Add `strict-export` option

This option is used to specify a filename which needs to be present in
the repositories found during `scan-path` processing. By setting this
option to 'git-daemon-export-ok', only repositories explicitly marked
for git daemon export will be included in the cgit configuration.

Signed-off-by: Felix Hanley <felix@seconddrawer.com.au>
Signed-off-by: Lars Hjemli <hjemli@gmail.com>

4 files changed, 14 insertions, 0 deletions

diff --git a/cgit.c b/cgit.c
index 96900bb..412fbf0 100644
--- a/cgit.c
+++ b/cgit.c
@@ -1,776 +1,778 @@
 /* cgit.c: cgi for the git scm
  *
  * Copyright (C) 2006 Lars Hjemli
  * Copyright (C) 2010 Jason A. Donenfeld <Jason@zx2c4.com>
  *
  * Licensed under GNU General Public License v2
  *   (see COPYING for full license text)
  */
 
 #include "cgit.h"
 #include "cache.h"
 #include "cmd.h"
 #include "configfile.h"
 #include "html.h"
 #include "ui-shared.h"
 #include "ui-stats.h"
 #include "scan-tree.h"
 
 const char *cgit_version = CGIT_VERSION;
 
 void add_mimetype(const char *name, const char *value)
 {
 	struct string_list_item *item;
 
 	item = string_list_insert(&ctx.cfg.mimetypes, xstrdup(name));
 	item->util = xstrdup(value);
 }
 
 struct cgit_filter *new_filter(const char *cmd, int extra_args)
 {
 	struct cgit_filter *f;
 
 	if (!cmd || !cmd[0])
 		return NULL;
 
 	f = xmalloc(sizeof(struct cgit_filter));
 	f->cmd = xstrdup(cmd);
 	f->argv = xmalloc((2 + extra_args) * sizeof(char *));
 	f->argv[0] = f->cmd;
 	f->argv[1] = NULL;
 	return f;
 }
 
 static void process_cached_repolist(const char *path);
 
 void repo_config(struct cgit_repo *repo, const char *name, const char *value)
 {
 	if (!strcmp(name, "name"))
 		repo->name = xstrdup(value);
 	else if (!strcmp(name, "clone-url"))
 		repo->clone_url = xstrdup(value);
 	else if (!strcmp(name, "desc"))
 		repo->desc = xstrdup(value);
 	else if (!strcmp(name, "owner"))
 		repo->owner = xstrdup(value);
 	else if (!strcmp(name, "defbranch"))
 		repo->defbranch = xstrdup(value);
 	else if (!strcmp(name, "snapshots"))
 		repo->snapshots = ctx.cfg.snapshots & cgit_parse_snapshots_mask(value);
 	else if (!strcmp(name, "enable-log-filecount"))
 		repo->enable_log_filecount = ctx.cfg.enable_log_filecount * atoi(value);
 	else if (!strcmp(name, "enable-log-linecount"))
 		repo->enable_log_linecount = ctx.cfg.enable_log_linecount * atoi(value);
 	else if (!strcmp(name, "enable-remote-branches"))
 		repo->enable_remote_branches = atoi(value);
 	else if (!strcmp(name, "enable-subject-links"))
 		repo->enable_subject_links = atoi(value);
 	else if (!strcmp(name, "max-stats"))
 		repo->max_stats = cgit_find_stats_period(value, NULL);
 	else if (!strcmp(name, "module-link"))
 		repo->module_link= xstrdup(value);
 	else if (!strcmp(name, "section"))
 		repo->section = xstrdup(value);
 	else if (!strcmp(name, "readme") && value != NULL) {
 		repo->readme = xstrdup(value);
 	} else if (ctx.cfg.enable_filter_overrides) {
 		if (!strcmp(name, "about-filter"))
 			repo->about_filter = new_filter(value, 0);
 		else if (!strcmp(name, "commit-filter"))
 			repo->commit_filter = new_filter(value, 0);
 		else if (!strcmp(name, "source-filter"))
 			repo->source_filter = new_filter(value, 1);
 	}
 }
 
 void config_cb(const char *name, const char *value)
 {
 	if (!strcmp(name, "section") || !strcmp(name, "repo.group"))
 		ctx.cfg.section = xstrdup(value);
 	else if (!strcmp(name, "repo.url"))
 		ctx.repo = cgit_add_repo(value);
 	else if (ctx.repo && !strcmp(name, "repo.path"))
 		ctx.repo->path = trim_end(value, '/');
 	else if (ctx.repo && !prefixcmp(name, "repo."))
 		repo_config(ctx.repo, name + 5, value);
 	else if (!strcmp(name, "readme"))
 		ctx.cfg.readme = xstrdup(value);
 	else if (!strcmp(name, "root-title"))
 		ctx.cfg.root_title = xstrdup(value);
 	else if (!strcmp(name, "root-desc"))
 		ctx.cfg.root_desc = xstrdup(value);
 	else if (!strcmp(name, "root-readme"))
 		ctx.cfg.root_readme = xstrdup(value);
 	else if (!strcmp(name, "css"))
 		ctx.cfg.css = xstrdup(value);
 	else if (!strcmp(name, "favicon"))
 		ctx.cfg.favicon = xstrdup(value);
 	else if (!strcmp(name, "footer"))
 		ctx.cfg.footer = xstrdup(value);
 	else if (!strcmp(name, "head-include"))
 		ctx.cfg.head_include = xstrdup(value);
 	else if (!strcmp(name, "header"))
 		ctx.cfg.header = xstrdup(value);
 	else if (!strcmp(name, "logo"))
 		ctx.cfg.logo = xstrdup(value);
 	else if (!strcmp(name, "index-header"))
 		ctx.cfg.index_header = xstrdup(value);
 	else if (!strcmp(name, "index-info"))
 		ctx.cfg.index_info = xstrdup(value);
 	else if (!strcmp(name, "logo-link"))
 		ctx.cfg.logo_link = xstrdup(value);
 	else if (!strcmp(name, "module-link"))
 		ctx.cfg.module_link = xstrdup(value);
+	else if (!strcmp(name, "strict-export"))
+		ctx.cfg.strict_export = xstrdup(value);
 	else if (!strcmp(name, "virtual-root")) {
 		ctx.cfg.virtual_root = trim_end(value, '/');
 		if (!ctx.cfg.virtual_root && (!strcmp(value, "/")))
 			ctx.cfg.virtual_root = "";
 	} else if (!strcmp(name, "nocache"))
 		ctx.cfg.nocache = atoi(value);
 	else if (!strcmp(name, "noplainemail"))
 		ctx.cfg.noplainemail = atoi(value);
 	else if (!strcmp(name, "noheader"))
 		ctx.cfg.noheader = atoi(value);
 	else if (!strcmp(name, "snapshots"))
 		ctx.cfg.snapshots = cgit_parse_snapshots_mask(value);
 	else if (!strcmp(name, "enable-filter-overrides"))
 		ctx.cfg.enable_filter_overrides = atoi(value);
 	else if (!strcmp(name, "enable-gitweb-owner"))
 		ctx.cfg.enable_gitweb_owner = atoi(value);
 	else if (!strcmp(name, "enable-index-links"))
 		ctx.cfg.enable_index_links = atoi(value);
 	else if (!strcmp(name, "enable-log-filecount"))
 		ctx.cfg.enable_log_filecount = atoi(value);
 	else if (!strcmp(name, "enable-log-linecount"))
 		ctx.cfg.enable_log_linecount = atoi(value);
 	else if (!strcmp(name, "enable-remote-branches"))
 		ctx.cfg.enable_remote_branches = atoi(value);
 	else if (!strcmp(name, "enable-subject-links"))
 		ctx.cfg.enable_subject_links = atoi(value);
 	else if (!strcmp(name, "enable-tree-linenumbers"))
 		ctx.cfg.enable_tree_linenumbers = atoi(value);
 	else if (!strcmp(name, "max-stats"))
 		ctx.cfg.max_stats = cgit_find_stats_period(value, NULL);
 	else if (!strcmp(name, "cache-size"))
 		ctx.cfg.cache_size = atoi(value);
 	else if (!strcmp(name, "cache-root"))
 		ctx.cfg.cache_root = xstrdup(expand_macros(value));
 	else if (!strcmp(name, "cache-root-ttl"))
 		ctx.cfg.cache_root_ttl = atoi(value);
 	else if (!strcmp(name, "cache-repo-ttl"))
 		ctx.cfg.cache_repo_ttl = atoi(value);
 	else if (!strcmp(name, "cache-scanrc-ttl"))
 		ctx.cfg.cache_scanrc_ttl = atoi(value);
 	else if (!strcmp(name, "cache-static-ttl"))
 		ctx.cfg.cache_static_ttl = atoi(value);
 	else if (!strcmp(name, "cache-dynamic-ttl"))
 		ctx.cfg.cache_dynamic_ttl = atoi(value);
 	else if (!strcmp(name, "about-filter"))
 		ctx.cfg.about_filter = new_filter(value, 0);
 	else if (!strcmp(name, "commit-filter"))
 		ctx.cfg.commit_filter = new_filter(value, 0);
 	else if (!strcmp(name, "embedded"))
 		ctx.cfg.embedded = atoi(value);
 	else if (!strcmp(name, "max-atom-items"))
 		ctx.cfg.max_atom_items = atoi(value);
 	else if (!strcmp(name, "max-message-length"))
 		ctx.cfg.max_msg_len = atoi(value);
 	else if (!strcmp(name, "max-repodesc-length"))
 		ctx.cfg.max_repodesc_len = atoi(value);
 	else if (!strcmp(name, "max-blob-size"))
 		ctx.cfg.max_blob_size = atoi(value);
 	else if (!strcmp(name, "max-repo-count"))
 		ctx.cfg.max_repo_count = atoi(value);
 	else if (!strcmp(name, "max-commit-count"))
 		ctx.cfg.max_commit_count = atoi(value);
 	else if (!strcmp(name, "project-list"))
 		ctx.cfg.project_list = xstrdup(expand_macros(value));
 	else if (!strcmp(name, "scan-path"))
 		if (!ctx.cfg.nocache && ctx.cfg.cache_size)
 			process_cached_repolist(expand_macros(value));
 		else if (ctx.cfg.project_list)
 			scan_projects(expand_macros(value),
 				      ctx.cfg.project_list, repo_config);
 		else
 			scan_tree(expand_macros(value), repo_config);
 	else if (!strcmp(name, "section-from-path"))
 		ctx.cfg.section_from_path = atoi(value);
 	else if (!strcmp(name, "source-filter"))
 		ctx.cfg.source_filter = new_filter(value, 1);
 	else if (!strcmp(name, "summary-log"))
 		ctx.cfg.summary_log = atoi(value);
 	else if (!strcmp(name, "summary-branches"))
 		ctx.cfg.summary_branches = atoi(value);
 	else if (!strcmp(name, "summary-tags"))
 		ctx.cfg.summary_tags = atoi(value);
 	else if (!strcmp(name, "side-by-side-diffs"))
 		ctx.cfg.ssdiff = atoi(value);
 	else if (!strcmp(name, "agefile"))
 		ctx.cfg.agefile = xstrdup(value);
 	else if (!strcmp(name, "renamelimit"))
 		ctx.cfg.renamelimit = atoi(value);
 	else if (!strcmp(name, "remove-suffix"))
 		ctx.cfg.remove_suffix = atoi(value);
 	else if (!strcmp(name, "robots"))
 		ctx.cfg.robots = xstrdup(value);
 	else if (!strcmp(name, "clone-prefix"))
 		ctx.cfg.clone_prefix = xstrdup(value);
 	else if (!strcmp(name, "local-time"))
 		ctx.cfg.local_time = atoi(value);
 	else if (!prefixcmp(name, "mimetype."))
 		add_mimetype(name + 9, value);
 	else if (!strcmp(name, "include"))
 		parse_configfile(expand_macros(value), config_cb);
 }
 
 static void querystring_cb(const char *name, const char *value)
 {
 	if (!value)
 		value = "";
 
 	if (!strcmp(name,"r")) {
 		ctx.qry.repo = xstrdup(value);
 		ctx.repo = cgit_get_repoinfo(value);
 	} else if (!strcmp(name, "p")) {
 		ctx.qry.page = xstrdup(value);
 	} else if (!strcmp(name, "url")) {
 		if (*value == '/')
 			value++;
 		ctx.qry.url = xstrdup(value);
 		cgit_parse_url(value);
 	} else if (!strcmp(name, "qt")) {
 		ctx.qry.grep = xstrdup(value);
 	} else if (!strcmp(name, "q")) {
 		ctx.qry.search = xstrdup(value);
 	} else if (!strcmp(name, "h")) {
 		ctx.qry.head = xstrdup(value);
 		ctx.qry.has_symref = 1;
 	} else if (!strcmp(name, "id")) {
 		ctx.qry.sha1 = xstrdup(value);
 		ctx.qry.has_sha1 = 1;
 	} else if (!strcmp(name, "id2")) {
 		ctx.qry.sha2 = xstrdup(value);
 		ctx.qry.has_sha1 = 1;
 	} else if (!strcmp(name, "ofs")) {
 		ctx.qry.ofs = atoi(value);
 	} else if (!strcmp(name, "path")) {
 		ctx.qry.path = trim_end(value, '/');
 	} else if (!strcmp(name, "name")) {
 		ctx.qry.name = xstrdup(value);
 	} else if (!strcmp(name, "mimetype")) {
 		ctx.qry.mimetype = xstrdup(value);
 	} else if (!strcmp(name, "s")){
 		ctx.qry.sort = xstrdup(value);
 	} else if (!strcmp(name, "showmsg")) {
 		ctx.qry.showmsg = atoi(value);
 	} else if (!strcmp(name, "period")) {
 		ctx.qry.period = xstrdup(value);
 	} else if (!strcmp(name, "ss")) {
 		ctx.qry.ssdiff = atoi(value);
 	} else if (!strcmp(name, "all")) {
 		ctx.qry.show_all = atoi(value);
 	} else if (!strcmp(name, "context")) {
 		ctx.qry.context = atoi(value);
 	} else if (!strcmp(name, "ignorews")) {
 		ctx.qry.ignorews = atoi(value);
 	}
 }
 
 char *xstrdupn(const char *str)
 {
 	return (str ? xstrdup(str) : NULL);
 }
 
 static void prepare_context(struct cgit_context *ctx)
 {
 	memset(ctx, 0, sizeof(*ctx));
 	ctx->cfg.agefile = "info/web/last-modified";
 	ctx->cfg.nocache = 0;
 	ctx->cfg.cache_size = 0;
 	ctx->cfg.cache_dynamic_ttl = 5;
 	ctx->cfg.cache_max_create_time = 5;
 	ctx->cfg.cache_repo_ttl = 5;
 	ctx->cfg.cache_root = CGIT_CACHE_ROOT;
 	ctx->cfg.cache_root_ttl = 5;
 	ctx->cfg.cache_scanrc_ttl = 15;
 	ctx->cfg.cache_static_ttl = -1;
 	ctx->cfg.css = "/cgit.css";
 	ctx->cfg.logo = "/cgit.png";
 	ctx->cfg.local_time = 0;
 	ctx->cfg.enable_gitweb_owner = 1;
 	ctx->cfg.enable_tree_linenumbers = 1;
 	ctx->cfg.max_repo_count = 50;
 	ctx->cfg.max_commit_count = 50;
 	ctx->cfg.max_lock_attempts = 5;
 	ctx->cfg.max_msg_len = 80;
 	ctx->cfg.max_repodesc_len = 80;
 	ctx->cfg.max_blob_size = 0;
 	ctx->cfg.max_stats = 0;
 	ctx->cfg.module_link = "./?repo=%s&page=commit&id=%s";
 	ctx->cfg.project_list = NULL;
 	ctx->cfg.renamelimit = -1;
 	ctx->cfg.remove_suffix = 0;
 	ctx->cfg.robots = "index, nofollow";
 	ctx->cfg.root_title = "Git repository browser";
 	ctx->cfg.root_desc = "a fast webinterface for the git dscm";
 	ctx->cfg.script_name = CGIT_SCRIPT_NAME;
 	ctx->cfg.section = "";
 	ctx->cfg.summary_branches = 10;
 	ctx->cfg.summary_log = 10;
 	ctx->cfg.summary_tags = 10;
 	ctx->cfg.max_atom_items = 10;
 	ctx->cfg.ssdiff = 0;
 	ctx->env.cgit_config = xstrdupn(getenv("CGIT_CONFIG"));
 	ctx->env.http_host = xstrdupn(getenv("HTTP_HOST"));
 	ctx->env.https = xstrdupn(getenv("HTTPS"));
 	ctx->env.no_http = xstrdupn(getenv("NO_HTTP"));
 	ctx->env.path_info = xstrdupn(getenv("PATH_INFO"));
 	ctx->env.query_string = xstrdupn(getenv("QUERY_STRING"));
 	ctx->env.request_method = xstrdupn(getenv("REQUEST_METHOD"));
 	ctx->env.script_name = xstrdupn(getenv("SCRIPT_NAME"));
 	ctx->env.server_name = xstrdupn(getenv("SERVER_NAME"));
 	ctx->env.server_port = xstrdupn(getenv("SERVER_PORT"));
 	ctx->page.mimetype = "text/html";
 	ctx->page.charset = PAGE_ENCODING;
 	ctx->page.filename = NULL;
 	ctx->page.size = 0;
 	ctx->page.modified = time(NULL);
 	ctx->page.expires = ctx->page.modified;
 	ctx->page.etag = NULL;
 	memset(&ctx->cfg.mimetypes, 0, sizeof(struct string_list));
 	if (ctx->env.script_name)
 		ctx->cfg.script_name = ctx->env.script_name;
 	if (ctx->env.query_string)
 		ctx->qry.raw = ctx->env.query_string;
 	if (!ctx->env.cgit_config)
 		ctx->env.cgit_config = CGIT_CONFIG;
 }
 
 struct refmatch {
 	char *req_ref;
 	char *first_ref;
 	int match;
 };
 
 int find_current_ref(const char *refname, const unsigned char *sha1,
 		     int flags, void *cb_data)
 {
 	struct refmatch *info;
 
 	info = (struct refmatch *)cb_data;
 	if (!strcmp(refname, info->req_ref))
 		info->match = 1;
 	if (!info->first_ref)
 		info->first_ref = xstrdup(refname);
 	return info->match;
 }
 
 char *find_default_branch(struct cgit_repo *repo)
 {
 	struct refmatch info;
 	char *ref;
 
 	info.req_ref = repo->defbranch;
 	info.first_ref = NULL;
 	info.match = 0;
 	for_each_branch_ref(find_current_ref, &info);
 	if (info.match)
 		ref = info.req_ref;
 	else
 		ref = info.first_ref;
 	if (ref)
 		ref = xstrdup(ref);
 	return ref;
 }
 
 static int prepare_repo_cmd(struct cgit_context *ctx)
 {
 	char *tmp;
 	unsigned char sha1[20];
 	int nongit = 0;
 
 	setenv("GIT_DIR", ctx->repo->path, 1);
 	setup_git_directory_gently(&nongit);
 	if (nongit) {
 		ctx->page.title = fmt("%s - %s", ctx->cfg.root_title,
 				      "config error");
 		tmp = fmt("Not a git repository: '%s'", ctx->repo->path);
 		ctx->repo = NULL;
 		cgit_print_http_headers(ctx);
 		cgit_print_docstart(ctx);
 		cgit_print_pageheader(ctx);
 		cgit_print_error(tmp);
 		cgit_print_docend();
 		return 1;
 	}
 	ctx->page.title = fmt("%s - %s", ctx->repo->name, ctx->repo->desc);
 
 	if (!ctx->qry.head) {
 		ctx->qry.nohead = 1;
 		ctx->qry.head = find_default_branch(ctx->repo);
 		ctx->repo->defbranch = ctx->qry.head;
 	}
 
 	if (!ctx->qry.head) {
 		cgit_print_http_headers(ctx);
 		cgit_print_docstart(ctx);
 		cgit_print_pageheader(ctx);
 		cgit_print_error("Repository seems to be empty");
 		cgit_print_docend();
 		return 1;
 	}
 
 	if (get_sha1(ctx->qry.head, sha1)) {
 		tmp = xstrdup(ctx->qry.head);
 		ctx->qry.head = ctx->repo->defbranch;
 		ctx->page.status = 404;
 		ctx->page.statusmsg = "not found";
 		cgit_print_http_headers(ctx);
 		cgit_print_docstart(ctx);
 		cgit_print_pageheader(ctx);
 		cgit_print_error(fmt("Invalid branch: %s", tmp));
 		cgit_print_docend();
 		return 1;
 	}
 	return 0;
 }
 
 static void process_request(void *cbdata)
 {
 	struct cgit_context *ctx = cbdata;
 	struct cgit_cmd *cmd;
 
 	cmd = cgit_get_cmd(ctx);
 	if (!cmd) {
 		ctx->page.title = "cgit error";
 		cgit_print_http_headers(ctx);
 		cgit_print_docstart(ctx);
 		cgit_print_pageheader(ctx);
 		cgit_print_error("Invalid request");
 		cgit_print_docend();
 		return;
 	}
 
 	/* If cmd->want_vpath is set, assume ctx->qry.path contains a "virtual"
 	 * in-project path limit to be made available at ctx->qry.vpath.
 	 * Otherwise, no path limit is in effect (ctx->qry.vpath = NULL).
 	 */
 	ctx->qry.vpath = cmd->want_vpath ? ctx->qry.path : NULL;
 
 	if (cmd->want_repo && !ctx->repo) {
 		cgit_print_http_headers(ctx);
 		cgit_print_docstart(ctx);
 		cgit_print_pageheader(ctx);
 		cgit_print_error(fmt("No repository selected"));
 		cgit_print_docend();
 		return;
 	}
 
 	if (ctx->repo && prepare_repo_cmd(ctx))
 		return;
 
 	if (cmd->want_layout) {
 		cgit_print_http_headers(ctx);
 		cgit_print_docstart(ctx);
 		cgit_print_pageheader(ctx);
 	}
 
 	cmd->fn(ctx);
 
 	if (cmd->want_layout)
 		cgit_print_docend();
 }
 
 int cmp_repos(const void *a, const void *b)
 {
 	const struct cgit_repo *ra = a, *rb = b;
 	return strcmp(ra->url, rb->url);
 }
 
 char *build_snapshot_setting(int bitmap)
 {
 	const struct cgit_snapshot_format *f;
 	char *result = xstrdup("");
 	char *tmp;
 	int len;
 
 	for (f = cgit_snapshot_formats; f->suffix; f++) {
 		if (f->bit & bitmap) {
 			tmp = result;
 			result = xstrdup(fmt("%s%s ", tmp, f->suffix));
 			free(tmp);
 		}
 	}
 	len = strlen(result);
 	if (len)
 		result[len - 1] = '\0';
 	return result;
 }
 
 char *get_first_line(char *txt)
 {
 	char *t = xstrdup(txt);
 	char *p = strchr(t, '\n');
 	if (p)
 		*p = '\0';
 	return t;
 }
 
 void print_repo(FILE *f, struct cgit_repo *repo)
 {
 	fprintf(f, "repo.url=%s\n", repo->url);
 	fprintf(f, "repo.name=%s\n", repo->name);
 	fprintf(f, "repo.path=%s\n", repo->path);
 	if (repo->owner)
 		fprintf(f, "repo.owner=%s\n", repo->owner);
 	if (repo->desc) {
 		char *tmp = get_first_line(repo->desc);
 		fprintf(f, "repo.desc=%s\n", tmp);
 		free(tmp);
 	}
 	if (repo->readme)
 		fprintf(f, "repo.readme=%s\n", repo->readme);
 	if (repo->defbranch)
 		fprintf(f, "repo.defbranch=%s\n", repo->defbranch);
 	if (repo->module_link)
 		fprintf(f, "repo.module-link=%s\n", repo->module_link);
 	if (repo->section)
 		fprintf(f, "repo.section=%s\n", repo->section);
 	if (repo->clone_url)
 		fprintf(f, "repo.clone-url=%s\n", repo->clone_url);
 	fprintf(f, "repo.enable-log-filecount=%d\n",
 	        repo->enable_log_filecount);
 	fprintf(f, "repo.enable-log-linecount=%d\n",
 	        repo->enable_log_linecount);
 	if (repo->about_filter && repo->about_filter != ctx.cfg.about_filter)
 		fprintf(f, "repo.about-filter=%s\n", repo->about_filter->cmd);
 	if (repo->commit_filter && repo->commit_filter != ctx.cfg.commit_filter)
 		fprintf(f, "repo.commit-filter=%s\n", repo->commit_filter->cmd);
 	if (repo->source_filter && repo->source_filter != ctx.cfg.source_filter)
 		fprintf(f, "repo.source-filter=%s\n", repo->source_filter->cmd);
 	if (repo->snapshots != ctx.cfg.snapshots) {
 		char *tmp = build_snapshot_setting(repo->snapshots);
 		fprintf(f, "repo.snapshots=%s\n", tmp);
 		free(tmp);
 	}
 	if (repo->max_stats != ctx.cfg.max_stats)
 		fprintf(f, "repo.max-stats=%s\n",
 		        cgit_find_stats_periodname(repo->max_stats));
 	fprintf(f, "\n");
 }
 
 void print_repolist(FILE *f, struct cgit_repolist *list, int start)
 {
 	int i;
 
 	for(i = start; i < list->count; i++)
 		print_repo(f, &list->repos[i]);
 }
 
 /* Scan 'path' for git repositories, save the resulting repolist in 'cached_rc'
  * and return 0 on success.
  */
 static int generate_cached_repolist(const char *path, const char *cached_rc)
 {
 	char *locked_rc;
 	int idx;
 	FILE *f;
 
 	locked_rc = xstrdup(fmt("%s.lock", cached_rc));
 	f = fopen(locked_rc, "wx");
 	if (!f) {
 		/* Inform about the error unless the lockfile already existed,
 		 * since that only means we've got concurrent requests.
 		 */
 		if (errno != EEXIST)
 			fprintf(stderr, "[cgit] Error opening %s: %s (%d)\n",
 				locked_rc, strerror(errno), errno);
 		return errno;
 	}
 	idx = cgit_repolist.count;
 	if (ctx.cfg.project_list)
 		scan_projects(path, ctx.cfg.project_list, repo_config);
 	else
 		scan_tree(path, repo_config);
 	print_repolist(f, &cgit_repolist, idx);
 	if (rename(locked_rc, cached_rc))
 		fprintf(stderr, "[cgit] Error renaming %s to %s: %s (%d)\n",
 			locked_rc, cached_rc, strerror(errno), errno);
 	fclose(f);
 	return 0;
 }
 
 static void process_cached_repolist(const char *path)
 {
 	struct stat st;
 	char *cached_rc;
 	time_t age;
 	unsigned long hash;
 
 	hash = hash_str(path);
 	if (ctx.cfg.project_list)
 		hash += hash_str(ctx.cfg.project_list);
 	cached_rc = xstrdup(fmt("%s/rc-%8lx", ctx.cfg.cache_root, hash));
 
 	if (stat(cached_rc, &st)) {
 		/* Nothing is cached, we need to scan without forking. And
 		 * if we fail to generate a cached repolist, we need to
 		 * invoke scan_tree manually.
 		 */
 		if (generate_cached_repolist(path, cached_rc)) {
 			if (ctx.cfg.project_list)
 				scan_projects(path, ctx.cfg.project_list,
 					      repo_config);
 			else
 				scan_tree(path, repo_config);
 		}
 		return;
 	}
 
 	parse_configfile(cached_rc, config_cb);
 
 	/* If the cached configfile hasn't expired, lets exit now */
 	age = time(NULL) - st.st_mtime;
 	if (age <= (ctx.cfg.cache_scanrc_ttl * 60))
 		return;
 
 	/* The cached repolist has been parsed, but it was old. So lets
 	 * rescan the specified path and generate a new cached repolist
 	 * in a child-process to avoid latency for the current request.
 	 */
 	if (fork())
 		return;
 
 	exit(generate_cached_repolist(path, cached_rc));
 }
 
 static void cgit_parse_args(int argc, const char **argv)
 {
 	int i;
 	int scan = 0;
 
 	for (i = 1; i < argc; i++) {
 		if (!strncmp(argv[i], "--cache=", 8)) {
 			ctx.cfg.cache_root = xstrdup(argv[i]+8);
 		}
 		if (!strcmp(argv[i], "--nocache")) {
 			ctx.cfg.nocache = 1;
 		}
 		if (!strcmp(argv[i], "--nohttp")) {
 			ctx.env.no_http = "1";
 		}
 		if (!strncmp(argv[i], "--query=", 8)) {
 			ctx.qry.raw = xstrdup(argv[i]+8);
 		}
 		if (!strncmp(argv[i], "--repo=", 7)) {
 			ctx.qry.repo = xstrdup(argv[i]+7);
 		}
 		if (!strncmp(argv[i], "--page=", 7)) {
 			ctx.qry.page = xstrdup(argv[i]+7);
 		}
 		if (!strncmp(argv[i], "--head=", 7)) {
 			ctx.qry.head = xstrdup(argv[i]+7);
 			ctx.qry.has_symref = 1;
 		}
 		if (!strncmp(argv[i], "--sha1=", 7)) {
 			ctx.qry.sha1 = xstrdup(argv[i]+7);
 			ctx.qry.has_sha1 = 1;
 		}
 		if (!strncmp(argv[i], "--ofs=", 6)) {
 			ctx.qry.ofs = atoi(argv[i]+6);
 		}
 		if (!strncmp(argv[i], "--scan-tree=", 12) ||
 		    !strncmp(argv[i], "--scan-path=", 12)) {
 			/* HACK: the global snapshot bitmask defines the
 			 * set of allowed snapshot formats, but the config
 			 * file hasn't been parsed yet so the mask is
 			 * currently 0. By setting all bits high before
 			 * scanning we make sure that any in-repo cgitrc
 			 * snapshot setting is respected by scan_tree().
 			 * BTW: we assume that there'll never be more than
 			 * 255 different snapshot formats supported by cgit...
 			 */
 			ctx.cfg.snapshots = 0xFF;
 			scan++;
 			scan_tree(argv[i] + 12, repo_config);
 		}
 	}
 	if (scan) {
 		qsort(cgit_repolist.repos, cgit_repolist.count,
 			sizeof(struct cgit_repo), cmp_repos);
 		print_repolist(stdout, &cgit_repolist, 0);
 		exit(0);
 	}
 }
 
 static int calc_ttl()
 {
 	if (!ctx.repo)
 		return ctx.cfg.cache_root_ttl;
 
 	if (!ctx.qry.page)
 		return ctx.cfg.cache_repo_ttl;
 
 	if (ctx.qry.has_symref)
 		return ctx.cfg.cache_dynamic_ttl;
 
 	if (ctx.qry.has_sha1)
 		return ctx.cfg.cache_static_ttl;
 
 	return ctx.cfg.cache_repo_ttl;
 }
 
 int main(int argc, const char **argv)
 {
 	const char *path;
 	char *qry;
 	int err, ttl;
 
 	prepare_context(&ctx);
 	cgit_repolist.length = 0;
 	cgit_repolist.count = 0;
 	cgit_repolist.repos = NULL;
 
 	cgit_parse_args(argc, argv);
 	parse_configfile(expand_macros(ctx.env.cgit_config), config_cb);
 	ctx.repo = NULL;
 	http_parse_querystring(ctx.qry.raw, querystring_cb);
 
 	/* If virtual-root isn't specified in cgitrc, lets pretend
 	 * that virtual-root equals SCRIPT_NAME.
 	 */
 	if (!ctx.cfg.virtual_root)
 		ctx.cfg.virtual_root = ctx.cfg.script_name;
 
 	/* If no url parameter is specified on the querystring, lets
 	 * use PATH_INFO as url. This allows cgit to work with virtual
 	 * urls without the need for rewriterules in the webserver (as
 	 * long as PATH_INFO is included in the cache lookup key).
 	 */
 	path = ctx.env.path_info;
 	if (!ctx.qry.url && path) {
 		if (path[0] == '/')
 			path++;
 		ctx.qry.url = xstrdup(path);
 		if (ctx.qry.raw) {
 			qry = ctx.qry.raw;
 			ctx.qry.raw = xstrdup(fmt("%s?%s", path, qry));
 			free(qry);
 		} else
 			ctx.qry.raw = xstrdup(ctx.qry.url);
 		cgit_parse_url(ctx.qry.url);
 	}
 
 	ttl = calc_ttl();
 	ctx.page.expires += ttl*60;
 	if (ctx.env.request_method && !strcmp(ctx.env.request_method, "HEAD"))
 		ctx.cfg.nocache = 1;
 	if (ctx.cfg.nocache)
 		ctx.cfg.cache_size = 0;
 	err = cache_process(ctx.cfg.cache_size, ctx.cfg.cache_root,
 			    ctx.qry.raw, ttl, process_request, &ctx);
 	if (err)
 		cgit_print_error(fmt("Error processing page: %s (%d)",
 				     strerror(err), err));
 	return err;
 }
diff --git a/cgit.h b/cgit.h
index 8f5dd2a..a9896cf 100644
--- a/cgit.h
+++ b/cgit.h
@@ -1,316 +1,317 @@
 #ifndef CGIT_H
 #define CGIT_H
 
 
 #include <git-compat-util.h>
 #include <cache.h>
 #include <grep.h>
 #include <object.h>
 #include <tree.h>
 #include <commit.h>
 #include <tag.h>
 #include <diff.h>
 #include <diffcore.h>
 #include <refs.h>
 #include <revision.h>
 #include <log-tree.h>
 #include <archive.h>
 #include <string-list.h>
 #include <xdiff-interface.h>
 #include <xdiff/xdiff.h>
 #include <utf8.h>
 #include <notes.h>
 
 
 /*
  * Dateformats used on misc. pages
  */
 #define FMT_LONGDATE "%Y-%m-%d %H:%M:%S (%Z)"
 #define FMT_SHORTDATE "%Y-%m-%d"
 #define FMT_ATOMDATE "%Y-%m-%dT%H:%M:%SZ"
 
 
 /*
  * Limits used for relative dates
  */
 #define TM_MIN    60
 #define TM_HOUR  (TM_MIN * 60)
 #define TM_DAY   (TM_HOUR * 24)
 #define TM_WEEK  (TM_DAY * 7)
 #define TM_YEAR  (TM_DAY * 365)
 #define TM_MONTH (TM_YEAR / 12.0)
 
 
 /*
  * Default encoding
  */
 #define PAGE_ENCODING "UTF-8"
 
 typedef void (*configfn)(const char *name, const char *value);
 typedef void (*filepair_fn)(struct diff_filepair *pair);
 typedef void (*linediff_fn)(char *line, int len);
 
 struct cgit_filter {
 	char *cmd;
 	char **argv;
 	int old_stdout;
 	int pipe_fh[2];
 	int pid;
 	int exitstatus;
 };
 
 struct cgit_repo {
 	char *url;
 	char *name;
 	char *path;
 	char *desc;
 	char *owner;
 	char *defbranch;
 	char *module_link;
 	char *readme;
 	char *section;
 	char *clone_url;
 	int snapshots;
 	int enable_log_filecount;
 	int enable_log_linecount;
 	int enable_remote_branches;
 	int enable_subject_links;
 	int max_stats;
 	time_t mtime;
 	struct cgit_filter *about_filter;
 	struct cgit_filter *commit_filter;
 	struct cgit_filter *source_filter;
 };
 
 typedef void (*repo_config_fn)(struct cgit_repo *repo, const char *name,
 	      const char *value);
 
 struct cgit_repolist {
 	int length;
 	int count;
 	struct cgit_repo *repos;
 };
 
 struct commitinfo {
 	struct commit *commit;
 	char *author;
 	char *author_email;
 	unsigned long author_date;
 	char *committer;
 	char *committer_email;
 	unsigned long committer_date;
 	char *subject;
 	char *msg;
 	char *msg_encoding;
 };
 
 struct taginfo {
 	char *tagger;
 	char *tagger_email;
 	unsigned long tagger_date;
 	char *msg;
 };
 
 struct refinfo {
 	const char *refname;
 	struct object *object;
 	union {
 		struct taginfo *tag;
 		struct commitinfo *commit;
 	};
 };
 
 struct reflist {
 	struct refinfo **refs;
 	int alloc;
 	int count;
 };
 
 struct cgit_query {
 	int has_symref;
 	int has_sha1;
 	char *raw;
 	char *repo;
 	char *page;
 	char *search;
 	char *grep;
 	char *head;
 	char *sha1;
 	char *sha2;
 	char *path;
 	char *name;
 	char *mimetype;
 	char *url;
 	char *period;
 	int   ofs;
 	int nohead;
 	char *sort;
 	int showmsg;
 	int ssdiff;
 	int show_all;
 	int context;
 	int ignorews;
 	char *vpath;
 };
 
 struct cgit_config {
 	char *agefile;
 	char *cache_root;
 	char *clone_prefix;
 	char *css;
 	char *favicon;
 	char *footer;
 	char *head_include;
 	char *header;
 	char *index_header;
 	char *index_info;
 	char *logo;
 	char *logo_link;
 	char *module_link;
 	char *project_list;
 	char *readme;
 	char *robots;
 	char *root_title;
 	char *root_desc;
 	char *root_readme;
 	char *script_name;
 	char *section;
 	char *virtual_root;
+	char *strict_export;
 	int cache_size;
 	int cache_dynamic_ttl;
 	int cache_max_create_time;
 	int cache_repo_ttl;
 	int cache_root_ttl;
 	int cache_scanrc_ttl;
 	int cache_static_ttl;
 	int embedded;
 	int enable_filter_overrides;
 	int enable_gitweb_owner;
 	int enable_index_links;
 	int enable_log_filecount;
 	int enable_log_linecount;
 	int enable_remote_branches;
 	int enable_subject_links;
 	int enable_tree_linenumbers;
 	int local_time;
 	int max_atom_items;
 	int max_repo_count;
 	int max_commit_count;
 	int max_lock_attempts;
 	int max_msg_len;
 	int max_repodesc_len;
 	int max_blob_size;
 	int max_stats;
 	int nocache;
 	int noplainemail;
 	int noheader;
 	int renamelimit;
 	int remove_suffix;
 	int section_from_path;
 	int snapshots;
 	int summary_branches;
 	int summary_log;
 	int summary_tags;
 	int ssdiff;
 	struct string_list mimetypes;
 	struct cgit_filter *about_filter;
 	struct cgit_filter *commit_filter;
 	struct cgit_filter *source_filter;
 };
 
 struct cgit_page {
 	time_t modified;
 	time_t expires;
 	size_t size;
 	char *mimetype;
 	char *charset;
 	char *filename;
 	char *etag;
 	char *title;
 	int status;
 	char *statusmsg;
 };
 
 struct cgit_environment {
 	char *cgit_config;
 	char *http_host;
 	char *https;
 	char *no_http;
 	char *path_info;
 	char *query_string;
 	char *request_method;
 	char *script_name;
 	char *server_name;
 	char *server_port;
 };
 
 struct cgit_context {
 	struct cgit_environment env;
 	struct cgit_query qry;
 	struct cgit_config cfg;
 	struct cgit_repo *repo;
 	struct cgit_page page;
 };
 
 struct cgit_snapshot_format {
 	const char *suffix;
 	const char *mimetype;
 	write_archive_fn_t write_func;
 	int bit;
 };
 
 extern const char *cgit_version;
 
 extern struct cgit_repolist cgit_repolist;
 extern struct cgit_context ctx;
 extern const struct cgit_snapshot_format cgit_snapshot_formats[];
 
 extern struct cgit_repo *cgit_add_repo(const char *url);
 extern struct cgit_repo *cgit_get_repoinfo(const char *url);
 extern void cgit_repo_config_cb(const char *name, const char *value);
 
 extern int chk_zero(int result, char *msg);
 extern int chk_positive(int result, char *msg);
 extern int chk_non_negative(int result, char *msg);
 
 extern char *trim_end(const char *str, char c);
 extern char *strlpart(char *txt, int maxlen);
 extern char *strrpart(char *txt, int maxlen);
 
 extern void cgit_add_ref(struct reflist *list, struct refinfo *ref);
 extern int cgit_refs_cb(const char *refname, const unsigned char *sha1,
 			int flags, void *cb_data);
 
 extern void *cgit_free_commitinfo(struct commitinfo *info);
 
 extern int cgit_diff_files(const unsigned char *old_sha1,
 			   const unsigned char *new_sha1,
 			   unsigned long *old_size, unsigned long *new_size,
 			   int *binary, int context, int ignorews,
 			   linediff_fn fn);
 
 extern void cgit_diff_tree(const unsigned char *old_sha1,
 			   const unsigned char *new_sha1,
 			   filepair_fn fn, const char *prefix, int ignorews);
 
 extern void cgit_diff_commit(struct commit *commit, filepair_fn fn);
 
 __attribute__((format (printf,1,2)))
 extern char *fmt(const char *format,...);
 
 extern struct commitinfo *cgit_parse_commit(struct commit *commit);
 extern struct taginfo *cgit_parse_tag(struct tag *tag);
 extern void cgit_parse_url(const char *url);
 
 extern const char *cgit_repobasename(const char *reponame);
 
 extern int cgit_parse_snapshots_mask(const char *str);
 
 extern int cgit_open_filter(struct cgit_filter *filter);
 extern int cgit_close_filter(struct cgit_filter *filter);
 
 extern int readfile(const char *path, char **buf, size_t *size);
 
 extern char *expand_macros(const char *txt);
 
 #endif /* CGIT_H */
diff --git a/cgitrc.5.txt b/cgitrc.5.txt
index ce78d41..75b6584 100644
--- a/cgitrc.5.txt
+++ b/cgitrc.5.txt
@@ -1,563 +1,570 @@
 :man source:   cgit
 :man manual:   cgit
 
 CGITRC(5)
 ========
 
 
 NAME
 ----
 cgitrc - runtime configuration for cgit
 
 
 SYNOPSIS
 --------
 Cgitrc contains all runtime settings for cgit, including the list of git
 repositories, formatted as a line-separated list of NAME=VALUE pairs. Blank
 lines, and lines starting with '#', are ignored.
 
 
 LOCATION
 --------
 The default location of cgitrc, defined at compile time, is /etc/cgitrc. At
 runtime, cgit will consult the environment variable CGIT_CONFIG and, if
 defined, use its value instead.
 
 
 GLOBAL SETTINGS
 ---------------
 about-filter::
 	Specifies a command which will be invoked to format the content of
 	about pages (both top-level and for each repository). The command will
 	get the content of the about-file on its STDIN, and the STDOUT from the
 	command will be included verbatim on the about page. Default value:
 	none.
 
 agefile::
 	Specifies a path, relative to each repository path, which can be used
 	to specify the date and time of the youngest commit in the repository.
 	The first line in the file is used as input to the "parse_date"
 	function in libgit. Recommended timestamp-format is "yyyy-mm-dd
 	hh:mm:ss". Default value: "info/web/last-modified".
 
 cache-root::
 	Path used to store the cgit cache entries. Default value:
 	"/var/cache/cgit".
 
 cache-dynamic-ttl::
 	Number which specifies the time-to-live, in minutes, for the cached
 	version of repository pages accessed without a fixed SHA1. Default
 	value: "5".
 
 cache-repo-ttl::
 	Number which specifies the time-to-live, in minutes, for the cached
 	version of the repository summary page. Default value: "5".
 
 cache-root-ttl::
 	Number which specifies the time-to-live, in minutes, for the cached
 	version of the repository index page. Default value: "5".
 
 cache-scanrc-ttl::
 	Number which specifies the time-to-live, in minutes, for the result
 	of scanning a path for git repositories. Default value: "15".
 
 cache-size::
 	The maximum number of entries in the cgit cache. Default value: "0"
 	(i.e. caching is disabled).
 
 cache-static-ttl::
 	Number which specifies the time-to-live, in minutes, for the cached
 	version of repository pages accessed with a fixed SHA1. Default value:
 	"5".
 
 clone-prefix::
 	Space-separated list of common prefixes which, when combined with a
 	repository url, generates valid clone urls for the repository. This
 	setting is only used if `repo.clone-url` is unspecified. Default value:
 	none.
 
 commit-filter::
 	Specifies a command which will be invoked to format commit messages.
 	The command will get the message on its STDIN, and the STDOUT from the
 	command will be included verbatim as the commit message, i.e. this can
 	be used to implement bugtracker integration. Default value: none.
 
 css::
 	Url which specifies the css document to include in all cgit pages.
 	Default value: "/cgit.css".
 
 embedded::
 	Flag which, when set to "1", will make cgit generate a html fragment
 	suitable for embedding in other html pages. Default value: none. See
 	also: "noheader".
 	
 enable-filter-overrides::
 	Flag which, when set to "1", allows all filter settings to be
 	overridden in repository-specific cgitrc files. Default value: none.
 
 enable-gitweb-owner::
 	If set to "1" and scan-path is enabled, we first check each repository
 	for the git config value "gitweb.owner" to determine the owner.
 	Default value: "1". See also: scan-path.
 
 enable-index-links::
 	Flag which, when set to "1", will make cgit generate extra links for
 	each repo in the repository index (specifically, to the "summary",
 	"commit" and "tree" pages). Default value: "0".
 
 enable-log-filecount::
 	Flag which, when set to "1", will make cgit print the number of
 	modified files for each commit on the repository log page. Default
 	value: "0".
 
 enable-log-linecount::
 	Flag which, when set to "1", will make cgit print the number of added
 	and removed lines for each commit on the repository log page. Default
 	value: "0".
 
 enable-remote-branches::
 	Flag which, when set to "1", will make cgit display remote branches
 	in the summary and refs views. Default value: "0". See also:
 	"repo.enable-remote-branches".
 
 enable-subject-links::
 	Flag which, when set to "1", will make cgit use the subject of the
 	parent commit as link text when generating links to parent commits
 	in commit view. Default value: "0". See also:
 	"repo.enable-subject-links".
 
 enable-tree-linenumbers::
 	Flag which, when set to "1", will make cgit generate linenumber links
 	for plaintext blobs printed in the tree view. Default value: "1".
 
 favicon::
 	Url used as link to a shortcut icon for cgit. If specified, it is
 	suggested to use the value "/favicon.ico" since certain browsers will
 	ignore other values. Default value: none.
 
 footer::
 	The content of the file specified with this option will be included
 	verbatim at the bottom of all pages (i.e. it replaces the standard
 	"generated by..." message. Default value: none.
 
 head-include::
 	The content of the file specified with this option will be included
 	verbatim in the html HEAD section on all pages. Default value: none.
 
 header::
 	The content of the file specified with this option will be included
 	verbatim at the top of all pages. Default value: none.
 
 include::
 	Name of a configfile to include before the rest of the current config-
 	file is parsed. Default value: none.
 
 index-header::
 	The content of the file specified with this option will be included
 	verbatim above the repository index. This setting is deprecated, and
 	will not be supported by cgit-1.0 (use root-readme instead). Default
 	value: none.
 
 index-info::
 	The content of the file specified with this option will be included
 	verbatim below the heading on the repository index page. This setting
 	is deprecated, and will not be supported by cgit-1.0 (use root-desc
 	instead). Default value: none.
 
 local-time::
 	Flag which, if set to "1", makes cgit print commit and tag times in the
 	servers timezone. Default value: "0".
 
 logo::
 	Url which specifies the source of an image which will be used as a logo
 	on all cgit pages. Default value: "/cgit.png".
 
 logo-link::
 	Url loaded when clicking on the cgit logo image. If unspecified the
 	calculated url of the repository index page will be used. Default
 	value: none.
 
 max-atom-items::
 	Specifies the number of items to display in atom feeds view. Default
 	value: "10".
 
 max-commit-count::
 	Specifies the number of entries to list per page in "log" view. Default
 	value: "50".
 
 max-message-length::
 	Specifies the maximum number of commit message characters to display in
 	"log" view. Default value: "80".
 
 max-repo-count::
 	Specifies the number of entries to list per page on the	repository
 	index page. Default value: "50".
 
 max-repodesc-length::
 	Specifies the maximum number of repo description characters to display
 	on the repository index page. Default value: "80".
 
 max-blob-size::
 	Specifies the maximum size of a blob to display HTML for in KBytes.
 	Default value: "0" (limit disabled).
 
 max-stats::
 	Set the default maximum statistics period. Valid values are "week",
 	"month", "quarter" and "year". If unspecified, statistics are
 	disabled. Default value: none. See also: "repo.max-stats".
 
 mimetype.<ext>::
 	Set the mimetype for the specified filename extension. This is used
 	by the `plain` command when returning blob content.
 
 module-link::
 	Text which will be used as the formatstring for a hyperlink when a
 	submodule is printed in a directory listing. The arguments for the
 	formatstring are the path and SHA1 of the submodule commit. Default
 	value: "./?repo=%s&page=commit&id=%s"
 
 nocache::
 	If set to the value "1" caching will be disabled. This settings is
 	deprecated, and will not be honored starting with cgit-1.0. Default
 	value: "0".
 
 noplainemail::
 	If set to "1" showing full author email adresses will be disabled.
 	Default value: "0".
 
 noheader::
 	Flag which, when set to "1", will make cgit omit the standard header
 	on all pages. Default value: none. See also: "embedded".
 
 project-list::
 	A list of subdirectories inside of scan-path, relative to it, that
 	should loaded as git repositories. This must be defined prior to
 	scan-path. Default value: none. See also: scan-path.
 
 readme::
 	Text which will be used as default value for "repo.readme". Default
 	value: none.
 
 remove-suffix::
 	If set to "1" and scan-path is enabled, if any repositories are found
 	with a suffix of ".git", this suffix will be removed for the url and
 	name. Default value: "0". See also: scan-path.
 
 renamelimit::
 	Maximum number of files to consider when detecting renames. The value
 	 "-1" uses the compiletime value in git (for further info, look at
 	  `man git-diff`). Default value: "-1".
 
 repo.group::
 	Legacy alias for "section". This option is deprecated and will not be
 	supported in cgit-1.0.
 
 robots::
 	Text used as content for the "robots" meta-tag. Default value:
 	"index, nofollow".
 
 root-desc::
 	Text printed below the heading on the repository index page. Default
 	value: "a fast webinterface for the git dscm".
 
 root-readme::
 	The content of the file specified with this option will be included
 	verbatim below the "about" link on the repository index page. Default
 	value: none.
 
 root-title::
 	Text printed as heading on the repository index page. Default value:
 	"Git Repository Browser".
 
 scan-path::
 	A path which will be scanned for repositories. If caching is enabled,
 	the result will be cached as a cgitrc include-file in the cache
 	directory. If project-list has been defined prior to scan-path,
 	scan-path loads only the directories listed in the file pointed to by
 	project-list. Default value: none. See also: cache-scanrc-ttl,
 	project-list.
 
 section::
 	The name of the current repository section - all repositories defined
 	after this option will inherit the current section name. Default value:
 	none.
 
 section-from-path::
 	A number which, if specified before scan-path, specifies how many
 	path elements from each repo path to use as a default section name.
 	If negative, cgit will discard the specified number of path elements
 	above the repo directory. Default value: 0.
 
 side-by-side-diffs::
 	If set to "1" shows side-by-side diffs instead of unidiffs per
 	default. Default value: "0".
 
 snapshots::
 	Text which specifies the default set of snapshot formats generated by
 	cgit. The value is a space-separated list of zero or more of the
 	values "tar", "tar.gz", "tar.bz2" and "zip". Default value: none.
 
 source-filter::
 	Specifies a command which will be invoked to format plaintext blobs
 	in the tree view. The command will get the blob content on its STDIN
 	and the name of the blob as its only command line argument. The STDOUT
 	from the command will be included verbatim as the blob contents, i.e.
 	this can be used to implement e.g. syntax highlighting. Default value:
 	none.
 
 summary-branches::
 	Specifies the number of branches to display in the repository "summary"
 	view. Default value: "10".
 
 summary-log::
 	Specifies the number of log entries to display in the repository
 	"summary" view. Default value: "10".
 
 summary-tags::
 	Specifies the number of tags to display in the repository "summary"
 	view. Default value: "10".
 
+strict-export::
+	Filename which, if specified, needs to be present within the repository
+	for cgit to allow access to that repository. This can be used to emulate
+	gitweb's EXPORT_OK and STRICT_EXPORT functionality and limit cgit's
+	repositories to match those exported by git-daemon. This option MUST come
+	before 'scan-path'.
+
 virtual-root::
 	Url which, if specified, will be used as root for all cgit links. It
 	will also cause cgit to generate 'virtual urls', i.e. urls like
 	'/cgit/tree/README' as opposed to '?r=cgit&p=tree&path=README'. Default
 	value: none.
 	NOTE: cgit has recently learned how to use PATH_INFO to achieve the
 	same kind of virtual urls, so this option will probably be deprecated.
 
 REPOSITORY SETTINGS
 -------------------
 repo.about-filter::
 	Override the default about-filter. Default value: none. See also:
 	"enable-filter-overrides".
 
 repo.clone-url::
 	A list of space-separated urls which can be used to clone this repo.
 	Default value: none.
 
 repo.commit-filter::
 	Override the default commit-filter. Default value: none. See also:
 	"enable-filter-overrides".
 
 repo.defbranch::
 	The name of the default branch for this repository. If no such branch
 	exists in the repository, the first branch name (when sorted) is used
 	as default instead. Default value: "master".
 
 repo.desc::
 	The value to show as repository description. Default value: none.
 
 repo.enable-log-filecount::
 	A flag which can be used to disable the global setting
 	`enable-log-filecount'. Default value: none.
 
 repo.enable-log-linecount::
 	A flag which can be used to disable the global setting
 	`enable-log-linecount'. Default value: none.
 
 repo.enable-remote-branches::
 	Flag which, when set to "1", will make cgit display remote branches
 	in the summary and refs views. Default value: <enable-remote-branches>.
 
 repo.enable-subject-links::
 	A flag which can be used to override the global setting
 	`enable-subject-links'. Default value: none.
 
 repo.max-stats::
 	Override the default maximum statistics period. Valid values are equal
 	to the values specified for the global "max-stats" setting. Default
 	value: none.
 
 repo.name::
 	The value to show as repository name. Default value: <repo.url>.
 
 repo.owner::
 	A value used to identify the owner of the repository. Default value:
 	none.
 
 repo.path::
 	An absolute path to the repository directory. For non-bare repositories
 	this is the .git-directory. Default value: none.
 
 repo.readme::
 	A path (relative to <repo.path>) which specifies a file to include
 	verbatim as the "About" page for this repo. You may also specify a
 	git refspec by head or by hash by prepending the refspec followed by
 	a colon. For example, "master:docs/readme.mkd" Default value: <readme>.
 
 repo.snapshots::
 	A mask of allowed snapshot-formats for this repo, restricted by the
 	"snapshots" global setting. Default value: <snapshots>.
 
 repo.section::
 	Override the current section name for this repository. Default value:
 	none.
 
 repo.source-filter::
 	Override the default source-filter. Default value: none. See also:
 	"enable-filter-overrides".
 
 repo.url::
 	The relative url used to access the repository. This must be the first
 	setting specified for each repo. Default value: none.
 
 
 REPOSITORY-SPECIFIC CGITRC FILE
 -------------------------------
 When the option "scan-path" is used to auto-discover git repositories, cgit
 will try to parse the file "cgitrc" within any found repository. Such a
 repo-specific config file may contain any of the repo-specific options
 described above, except "repo.url" and "repo.path". Additionally, the "filter"
 options are only acknowledged in repo-specific config files when
 "enable-filter-overrides" is set to "1".
 
 Note: the "repo." prefix is dropped from the option names in repo-specific
 config files, e.g. "repo.desc" becomes "desc".
 
 
 EXAMPLE CGITRC FILE
 -------------------
 
 ....
 # Enable caching of up to 1000 output entriess
 cache-size=1000
 
 
 # Specify some default clone prefixes
 clone-prefix=git://foobar.com ssh://foobar.com/pub/git http://foobar.com/git
 
 # Specify the css url
 css=/css/cgit.css
 
 
 # Show extra links for each repository on the index page
 enable-index-links=1
 
 
 # Show number of affected files per commit on the log pages
 enable-log-filecount=1
 
 
 # Show number of added/removed lines per commit on the log pages
 enable-log-linecount=1
 
 
 # Add a cgit favicon
 favicon=/favicon.ico
 
 
 # Use a custom logo
 logo=/img/mylogo.png
 
 
 # Enable statistics per week, month and quarter
 max-stats=quarter
 
 
 # Set the title and heading of the repository index page
 root-title=foobar.com git repositories
 
 
 # Set a subheading for the repository index page
 root-desc=tracking the foobar development
 
 
 # Include some more info about foobar.com on the index page
 root-readme=/var/www/htdocs/about.html
 
 
 # Allow download of tar.gz, tar.bz2 and zip-files
 snapshots=tar.gz tar.bz2 zip
 
 
 ##
 ## List of common mimetypes
 ##
 
 mimetype.gif=image/gif
 mimetype.html=text/html
 mimetype.jpg=image/jpeg
 mimetype.jpeg=image/jpeg
 mimetype.pdf=application/pdf
 mimetype.png=image/png
 mimetype.svg=image/svg+xml
 
 
 ##
 ## List of repositories.
 ## PS: Any repositories listed when section is unset will not be
 ##     displayed under a section heading
 ## PPS: This list could be kept in a different file (e.g. '/etc/cgitrepos')
 ##      and included like this:
 ##        include=/etc/cgitrepos
 ##
 
 
 repo.url=foo
 repo.path=/pub/git/foo.git
 repo.desc=the master foo repository
 repo.owner=fooman@foobar.com
 repo.readme=info/web/about.html
 
 
 repo.url=bar
 repo.path=/pub/git/bar.git
 repo.desc=the bars for your foo
 repo.owner=barman@foobar.com
 repo.readme=info/web/about.html
 
 
 # The next repositories will be displayed under the 'extras' heading
 section=extras
 
 
 repo.url=baz
 repo.path=/pub/git/baz.git
 repo.desc=a set of extensions for bar users
 
 repo.url=wiz
 repo.path=/pub/git/wiz.git
 repo.desc=the wizard of foo
 
 
 # Add some mirrored repositories
 section=mirrors
 
 
 repo.url=git
 repo.path=/pub/git/git.git
 repo.desc=the dscm
 
 
 repo.url=linux
 repo.path=/pub/git/linux.git
 repo.desc=the kernel
 
 # Disable adhoc downloads of this repo
 repo.snapshots=0
 
 # Disable line-counts for this repo
 repo.enable-log-linecount=0
 
 # Restrict the max statistics period for this repo
 repo.max-stats=month
 ....
 
 
 BUGS
 ----
 Comments currently cannot appear on the same line as a setting; the comment
 will be included as part of the value. E.g. this line:
 
 	robots=index  # allow indexing
 
 will generate the following html element:
 
 	<meta name='robots' content='index  # allow indexing'/>
 
 
 
 AUTHOR
 ------
 Lars Hjemli <hjemli@gmail.com>
 Jason A. Donenfeld <Jason@zx2c4.com>
diff --git a/scan-tree.c b/scan-tree.c
index b5b50f3..a0e09ce 100644
--- a/scan-tree.c
+++ b/scan-tree.c
@@ -1,235 +1,239 @@
 /* scan-tree.c
  * 
  * Copyright (C) 2008-2009 Lars Hjemli
  * Copyright (C) 2010 Jason A. Donenfeld <Jason@zx2c4.com>
  *
  * Licensed under GNU General Public License v2
  *   (see COPYING for full license text)
  */
 
 #include "cgit.h"
 #include "configfile.h"
 #include "html.h"
 
 #define MAX_PATH 4096
 
 /* return 1 if path contains a objects/ directory and a HEAD file */
 static int is_git_dir(const char *path)
 {
 	struct stat st;
 	static char buf[MAX_PATH];
 
 	if (snprintf(buf, MAX_PATH, "%s/objects", path) >= MAX_PATH) {
 		fprintf(stderr, "Insanely long path: %s\n", path);
 		return 0;
 	}
 	if (stat(buf, &st)) {
 		if (errno != ENOENT)
 			fprintf(stderr, "Error checking path %s: %s (%d)\n",
 				path, strerror(errno), errno);
 		return 0;
 	}
 	if (!S_ISDIR(st.st_mode))
 		return 0;
 
 	sprintf(buf, "%s/HEAD", path);
 	if (stat(buf, &st)) {
 		if (errno != ENOENT)
 			fprintf(stderr, "Error checking path %s: %s (%d)\n",
 				path, strerror(errno), errno);
 		return 0;
 	}
 	if (!S_ISREG(st.st_mode))
 		return 0;
 
 	return 1;
 }
 
 struct cgit_repo *repo;
 repo_config_fn config_fn;
 char *owner;
 
 static void repo_config(const char *name, const char *value)
 {
 	config_fn(repo, name, value);
 }
 
 static int git_owner_config(const char *key, const char *value, void *cb)
 {
 	if (!strcmp(key, "gitweb.owner"))
 		owner = xstrdup(value);
 	return 0;
 }
 
 static char *xstrrchr(char *s, char *from, int c)
 {
 	while (from >= s && *from != c)
 		from--;
 	return from < s ? NULL : from;
 }
 
 static void add_repo(const char *base, const char *path, repo_config_fn fn)
 {
 	struct stat st;
 	struct passwd *pwd;
 	char *rel, *p, *slash;
 	int n;
 	size_t size;
 
 	if (stat(path, &st)) {
 		fprintf(stderr, "Error accessing %s: %s (%d)\n",
 			path, strerror(errno), errno);
 		return;
 	}
+
+	if (ctx.cfg.strict_export && stat(fmt("%s/%s", path, ctx.cfg.strict_export), &st))
+		return;
+
 	if (!stat(fmt("%s/noweb", path), &st))
 		return;
 
 	owner = NULL;
 	if (ctx.cfg.enable_gitweb_owner)
 		git_config_from_file(git_owner_config, fmt("%s/config", path), NULL);
 	if (base == path)
 		rel = xstrdup(fmt("%s", path));
 	else
 		rel = xstrdup(fmt("%s", path + strlen(base) + 1));
 
 	if (!strcmp(rel + strlen(rel) - 5, "/.git"))
 		rel[strlen(rel) - 5] = '\0';
 
 	repo = cgit_add_repo(rel);
 	if (ctx.cfg.remove_suffix)
 		if ((p = strrchr(repo->url, '.')) && !strcmp(p, ".git"))
 			*p = '\0';
 	repo->name = repo->url;
 	repo->path = xstrdup(path);
 	while (!owner) {
 		if ((pwd = getpwuid(st.st_uid)) == NULL) {
 			fprintf(stderr, "Error reading owner-info for %s: %s (%d)\n",
 				path, strerror(errno), errno);
 			break;
 		}
 		if (pwd->pw_gecos)
 			if ((p = strchr(pwd->pw_gecos, ',')))
 				*p = '\0';
 		owner = xstrdup(pwd->pw_gecos ? pwd->pw_gecos : pwd->pw_name);
 	}
 	repo->owner = owner;
 
 	p = fmt("%s/description", path);
 	if (!stat(p, &st))
 		readfile(p, &repo->desc, &size);
 
 	if (!repo->readme) {
 		p = fmt("%s/README.html", path);
 		if (!stat(p, &st))
 			repo->readme = "README.html";
 	}
 	if (ctx.cfg.section_from_path) {
 		n  = ctx.cfg.section_from_path;
 		if (n > 0) {
 			slash = rel;
 			while (slash && n && (slash = strchr(slash, '/')))
 				n--;
 		} else {
 			slash = rel + strlen(rel);
 			while (slash && n && (slash = xstrrchr(rel, slash, '/')))
 				n++;
 		}
 		if (slash && !n) {
 			*slash = '\0';
 			repo->section = xstrdup(rel);
 			*slash = '/';
 			if (!prefixcmp(repo->name, repo->section)) {
 				repo->name += strlen(repo->section);
 				if (*repo->name == '/')
 					repo->name++;
 			}
 		}
 	}
 
 	p = fmt("%s/cgitrc", path);
 	if (!stat(p, &st)) {
 		config_fn = fn;
 		parse_configfile(xstrdup(p), &repo_config);
 	}
 }
 
 static void scan_path(const char *base, const char *path, repo_config_fn fn)
 {
 	DIR *dir;
 	struct dirent *ent;
 	char *buf;
 	struct stat st;
 
 	if (is_git_dir(path)) {
 		add_repo(base, path, fn);
 		return;
 	}
 	if (is_git_dir(fmt("%s/.git", path))) {
 		add_repo(base, fmt("%s/.git", path), fn);
 		return;
 	}
 	dir = opendir(path);
 	if (!dir) {
 		fprintf(stderr, "Error opening directory %s: %s (%d)\n",
 			path, strerror(errno), errno);
 		return;
 	}
 	while((ent = readdir(dir)) != NULL) {
 		if (ent->d_name[0] == '.') {
 			if (ent->d_name[1] == '\0')
 				continue;
 			if (ent->d_name[1] == '.' && ent->d_name[2] == '\0')
 				continue;
 		}
 		buf = malloc(strlen(path) + strlen(ent->d_name) + 2);
 		if (!buf) {
 			fprintf(stderr, "Alloc error on %s: %s (%d)\n",
 				path, strerror(errno), errno);
 			exit(1);
 		}
 		sprintf(buf, "%s/%s", path, ent->d_name);
 		if (stat(buf, &st)) {
 			fprintf(stderr, "Error checking path %s: %s (%d)\n",
 				buf, strerror(errno), errno);
 			free(buf);
 			continue;
 		}
 		if (S_ISDIR(st.st_mode))
 			scan_path(base, buf, fn);
 		free(buf);
 	}
 	closedir(dir);
 }
 
 #define lastc(s) s[strlen(s) - 1]
 
 void scan_projects(const char *path, const char *projectsfile, repo_config_fn fn)
 {
 	char line[MAX_PATH * 2], *z;
 	FILE *projects;
 	int err;
 	
 	projects = fopen(projectsfile, "r");
 	if (!projects) {
 		fprintf(stderr, "Error opening projectsfile %s: %s (%d)\n",
 			projectsfile, strerror(errno), errno);
 	}
 	while (fgets(line, sizeof(line), projects) != NULL) {
 		for (z = &lastc(line);
 		     strlen(line) && strchr("\n\r", *z);
 		     z = &lastc(line))
 			*z = '\0';
 		if (strlen(line))
 			scan_path(path, fmt("%s/%s", path, line), fn);
 	}
 	if ((err = ferror(projects))) {
 		fprintf(stderr, "Error reading from projectsfile %s: %s (%d)\n",
 			projectsfile, strerror(err), err);
 	}
 	fclose(projects);
 }
 
 void scan_tree(const char *path, repo_config_fn fn)
 {
 	scan_path(path, path, fn);
 }