cgit and symlinks

[MonkZ]

Am 07.03.2017 um 00:35 schrieb John Keeping:
> We can't reliably follow the link because there is no guarantee that the
> target lies within the repository and I don't know what we would output
> for the case where we can't display the target.

INADH (I'm not a dev here)

I would recommend to continue ignoring it or returning the blob, because
following symlinks (internally) might result -  if not done carefully -
in directory traversal security issues. Maybe resolving a symlink to a
HTTP301 could work.

For the UI there might be a html-link (in a notification box "This is a
symlink that points to ...") to the symlink-destination below or above
the blob, to get a user via click to a file/directory.

Regards,
MonkZ

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: OpenPGP digital signature
URL: <http://lists.zx2c4.com/pipermail/cgit/attachments/20170308/1daf3f21/attachment.asc>