From: Joshua Juran Date: Wed, 01 Sep 2010 10:00:20 GMT Subject: Re: html page display via cgit Message-ID: <9D2F75AD-B25E-4730-82FA-E8C5F73FCE1B@gmail.com> In-Reply-To: On Sep 1, 2010, at 2:46 AM, Ævar Arnfjörð Bjarmason wrote: > On Wed, Sep 1, 2010 at 09:32, Shivdas Gujare > wrote: > >> I hope, this is the right mailing list for cgit as well. >> I am trying to add some "html logs" inside cgit, but I can't open >> these logs via cgit inside firefox, i.e. cgit open every files in >> "plain" format, >> would like to know if it is possible to open "html" pages inside cgit >> so that if I click on html page added into git, it opens in html and >> not in plain format. >> >> for example: >> if I click on "download.html" from >> "http://cgit.freedesktop.org/~lb/mesa/tree/docs" it shows a raw file >> as "http://cgit.freedesktop.org/~lb/mesa/tree/docs/download.html" >> and if I click on "plain" it opens in firefox like >> "http://cgit.freedesktop.org/~lb/mesa/plain/docs/download.html" >> but here I am trying to open this "download.html" inside cgit so that >> I can view it like html web page and not as "plain" text file. >> >> Thanks for any help or pointers. > > I don't know, but that's probably deliberate. You're viewing a /plain/ > link, which should be the equivalent of "git show". > > There's also XSS security implications to serving things as text/html > on a shared hosting site if the main site serves cookies or otherwise > has user logins. One solution is parse the content server-side and re-render as sanitized HTML. In addition to stripping out scripts and frames, this would avoid sending broken markup produced by someone else under your name, or serving up otherwise well-formed XHTML as text/html. Josh