 	}
1043 
1044 	if (url->previd) {
1045 		if (tp_writef(c->tp, "%sprevid=%s", sep, url->previd) == -1)
1046 			return -1;
1047 		sep = "&";
1048 	}
1049 
1050 	if (url->prevset) {
1051 		if (tp_writef(c->tp, "%sprevset=%s", sep, url->prevset) == -1)
1052 			return -1;
1053 		sep = "&";
1054 	}
1055 
1056 	if (url->file) {
1057 		tmp = gotweb_urlencode(url->file);
1058 		if (tmp == NULL)
1059 			return -1;
1060 		r = tp_writef(c->tp, "%sfile=%s", sep, tmp);
1061 		free(tmp);
1062 		if (r == -1)
1063 			return -1;
1064 		sep = "&";
1065 	}
1066 
1067 	if (url->folder) {
1068 		tmp = gotweb_urlencode(url->folder);
1069 		if (tmp == NULL)
1070 			return -1;
1071 		r = tp_writef(c->tp, "%sfolder=%s", sep, tmp);
1072 		free(tmp);
1073 		if (r == -1)
1074 			return -1;
1075 		sep = "&";
1076 	}
1077 
1078 	if (url->headref) {
1079 		tmp = gotweb_urlencode(url->headref);
1080 		if (tmp == NULL)
1081 			return -1;
1082 		r = tp_writef(c->tp, "%sheadref=%s", sep, url->headref);
1083 		free(tmp);
1084 		if (r == -1)
1085 			return -1;
1086 		sep = "&";
1087 	}
1088 
1089 	if (url->index_page != -1) {
1090 		if (tp_writef(c->tp, "%sindex_page=%d", sep,
1091 		    url->index_page) == -1)
1092 			return -1;
1093 		sep = "&";
1094 	}
1095 
1096 	if (url->path) {
1097 		tmp = gotweb_urlencode(url->path);
1098 		if (tmp == NULL)
1099 			return -1;
1100 		r = tp_writef(c->tp, "%spath=%s", sep, tmp);
1101 		free(tmp);
1102 		if (r == -1)
1103 			return -1;
1104 		sep = "&";
1105 	}
1106 
1107 	if (url->page != -1) {
1108 		if (tp_writef(c->tp, "%spage=%d", sep, url->page) == -1)
1109 			return -1;
1110 		sep = "&";
1111 	}
1112 
1113 	return 0;
1114 }
1115 
1116 int
1117 gotweb_render_absolute_url(struct request *c, struct gotweb_url *url)
1118 {
1119 	struct template	*tp = c->tp;
1120 	const char	*proto = c->https ? "https" : "http";
1121 
1122 	if (tp_writes(tp, proto) == -1 ||
1123 	    tp_writes(tp, "://") == -1 ||
1124 	    tp_htmlescape(tp, c->server_name) == -1 ||
1125 	    tp_htmlescape(tp, c->document_uri) == -1)
1126 		return -1;
1127 
1128 	return gotweb_render_url(c, url);
1129 }
1130 
1131 static const struct got_error *
1132 gotweb_load_got_path(struct request *c, struct repo_dir *repo_dir)
1133 {
1134 	const struct got_error *error = NULL;
1135 	struct socket *sock = c->sock;
1136 	struct server *srv = c->srv;
1137 	struct transport *t = c->t;
1138 	DIR *dt;
1139 	char *dir_test;
1140 
1141 	if (asprintf(&dir_test, "%s/%s/%s", srv->repos_path, repo_dir->name,
1142 	    GOTWEB_GIT_DIR) == -1)
1143 		return got_error_from_errno("asprintf");
1144 
1145 	dt = opendir(dir_test);
1146 	if (dt == NULL) {
1147 		free(dir_test);
1148 		if (asprintf(&dir_test, "%s/%s", srv->repos_path,
1149 		    repo_dir->name) == -1)
1150 			return got_error_from_errno("asprintf");
1151 		dt = opendir(dir_test);
1152 		if (dt == NULL) {
1153 			free(dir_test);
1154 			return got_error_path(repo_dir->name,
1155 			    GOT_ERR_NOT_GIT_REPO);
1156 		}
1157 	}
1158 
1159 	repo_dir->path = dir_test;
1160 	dir_test = NULL;
1161 
1162 	if (srv->respect_exportok &&
1163 	    faccessat(dirfd(dt), "git-daemon-export-ok", F_OK, 0) == -1) {
1164 		error = got_error_path(repo_dir->name, GOT_ERR_NOT_GIT_REPO);
1165 		goto err;
1166 	}
1167 
1168 	error = got_repo_open(&t->repo, repo_dir->path, NULL, sock->pack_fds);
1169 	if (error)
1170 		goto err;
1171 	error = gotweb_get_repo_description(&repo_dir->description, srv,
1172 	    repo_dir->path, dirfd(dt));
1173 	if (error)
1174 		goto err;
1175 	error = got_get_repo_owner(&repo_dir->owner, c);
1176 	if (error)
1177 		goto err;
1178 	if (srv->show_repo_age) {
1179 		error = got_get_repo_age(&repo_dir->age, c, NULL);
1180 		if (error)
1181 			goto err;
1182 	}
1183 	error = gotweb_get_clone_url(&repo_dir->url, srv, repo_dir->path,
1184 	    dirfd(dt));
1185 err:
1186 	free(dir_test);
1187 	if (dt != NULL && closedir(dt) == EOF && error == NULL)
1188 		error = got_error_from_errno("closedir");
1189 	if (error && t->repo) {
1190 		got_repo_close(t->repo);
1191 		t->repo = NULL;
1192 	}
1193 	return error;
1194 }
1195 
1196 static const struct got_error *
1197 gotweb_init_repo_dir(struct repo_dir **repo_dir, const char *dir)
1198 {
1199 	const struct got_error *error;
1200 
1201 	*repo_dir = calloc(1, sizeof(**repo_dir));
1202 	if (*repo_dir == NULL)
1203 		return got_error_from_errno("calloc");
1204 
1205 	if (asprintf(&(*repo_dir)->name, "%s", dir) == -1) {
1206 		error = got_error_from_errno("asprintf");
1207 		free(*repo_dir);
1208 		*repo_dir = NULL;
1209 		return error;
1210 	}
1211 	(*repo_dir)->owner = NULL;
1212 	(*repo_dir)->description = NULL;
1213 	(*repo_dir)->url = NULL;
1214 	(*repo_dir)->path = NULL;
1215 
1216 	return NULL;
1217 }
1218 
1219 static const struct got_error *
1220 gotweb_get_repo_description(char **description, struct server *srv,
1221     const char *dirpath, int dir)
1222 {
1223 	const struct got_error *error = NULL;
1224 	struct stat sb;
1225 	int fd = -1;
1226 	off_t len;
1227 
1228 	*description = NULL;
1229 	if (srv->show_repo_description == 0)
1230 		return NULL;
1231 
1232 	fd = openat(dir, "description", O_RDONLY);
1233 	if (fd == -1) {
1234 		if (errno != ENOENT && errno != EACCES) {
1235 			error = got_error_from_errno_fmt("openat %s/%s",
1236 			    dirpath, "description");
1237 		}
1238 		goto done;
1239 	}
1240 
1241 	if (fstat(fd, &sb) == -1) {
1242 		error = got_error_from_errno_fmt("fstat %s/%s",
1243 		    dirpath, "description");
1244 		goto done;
1245 	}
1246 
1247 	len = sb.st_size;
1248 	if (len > GOTWEBD_MAXDESCRSZ - 1)
1249 		len = GOTWEBD_MAXDESCRSZ - 1;
1250 
1251 	*description = calloc(len + 1, sizeof(**description));
1252 	if (*description == NULL) {
1253 		error = got_error_from_errno("calloc");
1254 		goto done;
1255 	}
1256 
1257 	if (read(fd, *description, len) == -1)
1258 		error = got_error_from_errno("read");
1259 done:
1260 	if (fd != -1 && close(fd) == -1 && error == NULL)
1261 		error = got_error_from_errno("close");
1262 	return error;
1263 }
1264 
1265 static const struct got_error *
1266 gotweb_get_clone_url(char **url, struct server *srv, const char *dirpath,
1267     int dir)
1268 {
1269 	const struct got_error *error = NULL;
1270 	struct stat sb;
1271 	int fd = -1;
1272 	off_t len;
1273 
1274 	*url = NULL;
1275 	if (srv->show_repo_cloneurl == 0)
1276 		return NULL;
1277 
1278 	fd = openat(dir, "cloneurl", O_RDONLY);
1279 	if (fd == -1) {
1280 		if (errno != ENOENT && errno != EACCES) {
1281 			error = got_error_from_errno_fmt("openat %s/%s",
1282 			    dirpath, "cloneurl");
1283 		}
1284 		goto done;
1285 	}
1286 
1287 	if (fstat(fd, &sb) == -1) {
1288 		error = got_error_from_errno_fmt("fstat %s/%s",
1289 		    dirpath, "cloneurl");
1290 		goto done;
1291 	}
1292 
1293 	len = sb.st_size;
1294 	if (len > GOTWEBD_MAXCLONEURLSZ - 1)
1295 		len = GOTWEBD_MAXCLONEURLSZ - 1;
1296 
1297 	*url = calloc(len + 1, sizeof(**url));
1298 	if (*url == NULL) {
1299 		error = got_error_from_errno("calloc");
1300 		goto done;
1301 	}
1302 
1303 	if (read(fd, *url, len) == -1)
1304 		error = got_error_from_errno("read");
1305 done:
1306 	if (fd != -1 && close(fd) == -1 && error == NULL)
1307 		error = got_error_from_errno("close");
1308 	return error;
1309 }
1310 
1311 int
1312 gotweb_render_age(struct template *tp, time_t committer_time)
1313 {
1314 	struct request *c = tp->tp_arg;
1315 	long long diff_time;
1316 	const char *years = "years ago", *months = "months ago";
1317 	const char *weeks = "weeks ago", *days = "days ago";
1318 	const char *hours = "hours ago",  *minutes = "minutes ago";
1319 	const char *seconds = "seconds ago", *now = "right now";
1320 
1321 	diff_time = time(NULL) - committer_time;
1322 	if (diff_time > 60 * 60 * 24 * 365 * 2) {
1323 		if (tp_writef(c->tp, "%lld %s",
1324 		    (diff_time / 60 / 60 / 24 / 365), years) == -1)
1325 			return -1;
1326 	} else if (diff_time > 60 * 60 * 24 * (365 / 12) * 2) {
1327 		if (tp_writef(c->tp, "%lld %s",
1328 		    (diff_time / 60 / 60 / 24 / (365 / 12)),
1329 		    months) == -1)
1330 			return -1;
1331 	} else if (diff_time > 60 * 60 * 24 * 7 * 2) {
1332 		if (tp_writef(c->tp, "%lld %s",
1333 		    (diff_time / 60 / 60 / 24 / 7), weeks) == -1)
1334 			return -1;
1335 	} else if (diff_time > 60 * 60 * 24 * 2) {
1336 		if (tp_writef(c->tp, "%lld %s",
1337 		    (diff_time / 60 / 60 / 24), days) == -1)
1338 			return -1;
1339 	} else if (diff_time > 60 * 60 * 2) {
1340 		if (tp_writef(c->tp, "%lld %s",
1341 		    (diff_time / 60 / 60), hours) == -1)
1342 			return -1;
1343 	} else if (diff_time > 60 * 2) {
1344 		if (tp_writef(c->tp, "%lld %s", (diff_time / 60),
1345 		    minutes) == -1)
1346 			return -1;
1347 	} else if (diff_time > 2) {
1348 		if (tp_writef(c->tp, "%lld %s", diff_time,
1349 		    seconds) == -1)
1350 			return -1;
1351 	} else {
1352 		if (tp_writes(tp, now) == -1)
1353 			return -1;
1354 	}
1355 	return 0;
1356 }