1 /*
2  * Copyright (c) 2016, 2019, 2020-2022 Tracey Emery <tracey@traceyemery.net>
3  * Copyright (c) 2015 Mike Larkin <mlarkin@openbsd.org>
4  * Copyright (c) 2014 Reyk Floeter <reyk@openbsd.org>
5  * Copyright (c) 2013 David Gwynne <dlg@openbsd.org>
6  * Copyright (c) 2013 Florian Obser <florian@openbsd.org>
7  *
8  * Permission to use, copy, modify, and distribute this software for any
9  * purpose with or without fee is hereby granted, provided that the above
10  * copyright notice and this permission notice appear in all copies.
11  *
12  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
13  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
14  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
15  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
16  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
17  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
18  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
19  */
20 
21 #include <net/if.h>
22 #include <netinet/in.h>
23 #include <sys/queue.h>
24 #include <sys/stat.h>
25 #include <sys/types.h>
26 
27 #include <ctype.h>
28 #include <dirent.h>
29 #include <errno.h>
30 #include <event.h>
31 #include <fcntl.h>
32 #include <imsg.h>
33 #include <sha1.h>
34 #include <stdio.h>
35 #include <stdlib.h>
36 #include <string.h>
37 #include <unistd.h>
38 
39 #include "got_error.h"
40 #include "got_object.h"
41 #include "got_reference.h"
42 #include "got_repository.h"
43 #include "got_path.h"
44 #include "got_cancel.h"
45 #include "got_worktree.h"
46 #include "got_diff.h"
47 #include "got_commit_graph.h"
48 #include "got_blame.h"
49 #include "got_privsep.h"
50 
51 #include "proc.h"
52 #include "gotwebd.h"
53 #include "tmpl.h"
54 
55 static const struct querystring_keys querystring_keys[] = {
56 	{ "action",		ACTION },
57 	{ "commit",		COMMIT },
58 	{ "file",		RFILE },
59 	{ "folder",		FOLDER },
60 	{ "headref",		HEADREF },
61 	{ "index_page",		INDEX_PAGE },
62 	{ "path",		PATH },
63 	{ "page",		PAGE },
64 };
65 
66 static const struct action_keys action_keys[] = {
67 	{ "blame",	BLAME },
68 	{ "blob",	BLOB },
69 	{ "blobraw",	BLOBRAW },
70 	{ "briefs",	BRIEFS },
71 	{ "commits",	COMMITS },
72 	{ "diff",	DIFF },
73 	{ "error",	ERR },
74 	{ "index",	INDEX },
75 	{ "summary",	SUMMARY },
76 	{ "tag",	TAG },
77 	{ "tags",	TAGS },
78 	{ "tree",	TREE },
79 	{ "rss",	RSS },
80 };
81 
82 static const struct got_error *gotweb_init_querystring(struct querystring **);
83 static const struct got_error *gotweb_parse_querystring(struct querystring **,
84     char *);
85 static const struct got_error *gotweb_assign_querystring(struct querystring **,
86     char *, char *);
87 static const struct got_error *gotweb_render_index(struct request *);
88 static const struct got_error *gotweb_init_repo_dir(struct repo_dir **,
89     const char *);
90 static const struct got_error *gotweb_load_got_path(struct request *c,
91     struct repo_dir *);
92 static const struct got_error *gotweb_get_repo_description(char **,
93     struct server *, const char *, int);
94 static const struct got_error *gotweb_get_clone_url(char **, struct server *,
95     const char *, int);
96 static const struct got_error *gotweb_render_blame(struct request *);
97 static const struct got_error *gotweb_render_summary(struct request *);
98 static const struct got_error *gotweb_render_tag(struct request *);
99 static const struct got_error *gotweb_render_tags(struct request *);
100 static const struct got_error *gotweb_render_branches(struct request *);
101 
102 static void gotweb_free_querystring(struct querystring *);
103 static void gotweb_free_repo_dir(struct repo_dir *);
104 
105 struct server *gotweb_get_server(uint8_t *, uint8_t *);
106 
107 void
108 gotweb_process_request(struct request *c)
109 {
110 	const struct got_error *error = NULL, *error2 = NULL;
111 	struct got_blob_object *blob = NULL;
112 	struct server *srv = NULL;
113 	struct querystring *qs = NULL;
114 	struct repo_dir *repo_dir = NULL;
115 	FILE *fp = NULL;
116 	uint8_t err[] = "gotwebd experienced an error: ";
117 	int r, html = 0, fd = -1;
118 
119 	/* init the transport */
120 	error = gotweb_init_transport(&c->t);
121 	if (error) {
122 		log_warnx("%s: %s", __func__, error->msg);
123 		return;
124 	}
125 	/* don't process any further if client disconnected */
126 	if (c->sock->client_status == CLIENT_DISCONNECT)
127 		return;
128 	/* get the gotwebd server */
129 	srv = gotweb_get_server(c->server_name, c->http_host);
130 	if (srv == NULL) {
131 		log_warnx("%s: error server is NULL", __func__);
132 		goto err;
133 	}
134 	c->srv = srv;
135 	/* parse our querystring */
136 	error = gotweb_init_querystring(&qs);
137 	if (error) {
138 		log_warnx("%s: %s", __func__, error->msg);
139 		goto err;
140 	}
141 	c->t->qs = qs;
142 	error = gotweb_parse_querystring(&qs, c->querystring);
143 	if (error) {
144 		log_warnx("%s: %s", __func__, error->msg);
145 		goto err;
146 	}
147 
148 	/*
149 	 * certain actions require a commit id in the querystring. this stops
150 	 * bad actors from exploiting this by manually manipulating the
151 	 * querystring.
152 	 */
153 
154 	if (qs->action == BLAME || qs->action == BLOB ||
155 	    qs->action == BLOBRAW || qs->action == DIFF) {
156 		if (qs->commit == NULL) {
157 			error2 = got_error(GOT_ERR_QUERYSTRING);
158 			goto render;
159 		}
160 	}
161 
162 	if (qs->action != INDEX) {
163 		error = gotweb_init_repo_dir(&repo_dir, qs->path);
164 		if (error)
165 			goto done;
166 		error = gotweb_load_got_path(c, repo_dir);
167 		c->t->repo_dir = repo_dir;
168 		if (error && error->code != GOT_ERR_LONELY_PACKIDX)
169 			goto err;
170 	}
171 
172 	if (qs->action == BLOBRAW) {
173 		error = got_get_repo_commits(c, 1);
174 		if (error)
175 			goto done;
176 		error = got_output_file_blob(c);
177 		if (error) {
178 			log_warnx("%s: %s", __func__, error->msg);
179 			goto err;
180 		}
181 		goto done;
182 	}
183 
184 	if (qs->action == BLOB) {
185 		int binary;
186 		struct gotweb_url url = {
187 			.index_page = -1,
188 			.page = -1,
189 			.action = BLOBRAW,
190 			.path = qs->path,
191 			.commit = qs->commit,
192 			.folder = qs->folder,
193 			.file = qs->file,
194 		};
195 
196 		error = got_get_repo_commits(c, 1);
197 		if (error)
198 			goto done;
199 
200 		error2 = got_open_blob_for_output(&blob, &fd, &binary, c);
201 		if (error2)
202 			goto render;
203 		if (binary) {
204 			fcgi_puts(c->tp, "Status: 302\r\n");
205 			fcgi_puts(c->tp, "Location: ");
206 			gotweb_render_url(c, &url);
207 			fcgi_puts(c->tp, "\r\n\r\n");
208 			goto done;
209 		}
210 	}
211 
212 	if (qs->action == RSS) {
213 		error = gotweb_render_content_type_file(c,
214 		    "application/rss+xml;charset=utf-8",
215 		    repo_dir->name, ".rss");
216 		if (error) {
217 			log_warnx("%s: %s", __func__, error->msg);
218 			goto err;
219 		}
220 
221 		error = got_get_repo_tags(c, D_MAXSLCOMMDISP);
222 		if (error) {
223 			log_warnx("%s: %s", __func__, error->msg);
224 			goto err;
225 		}
226 		if (gotweb_render_rss(c->tp) == -1)
227 			goto err;
228 		goto done;
229 	}
230 
231 render:
232 	error = gotweb_render_content_type(c, "text/html");
233 	if (error) {
234 		log_warnx("%s: %s", __func__, error->msg);
235 		goto err;
236 	}
237 	html = 1;
238 
239 	if (gotweb_render_header(c->tp) == -1)
240 		goto err;
241 
242 	if (error2) {
243 		error = error2;
244 		goto err;
245 	}
246 
247 	switch(qs->action) {
248 	case BLAME:
249 		error = gotweb_render_blame(c);
250 		if (error) {
251 			log_warnx("%s: %s", __func__, error->msg);
252 			goto err;
253 		}
254 		break;
255 	case BLOB:
256 		if (gotweb_render_blob(c->tp, blob) == -1)
257 			goto err;
258 		break;
259 	case BRIEFS:
260 		if (gotweb_render_briefs(c->tp) == -1)
261 			goto err;
262 		break;
263 	case COMMITS:
264 		error = got_get_repo_commits(c, srv->max_commits_display);
265 		if (error) {
266 			log_warnx("%s: %s", __func__, error->msg);
267 			goto err;
268 		}
269 		if (gotweb_render_commits(c->tp) == -1)
270 			goto err;
271 		break;
272 	case DIFF:
273 		error = got_get_repo_commits(c, 1);
274 		if (error) {
275 			log_warnx("%s: %s", __func__, error->msg);
276 			goto err;
277 		}
278 		error = got_open_diff_for_output(&fp, &fd, c);
279 		if (error) {
280 			log_warnx("%s: %s", __func__, error->msg);
281 			goto err;
282 		}
283 		if (gotweb_render_diff(c->tp, fp) == -1)
284 			goto err;
285 		break;
286 	case INDEX:
287 		error = gotweb_render_index(c);
288 		if (error) {
289 			log_warnx("%s: %s", __func__, error->msg);
290 			goto err;
291 		}
292 		break;
293 	case SUMMARY:
294 		error = gotweb_render_summary(c);
295 		if (error) {
296 			log_warnx("%s: %s", __func__, error->msg);
297 			goto err;
298 		}
299 		break;
300 	case TAG:
301 		error = gotweb_render_tag(c);
302 		if (error) {
303 			log_warnx("%s: %s", __func__, error->msg);
304 			goto err;
305 		}
306 		break;
307 	case TAGS:
308 		error = gotweb_render_tags(c);
309 		if (error) {
310 			log_warnx("%s: %s", __func__, error->msg);
311 			goto err;
312 		}
313 		break;
314 	case TREE:
315 		error = got_get_repo_commits(c, 1);
316 		if (error) {
317 			log_warnx("%s: %s", __func__, error->msg);
318 			goto err;
319 		}
320 		if (gotweb_render_tree(c->tp) == -1)
321 			goto err;
322 		break;
323 	case ERR:
324 	default:
325 		r = fcgi_printf(c, "<div id='err_content'>%s</div>\n",
326 		    "Erorr: Bad Querystring");
327 		if (r == -1)
328 			goto err;
329 		break;
330 	}
331 
332 	goto done;
333 err:
334 	if (html && fcgi_printf(c, "<div id='err_content'>") == -1)
335 		return;
336 	if (fcgi_printf(c, "\n%s", err) == -1)
337 		return;
338 	if (error) {
339 		if (fcgi_printf(c, "%s", error->msg) == -1)
340 			return;
341 	} else {
342 		if (fcgi_printf(c, "see daemon logs for details") == -1)
343 			return;
344 	}
345 	if (html && fcgi_printf(c, "</div>\n") == -1)
346 		return;
347 done:
348 	if (blob)
349 		got_object_blob_close(blob);
350 	if (fp) {
351 		error = got_gotweb_flushfile(fp, fd);
352 		if (error)
353 			log_warnx("%s: got_gotweb_flushfile failure: %s",
354 			    __func__, error->msg);
355 		fd = -1;
356 	}
357 	if (fd != -1)
358 		close(fd);
359 	if (html && srv != NULL)
360 		gotweb_render_footer(c->tp);
361 }
362 
363 struct server *
364 gotweb_get_server(uint8_t *server_name, uint8_t *subdomain)
365 {
366 	struct server *srv = NULL;
367 
368 	/* check against the server name first */
369 	if (strlen(server_name) > 0)
370 		TAILQ_FOREACH(srv, &gotwebd_env->servers, entry)
371 			if (strcmp(srv->name, server_name) == 0)
372 				goto done;
373 
374 	/* check against subdomain second */
375 	if (strlen(subdomain) > 0)
376 		TAILQ_FOREACH(srv, &gotwebd_env->servers, entry)
377 			if (strcmp(srv->name, subdomain) == 0)
378 				goto done;
379 
380 	/* if those fail, send first server */
381 	TAILQ_FOREACH(srv, &gotwebd_env->servers, entry)
382 		if (srv != NULL)
383 			break;
384 done:
385 	return srv;
386 };
387 
388 const struct got_error *
389 gotweb_init_transport(struct transport **t)
390 {
391 	const struct got_error *error = NULL;
392 
393 	*t = calloc(1, sizeof(**t));
394 	if (*t == NULL)
395 		return got_error_from_errno2("%s: calloc", __func__);
396 
397 	TAILQ_INIT(&(*t)->repo_commits);
398 	TAILQ_INIT(&(*t)->repo_tags);
399 
400 	(*t)->repo = NULL;
401 	(*t)->repo_dir = NULL;
402 	(*t)->qs = NULL;
403 	(*t)->next_id = NULL;
404 	(*t)->prev_id = NULL;
405 	(*t)->next_disp = 0;
406 	(*t)->prev_disp = 0;
407 
408 	return error;
409 }
410 
411 static const struct got_error *
412 gotweb_init_querystring(struct querystring **qs)
413 {
414 	const struct got_error *error = NULL;
415 
416 	*qs = calloc(1, sizeof(**qs));
417 	if (*qs == NULL)
418 		return got_error_from_errno2("%s: calloc", __func__);
419 
420 	(*qs)->headref = strdup("HEAD");
421 	if ((*qs)->headref == NULL) {
422 		free(*qs);
423 		*qs = NULL;
424 		return got_error_from_errno2("%s: strdup", __func__);
425 	}
426 
427 	(*qs)->action = INDEX;
428 	(*qs)->commit = NULL;
429 	(*qs)->file = NULL;
430 	(*qs)->folder = NULL;
431 	(*qs)->index_page = 0;
432 	(*qs)->path = NULL;
433 
434 	return error;
435 }
436 
437 static const struct got_error *
438 gotweb_parse_querystring(struct querystring **qs, char *qst)
439 {
440 	const struct got_error *error = NULL;
441 	char *tok1 = NULL, *tok1_pair = NULL, *tok1_end = NULL;
442 	char *tok2 = NULL, *tok2_pair = NULL, *tok2_end = NULL;
443 
444 	if (qst == NULL)
445 		return error;
446 
447 	tok1 = strdup(qst);
448 	if (tok1 == NULL)
449 		return got_error_from_errno2("%s: strdup", __func__);
450 
451 	tok1_pair = tok1;
452 	tok1_end = tok1;
453 
454 	while (tok1_pair != NULL) {
455 		strsep(&tok1_end, "&");
456 
457 		tok2 = strdup(tok1_pair);
458 		if (tok2 == NULL) {
459 			free(tok1);
460 			return got_error_from_errno2("%s: strdup", __func__);
461 		}
462 
463 		tok2_pair = tok2;
464 		tok2_end = tok2;
465 
466 		while (tok2_pair != NULL) {
467 			strsep(&tok2_end, "=");
468 			if (tok2_end) {
469 				error = gotweb_assign_querystring(qs, tok2_pair,
470 				    tok2_end);
471 				if (error)
472 					goto err;
473 			}
474 			tok2_pair = tok2_end;
475 		}
476 		free(tok2);
477 		tok1_pair = tok1_end;
478 	}
479 	free(tok1);
480 	return error;
481 err:
482 	free(tok2);
483 	free(tok1);
484 	return error;
485 }
486 
487 /*
488  * Adapted from usr.sbin/httpd/httpd.c url_decode.
489  */
490 static const struct got_error *
491 gotweb_urldecode(char *url)
492 {
493 	char		*p, *q;
494 	char		 hex[3];
495 	unsigned long	 x;
496 
497 	hex[2] = '\0';
498 	p = q = url;
499 
500 	while (*p != '\0') {
501 		switch (*p) {
502 		case '%':
503 			/* Encoding character is followed by two hex chars */
504 			if (!isxdigit((unsigned char)p[1]) ||
505 			    !isxdigit((unsigned char)p[2]) ||
506 			    (p[1] == '0' && p[2] == '0'))
507 				return got_error(GOT_ERR_BAD_QUERYSTRING);
508 
509 			hex[0] = p[1];
510 			hex[1] = p[2];
511 
512 			/*
513 			 * We don't have to validate "hex" because it is
514 			 * guaranteed to include two hex chars followed by nul.
515 			 */
516 			x = strtoul(hex, NULL, 16);
517 			*q = (char)x;
518 			p += 2;
519 			break;
520 		default:
521 			*q = *p;
522 			break;
523 		}
524 		p++;
525 		q++;
526 	}
527 	*q = '\0';
528 
529 	return NULL;
530 }
531 
532 static const struct got_error *
533 gotweb_assign_querystring(struct querystring **qs, char *key, char *value)
534 {
535 	const struct got_error *error = NULL;
536 	const char *errstr;
537 	int a_cnt, el_cnt;
538 
539 	error = gotweb_urldecode(value);
540 	if (error)
541 		return error;
542 
543 	for (el_cnt = 0; el_cnt < QSELEM__MAX; el_cnt++) {
544 		if (strcmp(key, querystring_keys[el_cnt].name) != 0)
545 			continue;
546 
547 		switch (querystring_keys[el_cnt].element) {
548 		case ACTION:
549 			for (a_cnt = 0; a_cnt < ACTIONS__MAX; a_cnt++) {
550 				if (strcmp(value, action_keys[a_cnt].name) != 0)
551 					continue;
552 				else if (strcmp(value,
553 				    action_keys[a_cnt].name) == 0){
554 					(*qs)->action =
555 					    action_keys[a_cnt].action;
556 					goto qa_found;
557 				}
558 			}
559 			(*qs)->action = ERR;
560 qa_found:
561 			break;
562 		case COMMIT:
563 			(*qs)->commit = strdup(value);
564 			if ((*qs)->commit == NULL) {
565 				error = got_error_from_errno2("%s: strdup",
566 				    __func__);
567 				goto done;
568 			}
569 			break;
570 		case RFILE:
571 			(*qs)->file = strdup(value);
572 			if ((*qs)->file == NULL) {
573 				error = got_error_from_errno2("%s: strdup",
574 				    __func__);
575 				goto done;
576 			}
577 			break;
578 		case FOLDER:
579 			(*qs)->folder = strdup(value);
580 			if ((*qs)->folder == NULL) {
581 				error = got_error_from_errno2("%s: strdup",
582 				    __func__);
583 				goto done;
584 			}
585 			break;
586 		case HEADREF:
587 			free((*qs)->headref);
588 			(*qs)->headref = strdup(value);
589 			if ((*qs)->headref == NULL) {
590 				error = got_error_from_errno2("%s: strdup",
591 				    __func__);
592 				goto done;
593 			}
594 			break;
595 		case INDEX_PAGE:
596 			if (strlen(value) == 0)
597 				break;
598 			(*qs)->index_page = strtonum(value, INT64_MIN,
599 			    INT64_MAX, &errstr);
600 			if (errstr) {
601 				error = got_error_from_errno3("%s: strtonum %s",
602 				    __func__, errstr);
603 				goto done;
604 			}
605 			if ((*qs)->index_page < 0)
606 				(*qs)->index_page = 0;
607 			break;
608 		case PATH:
609 			(*qs)->path = strdup(value);
610 			if ((*qs)->path == NULL) {
611 				error = got_error_from_errno2("%s: strdup",
612 				    __func__);
613 				goto done;
614 			}
615 			break;
616 		case PAGE:
617 			if (strlen(value) == 0)
618 				break;
619 			(*qs)->page = strtonum(value, INT64_MIN,
620 			    INT64_MAX, &errstr);
621 			if (errstr) {
622 				error = got_error_from_errno3("%s: strtonum %s",
623 				    __func__, errstr);
624 				goto done;
625 			}
626 			if ((*qs)->page < 0)
627 				(*qs)->page = 0;
628 			break;
629 		default:
630 			break;
631 		}
632 	}
633 done:
634 	return error;
635 }
636 
637 void
638 gotweb_free_repo_tag(struct repo_tag *rt)
639 {
640 	if (rt != NULL) {
641 		free(rt->commit_id);
642 		free(rt->tag_name);
643 		free(rt->tag_commit);
644 		free(rt->commit_msg);
645 		free(rt->tagger);
646 	}
647 	free(rt);
648 }
649 
650 void
651 gotweb_free_repo_commit(struct repo_commit *rc)
652 {
653 	if (rc != NULL) {
654 		free(rc->path);
655 		free(rc->refs_str);
656 		free(rc->commit_id);
657 		free(rc->parent_id);
658 		free(rc->tree_id);
659 		free(rc->author);
660 		free(rc->committer);
661 		free(rc->commit_msg);
662 	}
663 	free(rc);
664 }
665 
666 static void
667 gotweb_free_querystring(struct querystring *qs)
668 {
669 	if (qs != NULL) {
670 		free(qs->commit);
671 		free(qs->file);
672 		free(qs->folder);
673 		free(qs->headref);
674 		free(qs->path);
675 	}
676 	free(qs);
677 }
678 
679 static void
680 gotweb_free_repo_dir(struct repo_dir *repo_dir)
681 {
682 	if (repo_dir != NULL) {
683 		free(repo_dir->name);
684 		free(repo_dir->owner);
685 		free(repo_dir->description);
686 		free(repo_dir->url);
687 		free(repo_dir->age);
688 		free(repo_dir->path);
689 	}
690 	free(repo_dir);
691 }
692 
693 void
694 gotweb_free_transport(struct transport *t)
695 {
696 	struct repo_commit *rc = NULL, *trc = NULL;
697 	struct repo_tag *rt = NULL, *trt = NULL;
698 
699 	TAILQ_FOREACH_SAFE(rc, &t->repo_commits, entry, trc) {
700 		TAILQ_REMOVE(&t->repo_commits, rc, entry);
701 		gotweb_free_repo_commit(rc);
702 	}
703 	TAILQ_FOREACH_SAFE(rt, &t->repo_tags, entry, trt) {
704 		TAILQ_REMOVE(&t->repo_tags, rt, entry);
705 		gotweb_free_repo_tag(rt);
706 	}
707 	gotweb_free_repo_dir(t->repo_dir);
708 	gotweb_free_querystring(t->qs);
709 	free(t->next_id);
710 	free(t->prev_id);
711 	free(t);
712 }
713 
714 const struct got_error *
715 gotweb_render_content_type(struct request *c, const char *type)
716 {
717 	const char *csp = "default-src 'self'; script-src 'none'; "
718 		"object-src 'none';";
719 
720 	fcgi_printf(c,
721 	    "Content-Security-Policy: %s\r\n"
722 	    "Content-Type: %s\r\n\r\n",
723 	    csp, type);
724 	return NULL;
725 }
726 
727 const struct got_error *
728 gotweb_render_content_type_file(struct request *c, const char *type,
729     const char *file, const char *suffix)
730 {
731 	fcgi_printf(c, "Content-type: %s\r\n"
732 	    "Content-disposition: attachment; filename=%s%s\r\n\r\n",
733 	    type, file, suffix ? suffix : "");
734 	return NULL;
735 }
736 
737 void
738 gotweb_get_navs(struct request *c, struct gotweb_url *prev, int *have_prev,
739     struct gotweb_url *next, int *have_next)
740 {
741 	struct transport *t = c->t;
742 	struct querystring *qs = t->qs;
743 	struct server *srv = c->srv;
744 
745 	*have_prev = *have_next = 0;
746 
747 	switch(qs->action) {
748 	case INDEX:
749 		if (qs->index_page > 0) {
750 			*have_prev = 1;
751 			*prev = (struct gotweb_url){
752 				.action = -1,
753 				.index_page = qs->index_page - 1,
754 				.page = -1,
755 			};
756 		}
757 		if (t->next_disp == srv->max_repos_display &&
758 		    t->repos_total != (qs->index_page + 1) *
759 		    srv->max_repos_display) {
760 			*have_next = 1;
761 			*next = (struct gotweb_url){
762 				.action = -1,
763 				.index_page = qs->index_page + 1,
764 				.page = -1,
765 			};
766 		}
767 		break;
768 	case BRIEFS:
769 		if (t->prev_id && qs->commit != NULL &&
770 		    strcmp(qs->commit, t->prev_id) != 0) {
771 			*have_prev = 1;
772 			*prev = (struct gotweb_url){
773 				.action = BRIEFS,
774 				.index_page = -1,
775 				.page = qs->page - 1,
776 				.path = qs->path,
777 				.commit = t->prev_id,
778 				.headref = qs->headref,
779 			};
780 		}
781 		if (t->next_id) {
782 			*have_next = 1;
783 			*next = (struct gotweb_url){
784 				.action = BRIEFS,
785 				.index_page = -1,
786 				.page = qs->page + 1,
787 				.path = qs->path,
788 				.commit = t->next_id,
789 				.headref = qs->headref,
790 			};
791 		}
792 		break;
793 	case COMMITS:
794 		if (t->prev_id && qs->commit != NULL &&
795 		    strcmp(qs->commit, t->prev_id) != 0) {
796 			*have_prev = 1;
797 			*prev = (struct gotweb_url){
798 				.action = COMMITS,
799 				.index_page = -1,
800 				.page = qs->page - 1,
801 				.path = qs->path,
802 				.commit = t->prev_id,
803 				.headref = qs->headref,
804 				.folder = qs->folder,
805 				.file = qs->file,
806 			};
807 		}
808 		if (t->next_id) {
809 			*have_next = 1;
810 			*next = (struct gotweb_url){
811 				.action = COMMITS,
812 				.index_page = -1,
813 				.page = qs->page + 1,
814 				.path = qs->path,
815 				.commit = t->next_id,
816 				.headref = qs->headref,
817 				.folder = qs->folder,
818 				.file = qs->file,
819 			};
820 		}
821 		break;
822 	case TAGS:
823 		if (t->prev_id && qs->commit != NULL &&
824 		    strcmp(qs->commit, t->prev_id) != 0) {
825 			*have_prev = 1;
826 			*prev = (struct gotweb_url){
827 				.action = TAGS,
828 				.index_page = -1,
829 				.page = qs->page - 1,
830 				.path = qs->path,
831 				.commit = t->prev_id,
832 				.headref = qs->headref,
833 			};
834 		}
835 		if (t->next_id) {
836 			*have_next = 1;
837 			*next = (struct gotweb_url){
838 				.action = TAGS,
839 				.index_page = -1,
840 				.page = qs->page + 1,
841 				.path = qs->path,
842 				.commit = t->next_id,
843 				.headref = qs->headref,
844 			};
845 		}
846 		break;
847 	}
848 }
849 
850 static const struct got_error *
851 gotweb_render_index(struct request *c)
852 {
853 	const struct got_error *error = NULL;
854 	struct server *srv = c->srv;
855 	struct transport *t = c->t;
856 	struct querystring *qs = t->qs;
857 	struct repo_dir *repo_dir = NULL;
858 	DIR *d;
859 	struct dirent **sd_dent = NULL;
860 	unsigned int d_cnt, d_i, d_disp = 0;
861 	unsigned int d_skipped = 0;
862 	int type;
863 
864 	d = opendir(srv->repos_path);
865 	if (d == NULL) {
866 		error = got_error_from_errno2("opendir", srv->repos_path);
867 		return error;
868 	}
869 
870 	d_cnt = scandir(srv->repos_path, &sd_dent, NULL, alphasort);
871 	if (d_cnt == -1) {
872 		sd_dent = NULL;
873 		error = got_error_from_errno2("scandir", srv->repos_path);
874 		goto done;
875 	}
876 
877 	if (gotweb_render_repo_table_hdr(c->tp) == -1)
878 		goto done;
879 
880 	for (d_i = 0; d_i < d_cnt; d_i++) {
881 		if (srv->max_repos > 0 && t->prev_disp == srv->max_repos)
882 			break;
883 
884 		if (strcmp(sd_dent[d_i]->d_name, ".") == 0 ||
885 		    strcmp(sd_dent[d_i]->d_name, "..") == 0) {
886 			d_skipped++;
887 			continue;
888 		}
889 
890 		error = got_path_dirent_type(&type, srv->repos_path,
891 		    sd_dent[d_i]);
892 		if (error)
893 			goto done;
894 		if (type != DT_DIR) {
895 			d_skipped++;
896 			continue;
897 		}
898 
899 		if (qs->index_page > 0 && (qs->index_page *
900 		    srv->max_repos_display) > t->prev_disp) {
901 			t->prev_disp++;
902 			continue;
903 		}
904 
905 		error = gotweb_init_repo_dir(&repo_dir, sd_dent[d_i]->d_name);
906 		if (error)
907 			goto done;
908 
909 		error = gotweb_load_got_path(c, repo_dir);
910 		if (error && error->code == GOT_ERR_NOT_GIT_REPO) {
911 			error = NULL;
912 			gotweb_free_repo_dir(repo_dir);
913 			repo_dir = NULL;
914 			d_skipped++;
915 			continue;
916 		}
917 		if (error && error->code != GOT_ERR_LONELY_PACKIDX)
918 			goto done;
919 
920 		d_disp++;
921 		t->prev_disp++;
922 
923 		if (gotweb_render_repo_fragment(c->tp, repo_dir) == -1)
924 			goto done;
925 
926 		gotweb_free_repo_dir(repo_dir);
927 		repo_dir = NULL;
928 		t->next_disp++;
929 		if (d_disp == srv->max_repos_display)
930 			break;
931 	}
932 	t->repos_total = d_cnt - d_skipped;
933 
934 	if (srv->max_repos_display == 0)
935 		goto done;
936 	if (srv->max_repos > 0 && srv->max_repos < srv->max_repos_display)
937 		goto done;
938 	if (t->repos_total <= srv->max_repos ||
939 	    t->repos_total <= srv->max_repos_display)
940 		goto done;
941 
942 	if (gotweb_render_navs(c->tp) == -1)
943 		goto done;
944 done:
945 	if (sd_dent) {
946 		for (d_i = 0; d_i < d_cnt; d_i++)
947 			free(sd_dent[d_i]);
948 		free(sd_dent);
949 	}
950 	if (d != NULL && closedir(d) == EOF && error == NULL)
951 		error = got_error_from_errno("closedir");
952 	return error;
953 }
954 
955 static const struct got_error *
956 gotweb_render_blame(struct request *c)
957 {
958 	const struct got_error *error = NULL;
959 	struct transport *t = c->t;
960 	struct repo_commit *rc = NULL;
961 	char *age = NULL, *msg = NULL;
962 	int r;
963 
964 	error = got_get_repo_commits(c, 1);
965 	if (error)
966 		return error;
967 
968 	rc = TAILQ_FIRST(&t->repo_commits);
969 
970 	error = gotweb_get_time_str(&age, rc->committer_time, TM_LONG);
971 	if (error)
972 		goto done;
973 	error = gotweb_escape_html(&msg, rc->commit_msg);
974 	if (error)
975 		goto done;
976 
977 	r = fcgi_printf(c, "<div id='blame_title_wrapper'>\n"
978 	    "<div id='blame_title'>Blame</div>\n"
979 	    "</div>\n"		/* #blame_title_wrapper */
980 	    "<div id='blame_content'>\n"
981 	    "<div id='blame_header_wrapper'>\n"
982 	    "<div id='blame_header'>\n"
983 	    "<div class='header_age_title'>Date:</div>\n"
984 	    "<div class='header_age'>%s</div>\n"
985 	    "<div id='header_commit_msg_title'>Message:</div>\n"
986 	    "<div id='header_commit_msg'>%s</div>\n"
987 	    "</div>\n"		/* #blame_header */
988 	    "</div>\n"		/* #blame_header_wrapper */
989 	    "<div class='dotted_line'></div>\n"
990 	    "<div id='blame'>\n",
991 	    age,
992 	    msg);
993 	if (r == -1)
994 		goto done;
995 
996 	error = got_output_file_blame(c);
997 	if (error)
998 		goto done;
999 
1000 	fcgi_printf(c, "</div>\n"	/* #blame */
1001 	    "</div>\n");		/* #blame_content */
1002 done:
1003 	free(age);
1004 	free(msg);
1005 	return error;
1006 }
1007 
1008 static const struct got_error *
1009 gotweb_render_branches(struct request *c)
1010 {
1011 	const struct got_error *error = NULL;
1012 	struct got_reflist_head refs;
1013 	struct got_reflist_entry *re;
1014 	struct transport *t = c->t;
1015 	struct querystring *qs = t->qs;
1016 	struct got_repository *repo = t->repo;
1017 	char *escaped_refname = NULL;
1018 	char *age = NULL;
1019 	int r;
1020 
1021 	TAILQ_INIT(&refs);
1022 
1023 	error = got_ref_list(&refs, repo, "refs/heads",
1024 	    got_ref_cmp_by_name, NULL);
1025 	if (error)
1026 		goto done;
1027 
1028 	r = fcgi_printf(c, "<div id='branches_title_wrapper'>\n"
1029 	    "<div id='branches_title'>Branches</div>\n"
1030 	    "</div>\n"	/* #branches_title_wrapper */
1031 	    "<div id='branches_content'>\n");
1032 	if (r == -1)
1033 		goto done;
1034 
1035 	TAILQ_FOREACH(re, &refs, entry) {
1036 		const char *refname = NULL;
1037 
1038 		if (got_ref_is_symbolic(re->ref))
1039 			continue;
1040 
1041 		refname = got_ref_get_name(re->ref);
1042 		if (refname == NULL) {
1043 			error = got_error_from_errno("strdup");
1044 			goto done;
1045 		}
1046 		if (strncmp(refname, "refs/heads/", 11) != 0)
1047 			continue;
1048 
1049 		error = got_get_repo_age(&age, c, refname, TM_DIFF);
1050 		if (error)
1051 			goto done;
1052 
1053 		if (strncmp(refname, "refs/heads/", 11) == 0)
1054 			refname += 11;
1055 		error = gotweb_escape_html(&escaped_refname, refname);
1056 		if (error)
1057 			goto done;
1058 
1059 		r = fcgi_printf(c, "<div class='branches_wrapper'>\n"
1060 		    "<div class='branches_age'>%s</div>\n"
1061 		    "<div class='branches_space'>&nbsp;</div>\n"
1062 		    "<div class='branch'>", age);
1063 		if (r == -1)
1064 			goto done;
1065 
1066 		r = gotweb_link(c, &(struct gotweb_url){
1067 			.action = SUMMARY,
1068 			.index_page = -1,
1069 			.page = -1,
1070 			.path = qs->path,
1071 			.headref = refname,
1072 		    }, "%s", escaped_refname);
1073 		if (r == -1)
1074 			goto done;
1075 
1076 		if (fcgi_printf(c, "</div>\n"	/* .branch */
1077 		    "<div class='navs_wrapper'>\n"
1078 		    "<div class='navs'>") == -1)
1079 			goto done;
1080 
1081 		r = gotweb_link(c, &(struct gotweb_url){
1082 			.action = SUMMARY,
1083 			.index_page = -1,
1084 			.page = -1,
1085 			.path = qs->path,
1086 			.headref = refname,
1087 		    }, "summary");
1088 		if (r == -1)
1089 			goto done;
1090 
1091 		if (fcgi_printf(c, " | ") == -1)
1092 			goto done;
1093 
1094 		r = gotweb_link(c, &(struct gotweb_url){
1095 			.action = BRIEFS,
1096 			.index_page = -1,
1097 			.page = -1,
1098 			.path = qs->path,
1099 			.headref = refname,
1100 		    }, "commit briefs");
1101 		if (r == -1)
1102 			goto done;
1103 
1104 		if (fcgi_printf(c, " | ") == -1)
1105 			goto done;
1106 
1107 		r = gotweb_link(c, &(struct gotweb_url){
1108 			.action = COMMITS,
1109 			.index_page = -1,
1110 			.page = -1,
1111 			.path = qs->path,
1112 			.headref = refname,
1113 		    }, "commits");
1114 		if (r == -1)
1115 			goto done;
1116 
1117 		r = fcgi_printf(c, "</div>\n"	/* .navs */
1118 		    "</div>\n"			/* .navs_wrapper */
1119 		    "<div class='dotted_line'></div>\n"
1120 		    "</div>\n");		/* .branches_wrapper */
1121 		if (r == -1)
1122 			goto done;
1123 
1124 		free(age);
1125 		age = NULL;
1126 		free(escaped_refname);
1127 		escaped_refname = NULL;
1128 	}
1129 	fcgi_printf(c, "</div>\n"); /* #branches_content */
1130 done:
1131 	free(age);
1132 	free(escaped_refname);
1133 	got_ref_list_free(&refs);
1134 	return error;
1135 }
1136 
1137 static const struct got_error *
1138 gotweb_render_summary(struct request *c)
1139 {
1140 	const struct got_error *error = NULL;
1141 	struct transport *t = c->t;
1142 	struct server *srv = c->srv;
1143 	int r;
1144 
1145 	if (fcgi_printf(c, "<div id='summary_wrapper'>\n") == -1)
1146 		goto done;
1147 
1148 	if (srv->show_repo_description) {
1149 		r = fcgi_printf(c,
1150 		    "<div id='description_title'>Description:</div>\n"
1151 		    "<div id='description'>%s</div>\n",
1152 		    t->repo_dir->description ? t->repo_dir->description : "");
1153 		if (r == -1)
1154 			goto done;
1155 	}
1156 
1157 	if (srv->show_repo_owner) {
1158 		r = fcgi_printf(c,
1159 		    "<div id='repo_owner_title'>Owner:</div>\n"
1160 		    "<div id='repo_owner'>%s</div>\n",
1161 		    t->repo_dir->owner ? t->repo_dir->owner : "");
1162 		if (r == -1)
1163 			goto done;
1164 	}
1165 
1166 	if (srv->show_repo_age) {
1167 		r = fcgi_printf(c,
1168 		    "<div id='last_change_title'>Last Change:</div>\n"
1169 		    "<div id='last_change'>%s</div>\n",
1170 		    t->repo_dir->age);
1171 		if (r == -1)
1172 			goto done;
1173 	}
1174 
1175 	if (srv->show_repo_cloneurl) {
1176 		r = fcgi_printf(c,
1177 		    "<div id='cloneurl_title'>Clone URL:</div>\n"
1178 		    "<div id='cloneurl'>%s</div>\n",
1179 		    t->repo_dir->url ? t->repo_dir->url : "");
1180 		if (r == -1)
1181 			goto done;
1182 	}
1183 
1184 	r = fcgi_printf(c, "</div>\n"); /* #summary_wrapper */
1185 	if (r == -1)
1186 		goto done;
1187 
1188 	if (gotweb_render_briefs(c->tp) == -1)
1189 		goto done;
1190 
1191 	error = gotweb_render_tags(c);
1192 	if (error) {
1193 		log_warnx("%s: %s", __func__, error->msg);
1194 		goto done;
1195 	}
1196 
1197 	error = gotweb_render_branches(c);
1198 	if (error)
1199 		log_warnx("%s: %s", __func__, error->msg);
1200 done:
1201 	return error;
1202 }
1203 
1204 static const struct got_error *
1205 gotweb_render_tag(struct request *c)
1206 {
1207 	const struct got_error *error = NULL;
1208 	struct repo_tag *rt = NULL;
1209 	struct transport *t = c->t;
1210 	char *tagname = NULL, *age = NULL, *author = NULL, *msg = NULL;
1211 
1212 	error = got_get_repo_tags(c, 1);
1213 	if (error)
1214 		goto done;
1215 
1216 	if (t->tag_count == 0) {
1217 		error = got_error_set_errno(GOT_ERR_BAD_OBJ_ID,
1218 		    "bad commit id");
1219 		goto done;
1220 	}
1221 
1222 	rt = TAILQ_LAST(&t->repo_tags, repo_tags_head);
1223 
1224 	error = gotweb_get_time_str(&age, rt->tagger_time, TM_LONG);
1225 	if (error)
1226 		goto done;
1227 	error = gotweb_escape_html(&author, rt->tagger);
1228 	if (error)
1229 		goto done;
1230 	error = gotweb_escape_html(&msg, rt->commit_msg);
1231 	if (error)
1232 		goto done;
1233 
1234 	tagname = rt->tag_name;
1235 	if (strncmp(tagname, "refs/", 5) == 0)
1236 		tagname += 5;
1237 	error = gotweb_escape_html(&tagname, tagname);
1238 	if (error)
1239 		goto done;
1240 
1241 	fcgi_printf(c, "<div id='tags_title_wrapper'>\n"
1242 	    "<div id='tags_title'>Tag</div>\n"
1243 	    "</div>\n"		/* #tags_title_wrapper */
1244 	    "<div id='tags_content'>\n"
1245 	    "<div id='tag_header_wrapper'>\n"
1246 	    "<div id='tag_header'>\n"
1247 	    "<div class='header_commit_title'>Commit:</div>\n"
1248 	    "<div class='header_commit'>%s"
1249 	    " <span class='refs_str'>(%s)</span></div>\n"
1250 	    "<div class='header_author_title'>Tagger:</div>\n"
1251 	    "<div class='header_author'>%s</div>\n"
1252 	    "<div class='header_age_title'>Date:</div>\n"
1253 	    "<div class='header_age'>%s</div>\n"
1254 	    "<div id='header_commit_msg_title'>Message:</div>\n"
1255 	    "<div id='header_commit_msg'>%s</div>\n"
1256 	    "</div>\n"		/* #tag_header */
1257 	    "<div class='dotted_line'></div>\n"
1258 	    "<div id='tag_commit'>\n%s</div>"
1259 	    "</div>"		/* #tag_header_wrapper */
1260 	    "</div>",		/* #tags_content */
1261 	    rt->commit_id,
1262 	    tagname,
1263 	    author,
1264 	    age,
1265 	    msg,
1266 	    rt->tag_commit);
1267 
1268 done:
1269 	free(age);
1270 	free(author);
1271 	free(msg);
1272 	return error;
1273 }
1274 
1275 static const struct got_error *
1276 gotweb_render_tags(struct request *c)
1277 {
1278 	const struct got_error *error = NULL;
1279 	struct repo_tag *rt = NULL;
1280 	struct server *srv = c->srv;
1281 	struct transport *t = c->t;
1282 	struct querystring *qs = t->qs;
1283 	struct repo_dir *repo_dir = t->repo_dir;
1284 	char *age = NULL, *tagname = NULL, *msg = NULL, *newline;
1285 	int r, commit_found = 0;
1286 
1287 	if (qs->action == BRIEFS) {
1288 		qs->action = TAGS;
1289 		error = got_get_repo_tags(c, D_MAXSLCOMMDISP);
1290 	} else
1291 		error = got_get_repo_tags(c, srv->max_commits_display);
1292 	if (error)
1293 		goto done;
1294 
1295 	r = fcgi_printf(c, "<div id='tags_title_wrapper'>\n"
1296 	    "<div id='tags_title'>Tags</div>\n"
1297 	    "</div>\n"		/* #tags_title_wrapper */
1298 	    "<div id='tags_content'>\n");
1299 	if (r == -1)
1300 		goto done;
1301 
1302 	if (t->tag_count == 0) {
1303 		r = fcgi_printf(c, "<div id='err_content'>%s\n</div>\n",
1304 		    "This repository contains no tags");
1305 		if (r == -1)
1306 			goto done;
1307 	}
1308 
1309 	TAILQ_FOREACH(rt, &t->repo_tags, entry) {
1310 		if (commit_found == 0 && qs->commit != NULL) {
1311 			if (strcmp(qs->commit, rt->commit_id) != 0)
1312 				continue;
1313 			else
1314 				commit_found = 1;
1315 		}
1316 		error = gotweb_get_time_str(&age, rt->tagger_time, TM_DIFF);
1317 		if (error)
1318 			goto done;
1319 
1320 		tagname = rt->tag_name;
1321 		if (strncmp(tagname, "refs/tags/", 10) == 0)
1322 			tagname += 10;
1323 		error = gotweb_escape_html(&tagname, tagname);
1324 		if (error)
1325 			goto done;
1326 
1327 		if (rt->tag_commit != NULL) {
1328 			newline = strchr(rt->tag_commit, '\n');
1329 			if (newline)
1330 				*newline = '\0';
1331 			error = gotweb_escape_html(&msg, rt->tag_commit);
1332 			if (error)
1333 				goto done;
1334 		}
1335 
1336 		if (fcgi_printf(c, "<div class='tag_age'>%s</div>\n"
1337 		    "<div class='tag'>%s</div>\n"
1338 		    "<div class='tag_log'>", age, tagname) == -1)
1339 			goto done;
1340 
1341 		r = gotweb_link(c, &(struct gotweb_url){
1342 			.action = TAG,
1343 			.index_page = -1,
1344 			.page = -1,
1345 			.path = repo_dir->name,
1346 			.commit = rt->commit_id,
1347 		    }, "%s", msg ? msg : "");
1348 		if (r == -1)
1349 			goto done;
1350 
1351 		if (fcgi_printf(c, "</div>\n"	/* .tag_log */
1352 		    "<div class='navs_wrapper'>\n"
1353 		    "<div class='navs'>") == -1)
1354 			goto done;
1355 
1356 		r = gotweb_link(c, &(struct gotweb_url){
1357 			.action = TAG,
1358 			.index_page = -1,
1359 			.page = -1,
1360 			.path = repo_dir->name,
1361 			.commit = rt->commit_id,
1362 		    }, "tag");
1363 		if (r == -1)
1364 			goto done;
1365 
1366 		if (fcgi_printf(c, " | ") == -1)
1367 			goto done;
1368 
1369 		r = gotweb_link(c, &(struct gotweb_url){
1370 			.action = BRIEFS,
1371 			.index_page = -1,
1372 			.page = -1,
1373 			.path = repo_dir->name,
1374 			.commit = rt->commit_id,
1375 		    }, "commit briefs");
1376 		if (r == -1)
1377 			goto done;
1378 
1379 		if (fcgi_printf(c, " | ") == -1)
1380 			goto done;
1381 
1382 		r = gotweb_link(c, &(struct gotweb_url){
1383 			.action = COMMITS,
1384 			.index_page = -1,
1385 			.page = -1,
1386 			.path = repo_dir->name,
1387 			.commit = rt->commit_id,
1388 		    }, "commits");
1389 		if (r == -1)
1390 			goto done;
1391 
1392 		r = fcgi_printf(c,
1393 		    "</div>\n"	/* .navs */
1394 		    "</div>\n"	/* .navs_wrapper */
1395 		    "<div class='dotted_line'></div>\n");
1396 		if (r == -1)
1397 			goto done;
1398 
1399 		free(age);
1400 		age = NULL;
1401 		free(tagname);
1402 		tagname = NULL;
1403 		free(msg);
1404 		msg = NULL;
1405 	}
1406 	if (t->next_id || t->prev_id) {
1407 		if (gotweb_render_navs(c->tp) == -1)
1408 			goto done;
1409 	}
1410 	fcgi_printf(c, "</div>\n"); /* #tags_content */
1411 done:
1412 	free(age);
1413 	free(tagname);
1414 	free(msg);
1415 	return error;
1416 }
1417 
1418 const struct got_error *
1419 gotweb_escape_html(char **escaped_html, const char *orig_html)
1420 {
1421 	const struct got_error *error = NULL;
1422 	struct escape_pair {
1423 		char c;
1424 		const char *s;
1425 	} esc[] = {
1426 		{ '>', "&gt;" },
1427 		{ '<', "&lt;" },
1428 		{ '&', "&amp;" },
1429 		{ '"', "&quot;" },
1430 		{ '\'', "&apos;" },
1431 		{ '\n', "<br />" },
1432 	};
1433 	size_t orig_len, len;
1434 	int i, j, x;
1435 
1436 	orig_len = strlen(orig_html);
1437 	len = orig_len;
1438 	for (i = 0; i < orig_len; i++) {
1439 		for (j = 0; j < nitems(esc); j++) {
1440 			if (orig_html[i] != esc[j].c)
1441 				continue;
1442 			len += strlen(esc[j].s) - 1 /* escaped char */;
1443 		}
1444 	}
1445 
1446 	*escaped_html = calloc(len + 1 /* NUL */, sizeof(**escaped_html));
1447 	if (*escaped_html == NULL)
1448 		return got_error_from_errno("calloc");
1449 
1450 	x = 0;
1451 	for (i = 0; i < orig_len; i++) {
1452 		int escaped = 0;
1453 		for (j = 0; j < nitems(esc); j++) {
1454 			if (orig_html[i] != esc[j].c)
1455 				continue;
1456 
1457 			if (strlcat(*escaped_html, esc[j].s, len + 1)
1458 			    >= len + 1) {
1459 				error = got_error(GOT_ERR_NO_SPACE);
1460 				goto done;
1461 			}
1462 			x += strlen(esc[j].s);
1463 			escaped = 1;
1464 			break;
1465 		}
1466 		if (!escaped) {
1467 			(*escaped_html)[x] = orig_html[i];
1468 			x++;
1469 		}
1470 	}
1471 done:
1472 	if (error) {
1473 		free(*escaped_html);
1474 		*escaped_html = NULL;
1475 	} else {
1476 		(*escaped_html)[x] = '\0';
1477 	}
1478 
1479 	return error;
1480 }
1481 
1482 static inline int
1483 should_urlencode(int c)
1484 {
1485 	if (c <= ' ' || c >= 127)
1486 		return 1;
1487 
1488 	switch (c) {
1489 		/* gen-delim */
1490 	case ':':
1491 	case '/':
1492 	case '?':
1493 	case '#':
1494 	case '[':
1495 	case ']':
1496 	case '@':
1497 		/* sub-delims */
1498 	case '!':
1499 	case '$':
1500 	case '&':
1501 	case '\'':
1502 	case '(':
1503 	case ')':
1504 	case '*':
1505 	case '+':
1506 	case ',':
1507 	case ';':
1508 	case '=':
1509 		/* needed because the URLs are embedded into the HTML */
1510 	case '\"':
1511 		return 1;
1512 	default:
1513 		return 0;
1514 	}
1515 }
1516 
1517 static char *
1518 gotweb_urlencode(const char *str)
1519 {
1520 	const char *s;
1521 	char *escaped;
1522 	size_t i, len;
1523 	int a, b;
1524 
1525 	len = 0;
1526 	for (s = str; *s; ++s) {
1527 		len++;
1528 		if (should_urlencode(*s))
1529 			len += 2;
1530 	}
1531 
1532 	escaped = calloc(1, len + 1);
1533 	if (escaped == NULL)
1534 		return NULL;
1535 
1536 	i = 0;
1537 	for (s = str; *s; ++s) {
1538 		if (should_urlencode(*s)) {
1539 			a = (*s & 0xF0) >> 4;
1540 			b = (*s & 0x0F);
1541 
1542 			escaped[i++] = '%';
1543 			escaped[i++] = a <= 9 ? ('0' + a) : ('7' + a);
1544 			escaped[i++] = b <= 9 ? ('0' + b) : ('7' + b);
1545 		} else
1546 			escaped[i++] = *s;
1547 	}
1548 
1549 	return escaped;
1550 }
1551 
1552 const char *
1553 gotweb_action_name(int action)
1554 {
1555 	switch (action) {
1556 	case BLAME:
1557 		return "blame";
1558 	case BLOB:
1559 		return "blob";
1560 	case BLOBRAW:
1561 		return "blobraw";
1562 	case BRIEFS:
1563 		return "briefs";
1564 	case COMMITS:
1565 		return "commits";
1566 	case DIFF:
1567 		return "diff";
1568 	case ERR:
1569 		return "err";
1570 	case INDEX:
1571 		return "index";
1572 	case SUMMARY:
1573 		return "summary";
1574 	case TAG:
1575 		return "tag";
1576 	case TAGS:
1577 		return "tags";
1578 	case TREE:
1579 		return "tree";
1580 	case RSS:
1581 		return "rss";
1582 	default:
1583 		return NULL;
1584 	}
1585 }
1586 
1587 int
1588 gotweb_render_url(struct request *c, struct gotweb_url *url)
1589 {
1590 	const char *sep = "?", *action;
1591 	char *tmp;
1592 	int r;
1593 
1594 	action = gotweb_action_name(url->action);
1595 	if (action != NULL) {
1596 		if (fcgi_printf(c, "?action=%s", action) == -1)
1597 			return -1;
1598 		sep = "&";
1599 	}
1600 
1601 	if (url->commit) {
1602 		if (fcgi_printf(c, "%scommit=%s", sep, url->commit) == -1)
1603 			return -1;
1604 		sep = "&";
1605 	}
1606 
1607 	if (url->previd) {
1608 		if (fcgi_printf(c, "%sprevid=%s", sep, url->previd) == -1)
1609 			return -1;
1610 		sep = "&";
1611 	}
1612 
1613 	if (url->prevset) {
1614 		if (fcgi_printf(c, "%sprevset=%s", sep, url->prevset) == -1)
1615 			return -1;
1616 		sep = "&";
1617 	}
1618 
1619 	if (url->file) {
1620 		tmp = gotweb_urlencode(url->file);
1621 		if (tmp == NULL)
1622 			return -1;
1623 		r = fcgi_printf(c, "%sfile=%s", sep, tmp);
1624 		free(tmp);
1625 		if (r == -1)
1626 			return -1;
1627 		sep = "&";
1628 	}
1629 
1630 	if (url->folder) {
1631 		tmp = gotweb_urlencode(url->folder);
1632 		if (tmp == NULL)
1633 			return -1;
1634 		r = fcgi_printf(c, "%sfolder=%s", sep, tmp);
1635 		free(tmp);
1636 		if (r == -1)
1637 			return -1;
1638 		sep = "&";
1639 	}
1640 
1641 	if (url->headref) {
1642 		tmp = gotweb_urlencode(url->headref);
1643 		if (tmp == NULL)
1644 			return -1;
1645 		r = fcgi_printf(c, "%sheadref=%s", sep, url->headref);
1646 		free(tmp);
1647 		if (r == -1)
1648 			return -1;
1649 		sep = "&";
1650 	}
1651 
1652 	if (url->index_page != -1) {
1653 		if (fcgi_printf(c, "%sindex_page=%d", sep,
1654 		    url->index_page) == -1)
1655 			return -1;
1656 		sep = "&";
1657 	}
1658 
1659 	if (url->path) {
1660 		tmp = gotweb_urlencode(url->path);
1661 		if (tmp == NULL)
1662 			return -1;
1663 		r = fcgi_printf(c, "%spath=%s", sep, tmp);
1664 		free(tmp);
1665 		if (r == -1)
1666 			return -1;
1667 		sep = "&";
1668 	}
1669 
1670 	if (url->page != -1) {
1671 		if (fcgi_printf(c, "%spage=%d", sep, url->page) == -1)
1672 			return -1;
1673 		sep = "&";
1674 	}
1675 
1676 	return 0;
1677 }
1678 
1679 int
1680 gotweb_render_absolute_url(struct request *c, struct gotweb_url *url)
1681 {
1682 	struct template	*tp = c->tp;
1683 	const char	*proto = c->https ? "https" : "http";
1684 
1685 	if (fcgi_puts(tp, proto) == -1 ||
1686 	    fcgi_puts(tp, "://") == -1 ||
1687 	    tp_htmlescape(tp, c->server_name) == -1 ||
1688 	    tp_htmlescape(tp, c->document_uri) == -1)
1689 		return -1;
1690 
1691 	return gotweb_render_url(c, url);
1692 }
1693 
1694 int
1695 gotweb_link(struct request *c, struct gotweb_url *url, const char *fmt, ...)
1696 {
1697 	va_list ap;
1698 	int r;
1699 
1700 	if (fcgi_printf(c, "<a href='") == -1)
1701 		return -1;
1702 
1703 	if (gotweb_render_url(c, url) == -1)
1704 		return -1;
1705 
1706 	if (fcgi_printf(c, "'>") == -1)
1707 		return -1;
1708 
1709 	va_start(ap, fmt);
1710 	r = fcgi_vprintf(c, fmt, ap);
1711 	va_end(ap);
1712 	if (r == -1)
1713 		return -1;
1714 
1715 	if (fcgi_printf(c, "</a>"))
1716 		return -1;
1717 	return 0;
1718 }
1719 
1720 static struct got_repository *
1721 find_cached_repo(struct server *srv, const char *path)
1722 {
1723 	int i;
1724 
1725 	for (i = 0; i < srv->ncached_repos; i++) {
1726 		if (strcmp(srv->cached_repos[i].path, path) == 0)
1727 			return srv->cached_repos[i].repo;
1728 	}
1729 
1730 	return NULL;
1731 }
1732 
1733 static const struct got_error *
1734 cache_repo(struct got_repository **new, struct server *srv,
1735     struct repo_dir *repo_dir, struct socket *sock)
1736 {
1737 	const struct got_error *error = NULL;
1738 	struct got_repository *repo;
1739 	struct cached_repo *cr;
1740 	int evicted = 0;
1741 
1742 	if (srv->ncached_repos >= GOTWEBD_REPO_CACHESIZE) {
1743 		cr = &srv->cached_repos[srv->ncached_repos - 1];
1744 		error = got_repo_close(cr->repo);
1745 		memset(cr, 0, sizeof(*cr));
1746 		srv->ncached_repos--;
1747 		if (error)
1748 			return error;
1749 		memmove(&srv->cached_repos[1], &srv->cached_repos[0],
1750 		    srv->ncached_repos * sizeof(srv->cached_repos[0]));
1751 		cr = &srv->cached_repos[0];
1752 		evicted = 1;
1753 	} else {
1754 		cr = &srv->cached_repos[srv->ncached_repos];
1755 	}
1756 
1757 	error = got_repo_open(&repo, repo_dir->path, NULL, sock->pack_fds);
1758 	if (error) {
1759 		if (evicted) {
1760 			memmove(&srv->cached_repos[0], &srv->cached_repos[1],
1761 			    srv->ncached_repos * sizeof(srv->cached_repos[0]));
1762 		}
1763 		return error;
1764 	}
1765 
1766 	if (strlcpy(cr->path, repo_dir->path, sizeof(cr->path))
1767 	    >= sizeof(cr->path)) {
1768 		if (evicted) {
1769 			memmove(&srv->cached_repos[0], &srv->cached_repos[1],
1770 			    srv->ncached_repos * sizeof(srv->cached_repos[0]));
1771 		}
1772 		return got_error(GOT_ERR_NO_SPACE);
1773 	}
1774 
1775 	cr->repo = repo;
1776 	srv->ncached_repos++;
1777 	*new = repo;
1778 	return NULL;
1779 }
1780 
1781 static const struct got_error *
1782 gotweb_load_got_path(struct request *c, struct repo_dir *repo_dir)
1783 {
1784 	const struct got_error *error = NULL;
1785 	struct socket *sock = c->sock;
1786 	struct server *srv = c->srv;
1787 	struct transport *t = c->t;
1788 	struct got_repository *repo = NULL;
1789 	DIR *dt;
1790 	char *dir_test;
1791 
1792 	if (asprintf(&dir_test, "%s/%s/%s", srv->repos_path, repo_dir->name,
1793 	    GOTWEB_GIT_DIR) == -1)
1794 		return got_error_from_errno("asprintf");
1795 
1796 	dt = opendir(dir_test);
1797 	if (dt == NULL) {
1798 		free(dir_test);
1799 	} else {
1800 		repo_dir->path = dir_test;
1801 		dir_test = NULL;
1802 		goto done;
1803 	}
1804 
1805 	if (asprintf(&dir_test, "%s/%s", srv->repos_path,
1806 	    repo_dir->name) == -1)
1807 		return got_error_from_errno("asprintf");
1808 
1809 	dt = opendir(dir_test);
1810 	if (dt == NULL) {
1811 		error = got_error_path(repo_dir->name, GOT_ERR_NOT_GIT_REPO);
1812 		goto err;
1813 	} else {
1814 		repo_dir->path = dir_test;
1815 		dir_test = NULL;
1816 	}
1817 
1818 done:
1819 	if (srv->respect_exportok &&
1820 	    faccessat(dirfd(dt), "git-daemon-export-ok", F_OK, 0) == -1) {
1821 		error = got_error_path(repo_dir->name, GOT_ERR_NOT_GIT_REPO);
1822 		goto err;
1823 	}
1824 
1825 	repo = find_cached_repo(srv, repo_dir->path);
1826 	if (repo == NULL) {
1827 		error = cache_repo(&repo, srv, repo_dir, sock);
1828 		if (error)
1829 			goto err;
1830 	}
1831 	t->repo = repo;
1832 	error = gotweb_get_repo_description(&repo_dir->description, srv,
1833 	    repo_dir->path, dirfd(dt));
1834 	if (error)
1835 		goto err;
1836 	error = got_get_repo_owner(&repo_dir->owner, c);
1837 	if (error)
1838 		goto err;
1839 	error = got_get_repo_age(&repo_dir->age, c, NULL, TM_DIFF);
1840 	if (error)
1841 		goto err;
1842 	error = gotweb_get_clone_url(&repo_dir->url, srv, repo_dir->path,
1843 	    dirfd(dt));
1844 err:
1845 	free(dir_test);
1846 	if (dt != NULL && closedir(dt) == EOF && error == NULL)
1847 		error = got_error_from_errno("closedir");
1848 	return error;
1849 }
1850 
1851 static const struct got_error *
1852 gotweb_init_repo_dir(struct repo_dir **repo_dir, const char *dir)
1853 {
1854 	const struct got_error *error;
1855 
1856 	*repo_dir = calloc(1, sizeof(**repo_dir));
1857 	if (*repo_dir == NULL)
1858 		return got_error_from_errno("calloc");
1859 
1860 	if (asprintf(&(*repo_dir)->name, "%s", dir) == -1) {
1861 		error = got_error_from_errno("asprintf");
1862 		free(*repo_dir);
1863 		*repo_dir = NULL;
1864 		return error;
1865 	}
1866 	(*repo_dir)->owner = NULL;
1867 	(*repo_dir)->description = NULL;
1868 	(*repo_dir)->url = NULL;
1869 	(*repo_dir)->age = NULL;
1870 	(*repo_dir)->path = NULL;
1871 
1872 	return NULL;
1873 }
1874 
1875 static const struct got_error *
1876 gotweb_get_repo_description(char **description, struct server *srv,
1877     const char *dirpath, int dir)
1878 {
1879 	const struct got_error *error = NULL;
1880 	struct stat sb;
1881 	int fd = -1;
1882 	off_t len;
1883 
1884 	*description = NULL;
1885 	if (srv->show_repo_description == 0)
1886 		return NULL;
1887 
1888 	fd = openat(dir, "description", O_RDONLY);
1889 	if (fd == -1) {
1890 		if (errno != ENOENT && errno != EACCES) {
1891 			error = got_error_from_errno_fmt("openat %s/%s",
1892 			    dirpath, "description");
1893 		}
1894 		goto done;
1895 	}
1896 
1897 	if (fstat(fd, &sb) == -1) {
1898 		error = got_error_from_errno_fmt("fstat %s/%s",
1899 		    dirpath, "description");
1900 		goto done;
1901 	}
1902 
1903 	len = sb.st_size;
1904 	if (len > GOTWEBD_MAXDESCRSZ - 1)
1905 		len = GOTWEBD_MAXDESCRSZ - 1;
1906 
1907 	*description = calloc(len + 1, sizeof(**description));
1908 	if (*description == NULL) {
1909 		error = got_error_from_errno("calloc");
1910 		goto done;
1911 	}
1912 
1913 	if (read(fd, *description, len) == -1)
1914 		error = got_error_from_errno("read");
1915 done:
1916 	if (fd != -1 && close(fd) == -1 && error == NULL)
1917 		error = got_error_from_errno("close");
1918 	return error;
1919 }
1920 
1921 static const struct got_error *
1922 gotweb_get_clone_url(char **url, struct server *srv, const char *dirpath,
1923     int dir)
1924 {
1925 	const struct got_error *error = NULL;
1926 	struct stat sb;
1927 	int fd = -1;
1928 	off_t len;
1929 
1930 	*url = NULL;
1931 	if (srv->show_repo_cloneurl == 0)
1932 		return NULL;
1933 
1934 	fd = openat(dir, "cloneurl", O_RDONLY);
1935 	if (fd == -1) {
1936 		if (errno != ENOENT && errno != EACCES) {
1937 			error = got_error_from_errno_fmt("openat %s/%s",
1938 			    dirpath, "cloneurl");
1939 		}
1940 		goto done;
1941 	}
1942 
1943 	if (fstat(fd, &sb) == -1) {
1944 		error = got_error_from_errno_fmt("fstat %s/%s",
1945 		    dirpath, "cloneurl");
1946 		goto done;
1947 	}
1948 
1949 	len = sb.st_size;
1950 	if (len > GOTWEBD_MAXCLONEURLSZ - 1)
1951 		len = GOTWEBD_MAXCLONEURLSZ - 1;
1952 
1953 	*url = calloc(len + 1, sizeof(**url));
1954 	if (*url == NULL) {
1955 		error = got_error_from_errno("calloc");
1956 		goto done;
1957 	}
1958 
1959 	if (read(fd, *url, len) == -1)
1960 		error = got_error_from_errno("read");
1961 done:
1962 	if (fd != -1 && close(fd) == -1 && error == NULL)
1963 		error = got_error_from_errno("close");
1964 	return error;
1965 }
1966 
1967 const struct got_error *
1968 gotweb_get_time_str(char **repo_age, time_t committer_time, int ref_tm)
1969 {
1970 	struct tm tm;
1971 	long long diff_time;
1972 	const char *years = "years ago", *months = "months ago";
1973 	const char *weeks = "weeks ago", *days = "days ago";
1974 	const char *hours = "hours ago",  *minutes = "minutes ago";
1975 	const char *seconds = "seconds ago", *now = "right now";
1976 	char *s;
1977 	char datebuf[64];
1978 	size_t r;
1979 
1980 	*repo_age = NULL;
1981 
1982 	switch (ref_tm) {
1983 	case TM_DIFF:
1984 		diff_time = time(NULL) - committer_time;
1985 		if (diff_time > 60 * 60 * 24 * 365 * 2) {
1986 			if (asprintf(repo_age, "%lld %s",
1987 			    (diff_time / 60 / 60 / 24 / 365), years) == -1)
1988 				return got_error_from_errno("asprintf");
1989 		} else if (diff_time > 60 * 60 * 24 * (365 / 12) * 2) {
1990 			if (asprintf(repo_age, "%lld %s",
1991 			    (diff_time / 60 / 60 / 24 / (365 / 12)),
1992 			    months) == -1)
1993 				return got_error_from_errno("asprintf");
1994 		} else if (diff_time > 60 * 60 * 24 * 7 * 2) {
1995 			if (asprintf(repo_age, "%lld %s",
1996 			    (diff_time / 60 / 60 / 24 / 7), weeks) == -1)
1997 				return got_error_from_errno("asprintf");
1998 		} else if (diff_time > 60 * 60 * 24 * 2) {
1999 			if (asprintf(repo_age, "%lld %s",
2000 			    (diff_time / 60 / 60 / 24), days) == -1)
2001 				return got_error_from_errno("asprintf");
2002 		} else if (diff_time > 60 * 60 * 2) {
2003 			if (asprintf(repo_age, "%lld %s",
2004 			    (diff_time / 60 / 60), hours) == -1)
2005 				return got_error_from_errno("asprintf");
2006 		} else if (diff_time > 60 * 2) {
2007 			if (asprintf(repo_age, "%lld %s", (diff_time / 60),
2008 			    minutes) == -1)
2009 				return got_error_from_errno("asprintf");
2010 		} else if (diff_time > 2) {
2011 			if (asprintf(repo_age, "%lld %s", diff_time,
2012 			    seconds) == -1)
2013 				return got_error_from_errno("asprintf");
2014 		} else {
2015 			if (asprintf(repo_age, "%s", now) == -1)
2016 				return got_error_from_errno("asprintf");
2017 		}
2018 		break;
2019 	case TM_LONG:
2020 		if (gmtime_r(&committer_time, &tm) == NULL)
2021 			return got_error_from_errno("gmtime_r");
2022 
2023 		s = asctime_r(&tm, datebuf);
2024 		if (s == NULL)
2025 			return got_error_from_errno("asctime_r");
2026 
2027 		if (asprintf(repo_age, "%s UTC", datebuf) == -1)
2028 			return got_error_from_errno("asprintf");
2029 		break;
2030 	case TM_RFC822:
2031 		if (gmtime_r(&committer_time, &tm) == NULL)
2032 			return got_error_from_errno("gmtime_r");
2033 
2034 		r = strftime(datebuf, sizeof(datebuf),
2035 		    "%a, %d %b %Y %H:%M:%S GMT", &tm);
2036 		if (r == 0)
2037 			return got_error(GOT_ERR_NO_SPACE);
2038 
2039 		*repo_age = strdup(datebuf);
2040 		if (*repo_age == NULL)
2041 			return got_error_from_errno("asprintf");
2042 		break;
2043 	}
2044 	return NULL;
2045 }