Use GIT-1.7.3

This fixes http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2010-2542.

Noticed-by: Silvio Cesare <silvio.cesare@gmail.com>
Signed-off-by: Lars Hjemli <hjemli@gmail.com>

5 files changed, 8 insertions, 8 deletions

diff --git a/Makefile b/Makefile
index 5162020..0349639 100644
--- a/Makefile
+++ b/Makefile
@@ -1,171 +1,171 @@
 CGIT_VERSION = v0.8.3.3
 CGIT_SCRIPT_NAME = cgit.cgi
 CGIT_SCRIPT_PATH = /var/www/htdocs/cgit
 CGIT_DATA_PATH = $(CGIT_SCRIPT_PATH)
 CGIT_CONFIG = /etc/cgitrc
 CACHE_ROOT = /var/cache/cgit
 SHA1_HEADER = <openssl/sha.h>
-GIT_VER = 1.6.4.3
+GIT_VER = 1.7.3
 GIT_URL = http://www.kernel.org/pub/software/scm/git/git-$(GIT_VER).tar.bz2
 INSTALL = install
 
 # Define NO_STRCASESTR if you don't have strcasestr.
 #
 # Define NEEDS_LIBICONV if linking with libc is not enough (eg. Darwin).
 #
 
 #-include config.mak
 
 #
 # Platform specific tweaks
 #
 
 uname_S := $(shell sh -c 'uname -s 2>/dev/null || echo not')
 uname_O := $(shell sh -c 'uname -o 2>/dev/null || echo not')
 uname_R := $(shell sh -c 'uname -r 2>/dev/null || echo not')
 
 ifeq ($(uname_O),Cygwin)
 	NO_STRCASESTR = YesPlease
 	NEEDS_LIBICONV = YesPlease
 endif
 
 #
 # Let the user override the above settings.
 #
 -include cgit.conf
 
 #
 # Define a way to invoke make in subdirs quietly, shamelessly ripped
 # from git.git
 #
 QUIET_SUBDIR0  = +$(MAKE) -C # space to separate -C and subdir
 QUIET_SUBDIR1  =
 
 ifneq ($(findstring $(MAKEFLAGS),w),w)
 PRINT_DIR = --no-print-directory
 else # "make -w"
 NO_SUBDIR = :
 endif
 
 ifndef V
 	QUIET_CC       = @echo '   ' CC $@;
 	QUIET_MM       = @echo '   ' MM $@;
 	QUIET_SUBDIR0  = +@subdir=
 	QUIET_SUBDIR1  = ;$(NO_SUBDIR) echo '   ' SUBDIR $$subdir; \
 			 $(MAKE) $(PRINT_DIR) -C $$subdir
 endif
 
 #
 # Define a pattern rule for automatic dependency building
 #
 %.d: %.c
 	$(QUIET_MM)$(CC) $(CFLAGS) -MM $< | sed -e 's/\($*\)\.o:/\1.o $@:/g' >$@
 
 #
 # Define a pattern rule for silent object building
 #
 %.o: %.c
 	$(QUIET_CC)$(CC) -o $*.o -c $(CFLAGS) $<
 
 
-EXTLIBS = git/libgit.a git/xdiff/lib.a -lz -lcrypto
+EXTLIBS = git/libgit.a git/xdiff/lib.a -lz -lcrypto -lpthread
 OBJECTS =
 OBJECTS += cache.o
 OBJECTS += cgit.o
 OBJECTS += cmd.o
 OBJECTS += configfile.o
 OBJECTS += html.o
 OBJECTS += parsing.o
 OBJECTS += scan-tree.o
 OBJECTS += shared.o
 OBJECTS += ui-atom.o
 OBJECTS += ui-blob.o
 OBJECTS += ui-clone.o
 OBJECTS += ui-commit.o
 OBJECTS += ui-diff.o
 OBJECTS += ui-log.o
 OBJECTS += ui-patch.o
 OBJECTS += ui-plain.o
 OBJECTS += ui-refs.o
 OBJECTS += ui-repolist.o
 OBJECTS += ui-shared.o
 OBJECTS += ui-snapshot.o
 OBJECTS += ui-stats.o
 OBJECTS += ui-summary.o
 OBJECTS += ui-tag.o
 OBJECTS += ui-tree.o
 
 ifdef NEEDS_LIBICONV
 	EXTLIBS += -liconv
 endif
 
 
 .PHONY: all libgit test install uninstall clean force-version get-git \
 	doc man-doc html-doc clean-doc
 
 all: cgit
 
 VERSION: force-version
 	@./gen-version.sh "$(CGIT_VERSION)"
 -include VERSION
 
 
 CFLAGS += -g -Wall -Igit
 CFLAGS += -DSHA1_HEADER='$(SHA1_HEADER)'
 CFLAGS += -DCGIT_VERSION='"$(CGIT_VERSION)"'
 CFLAGS += -DCGIT_CONFIG='"$(CGIT_CONFIG)"'
 CFLAGS += -DCGIT_SCRIPT_NAME='"$(CGIT_SCRIPT_NAME)"'
 CFLAGS += -DCGIT_CACHE_ROOT='"$(CACHE_ROOT)"'
 
 ifdef NO_ICONV
 	CFLAGS += -DNO_ICONV
 endif
 ifdef NO_STRCASESTR
 	CFLAGS += -DNO_STRCASESTR
 endif
 
 cgit: $(OBJECTS) libgit
 	$(QUIET_CC)$(CC) $(CFLAGS) $(LDFLAGS) -o cgit $(OBJECTS) $(EXTLIBS)
 
 cgit.o: VERSION
 
 -include $(OBJECTS:.o=.d)
 
 libgit:
 	$(QUIET_SUBDIR0)git $(QUIET_SUBDIR1) NO_CURL=1 libgit.a
 	$(QUIET_SUBDIR0)git $(QUIET_SUBDIR1) NO_CURL=1 xdiff/lib.a
 
 test: all
 	$(QUIET_SUBDIR0)tests $(QUIET_SUBDIR1) all
 
 install: all
 	$(INSTALL) -m 0755 -d $(DESTDIR)$(CGIT_SCRIPT_PATH)
 	$(INSTALL) -m 0755 cgit $(DESTDIR)$(CGIT_SCRIPT_PATH)/$(CGIT_SCRIPT_NAME)
 	$(INSTALL) -m 0755 -d $(DESTDIR)$(CGIT_DATA_PATH)
 	$(INSTALL) -m 0644 cgit.css $(DESTDIR)$(CGIT_DATA_PATH)/cgit.css
 	$(INSTALL) -m 0644 cgit.png $(DESTDIR)$(CGIT_DATA_PATH)/cgit.png
 
 uninstall:
 	rm -f $(CGIT_SCRIPT_PATH)/$(CGIT_SCRIPT_NAME)
 	rm -f $(CGIT_DATA_PATH)/cgit.css
 	rm -f $(CGIT_DATA_PATH)/cgit.png
 
 doc: man-doc html-doc pdf-doc
 
 man-doc: cgitrc.5.txt
 	a2x -f manpage cgitrc.5.txt
 
 html-doc: cgitrc.5.txt
 	a2x -f xhtml --stylesheet=cgit-doc.css cgitrc.5.txt
 
 pdf-doc: cgitrc.5.txt
 	a2x -f pdf cgitrc.5.txt
 
 clean: clean-doc
 	rm -f cgit VERSION *.o *.d
 
 clean-doc:
 	rm -f cgitrc.5 cgitrc.5.html cgitrc.5.pdf cgitrc.5.xml cgitrc.5.fo
 
 get-git:
 	curl $(GIT_URL) | tar -xj && rm -rf git && mv git-$(GIT_VER) git
diff --git a/cgit.c b/cgit.c
index 6c7e811..ad62d10 100644
--- a/cgit.c
+++ b/cgit.c
@@ -1,718 +1,718 @@
 /* cgit.c: cgi for the git scm
  *
  * Copyright (C) 2006 Lars Hjemli
  *
  * Licensed under GNU General Public License v2
  *   (see COPYING for full license text)
  */
 
 #include "cgit.h"
 #include "cache.h"
 #include "cmd.h"
 #include "configfile.h"
 #include "html.h"
 #include "ui-shared.h"
 #include "ui-stats.h"
 #include "scan-tree.h"
 
 const char *cgit_version = CGIT_VERSION;
 
 void add_mimetype(const char *name, const char *value)
 {
 	struct string_list_item *item;
 
-	item = string_list_insert(xstrdup(name), &ctx.cfg.mimetypes);
+	item = string_list_insert(&ctx.cfg.mimetypes, xstrdup(name));
 	item->util = xstrdup(value);
 }
 
 struct cgit_filter *new_filter(const char *cmd, int extra_args)
 {
 	struct cgit_filter *f;
 
 	if (!cmd || !cmd[0])
 		return NULL;
 
 	f = xmalloc(sizeof(struct cgit_filter));
 	f->cmd = xstrdup(cmd);
 	f->argv = xmalloc((2 + extra_args) * sizeof(char *));
 	f->argv[0] = f->cmd;
 	f->argv[1] = NULL;
 	return f;
 }
 
 static void process_cached_repolist(const char *path);
 
 void repo_config(struct cgit_repo *repo, const char *name, const char *value)
 {
 	if (!strcmp(name, "name"))
 		repo->name = xstrdup(value);
 	else if (!strcmp(name, "clone-url"))
 		repo->clone_url = xstrdup(value);
 	else if (!strcmp(name, "desc"))
 		repo->desc = xstrdup(value);
 	else if (!strcmp(name, "owner"))
 		repo->owner = xstrdup(value);
 	else if (!strcmp(name, "defbranch"))
 		repo->defbranch = xstrdup(value);
 	else if (!strcmp(name, "snapshots"))
 		repo->snapshots = ctx.cfg.snapshots & cgit_parse_snapshots_mask(value);
 	else if (!strcmp(name, "enable-log-filecount"))
 		repo->enable_log_filecount = ctx.cfg.enable_log_filecount * atoi(value);
 	else if (!strcmp(name, "enable-log-linecount"))
 		repo->enable_log_linecount = ctx.cfg.enable_log_linecount * atoi(value);
 	else if (!strcmp(name, "max-stats"))
 		repo->max_stats = cgit_find_stats_period(value, NULL);
 	else if (!strcmp(name, "module-link"))
 		repo->module_link= xstrdup(value);
 	else if (!strcmp(name, "section"))
 		repo->section = xstrdup(value);
 	else if (!strcmp(name, "readme") && value != NULL) {
 		if (*value == '/')
 			repo->readme = xstrdup(value);
 		else
 			repo->readme = xstrdup(fmt("%s/%s", repo->path, value));
 	} else if (ctx.cfg.enable_filter_overrides) {
 		if (!strcmp(name, "about-filter"))
 			repo->about_filter = new_filter(value, 0);
 		else if (!strcmp(name, "commit-filter"))
 			repo->commit_filter = new_filter(value, 0);
 		else if (!strcmp(name, "source-filter"))
 			repo->source_filter = new_filter(value, 1);
 	}
 }
 
 void config_cb(const char *name, const char *value)
 {
 	if (!strcmp(name, "section") || !strcmp(name, "repo.group"))
 		ctx.cfg.section = xstrdup(value);
 	else if (!strcmp(name, "repo.url"))
 		ctx.repo = cgit_add_repo(value);
 	else if (ctx.repo && !strcmp(name, "repo.path"))
 		ctx.repo->path = trim_end(value, '/');
 	else if (ctx.repo && !prefixcmp(name, "repo."))
 		repo_config(ctx.repo, name + 5, value);
 	else if (!strcmp(name, "root-title"))
 		ctx.cfg.root_title = xstrdup(value);
 	else if (!strcmp(name, "root-desc"))
 		ctx.cfg.root_desc = xstrdup(value);
 	else if (!strcmp(name, "root-readme"))
 		ctx.cfg.root_readme = xstrdup(value);
 	else if (!strcmp(name, "css"))
 		ctx.cfg.css = xstrdup(value);
 	else if (!strcmp(name, "favicon"))
 		ctx.cfg.favicon = xstrdup(value);
 	else if (!strcmp(name, "footer"))
 		ctx.cfg.footer = xstrdup(value);
 	else if (!strcmp(name, "head-include"))
 		ctx.cfg.head_include = xstrdup(value);
 	else if (!strcmp(name, "header"))
 		ctx.cfg.header = xstrdup(value);
 	else if (!strcmp(name, "logo"))
 		ctx.cfg.logo = xstrdup(value);
 	else if (!strcmp(name, "index-header"))
 		ctx.cfg.index_header = xstrdup(value);
 	else if (!strcmp(name, "index-info"))
 		ctx.cfg.index_info = xstrdup(value);
 	else if (!strcmp(name, "logo-link"))
 		ctx.cfg.logo_link = xstrdup(value);
 	else if (!strcmp(name, "module-link"))
 		ctx.cfg.module_link = xstrdup(value);
 	else if (!strcmp(name, "virtual-root")) {
 		ctx.cfg.virtual_root = trim_end(value, '/');
 		if (!ctx.cfg.virtual_root && (!strcmp(value, "/")))
 			ctx.cfg.virtual_root = "";
 	} else if (!strcmp(name, "nocache"))
 		ctx.cfg.nocache = atoi(value);
 	else if (!strcmp(name, "noplainemail"))
 		ctx.cfg.noplainemail = atoi(value);
 	else if (!strcmp(name, "noheader"))
 		ctx.cfg.noheader = atoi(value);
 	else if (!strcmp(name, "snapshots"))
 		ctx.cfg.snapshots = cgit_parse_snapshots_mask(value);
 	else if (!strcmp(name, "enable-filter-overrides"))
 		ctx.cfg.enable_filter_overrides = atoi(value);
 	else if (!strcmp(name, "enable-index-links"))
 		ctx.cfg.enable_index_links = atoi(value);
 	else if (!strcmp(name, "enable-log-filecount"))
 		ctx.cfg.enable_log_filecount = atoi(value);
 	else if (!strcmp(name, "enable-log-linecount"))
 		ctx.cfg.enable_log_linecount = atoi(value);
 	else if (!strcmp(name, "enable-tree-linenumbers"))
 		ctx.cfg.enable_tree_linenumbers = atoi(value);
 	else if (!strcmp(name, "max-stats"))
 		ctx.cfg.max_stats = cgit_find_stats_period(value, NULL);
 	else if (!strcmp(name, "cache-size"))
 		ctx.cfg.cache_size = atoi(value);
 	else if (!strcmp(name, "cache-root"))
 		ctx.cfg.cache_root = xstrdup(value);
 	else if (!strcmp(name, "cache-root-ttl"))
 		ctx.cfg.cache_root_ttl = atoi(value);
 	else if (!strcmp(name, "cache-repo-ttl"))
 		ctx.cfg.cache_repo_ttl = atoi(value);
 	else if (!strcmp(name, "cache-scanrc-ttl"))
 		ctx.cfg.cache_scanrc_ttl = atoi(value);
 	else if (!strcmp(name, "cache-static-ttl"))
 		ctx.cfg.cache_static_ttl = atoi(value);
 	else if (!strcmp(name, "cache-dynamic-ttl"))
 		ctx.cfg.cache_dynamic_ttl = atoi(value);
 	else if (!strcmp(name, "about-filter"))
 		ctx.cfg.about_filter = new_filter(value, 0);
 	else if (!strcmp(name, "commit-filter"))
 		ctx.cfg.commit_filter = new_filter(value, 0);
 	else if (!strcmp(name, "embedded"))
 		ctx.cfg.embedded = atoi(value);
 	else if (!strcmp(name, "max-message-length"))
 		ctx.cfg.max_msg_len = atoi(value);
 	else if (!strcmp(name, "max-repodesc-length"))
 		ctx.cfg.max_repodesc_len = atoi(value);
 	else if (!strcmp(name, "max-repo-count"))
 		ctx.cfg.max_repo_count = atoi(value);
 	else if (!strcmp(name, "max-commit-count"))
 		ctx.cfg.max_commit_count = atoi(value);
 	else if (!strcmp(name, "scan-path"))
 		if (!ctx.cfg.nocache && ctx.cfg.cache_size)
 			process_cached_repolist(value);
 		else
 			scan_tree(value, repo_config);
 	else if (!strcmp(name, "source-filter"))
 		ctx.cfg.source_filter = new_filter(value, 1);
 	else if (!strcmp(name, "summary-log"))
 		ctx.cfg.summary_log = atoi(value);
 	else if (!strcmp(name, "summary-branches"))
 		ctx.cfg.summary_branches = atoi(value);
 	else if (!strcmp(name, "summary-tags"))
 		ctx.cfg.summary_tags = atoi(value);
 	else if (!strcmp(name, "agefile"))
 		ctx.cfg.agefile = xstrdup(value);
 	else if (!strcmp(name, "renamelimit"))
 		ctx.cfg.renamelimit = atoi(value);
 	else if (!strcmp(name, "robots"))
 		ctx.cfg.robots = xstrdup(value);
 	else if (!strcmp(name, "clone-prefix"))
 		ctx.cfg.clone_prefix = xstrdup(value);
 	else if (!strcmp(name, "local-time"))
 		ctx.cfg.local_time = atoi(value);
 	else if (!prefixcmp(name, "mimetype."))
 		add_mimetype(name + 9, value);
 	else if (!strcmp(name, "include"))
 		parse_configfile(value, config_cb);
 }
 
 static void querystring_cb(const char *name, const char *value)
 {
 	if (!value)
 		value = "";
 
 	if (!strcmp(name,"r")) {
 		ctx.qry.repo = xstrdup(value);
 		ctx.repo = cgit_get_repoinfo(value);
 	} else if (!strcmp(name, "p")) {
 		ctx.qry.page = xstrdup(value);
 	} else if (!strcmp(name, "url")) {
 		ctx.qry.url = xstrdup(value);
 		cgit_parse_url(value);
 	} else if (!strcmp(name, "qt")) {
 		ctx.qry.grep = xstrdup(value);
 	} else if (!strcmp(name, "q")) {
 		ctx.qry.search = xstrdup(value);
 	} else if (!strcmp(name, "h")) {
 		ctx.qry.head = xstrdup(value);
 		ctx.qry.has_symref = 1;
 	} else if (!strcmp(name, "id")) {
 		ctx.qry.sha1 = xstrdup(value);
 		ctx.qry.has_sha1 = 1;
 	} else if (!strcmp(name, "id2")) {
 		ctx.qry.sha2 = xstrdup(value);
 		ctx.qry.has_sha1 = 1;
 	} else if (!strcmp(name, "ofs")) {
 		ctx.qry.ofs = atoi(value);
 	} else if (!strcmp(name, "path")) {
 		ctx.qry.path = trim_end(value, '/');
 	} else if (!strcmp(name, "name")) {
 		ctx.qry.name = xstrdup(value);
 	} else if (!strcmp(name, "mimetype")) {
 		ctx.qry.mimetype = xstrdup(value);
 	} else if (!strcmp(name, "s")){
 		ctx.qry.sort = xstrdup(value);
 	} else if (!strcmp(name, "showmsg")) {
 		ctx.qry.showmsg = atoi(value);
 	} else if (!strcmp(name, "period")) {
 		ctx.qry.period = xstrdup(value);
 	}
 }
 
 char *xstrdupn(const char *str)
 {
 	return (str ? xstrdup(str) : NULL);
 }
 
 static void prepare_context(struct cgit_context *ctx)
 {
 	memset(ctx, 0, sizeof(*ctx));
 	ctx->cfg.agefile = "info/web/last-modified";
 	ctx->cfg.nocache = 0;
 	ctx->cfg.cache_size = 0;
 	ctx->cfg.cache_dynamic_ttl = 5;
 	ctx->cfg.cache_max_create_time = 5;
 	ctx->cfg.cache_repo_ttl = 5;
 	ctx->cfg.cache_root = CGIT_CACHE_ROOT;
 	ctx->cfg.cache_root_ttl = 5;
 	ctx->cfg.cache_scanrc_ttl = 15;
 	ctx->cfg.cache_static_ttl = -1;
 	ctx->cfg.css = "/cgit.css";
 	ctx->cfg.logo = "/cgit.png";
 	ctx->cfg.local_time = 0;
 	ctx->cfg.enable_tree_linenumbers = 1;
 	ctx->cfg.max_repo_count = 50;
 	ctx->cfg.max_commit_count = 50;
 	ctx->cfg.max_lock_attempts = 5;
 	ctx->cfg.max_msg_len = 80;
 	ctx->cfg.max_repodesc_len = 80;
 	ctx->cfg.max_stats = 0;
 	ctx->cfg.module_link = "./?repo=%s&page=commit&id=%s";
 	ctx->cfg.renamelimit = -1;
 	ctx->cfg.robots = "index, nofollow";
 	ctx->cfg.root_title = "Git repository browser";
 	ctx->cfg.root_desc = "a fast webinterface for the git dscm";
 	ctx->cfg.script_name = CGIT_SCRIPT_NAME;
 	ctx->cfg.section = "";
 	ctx->cfg.summary_branches = 10;
 	ctx->cfg.summary_log = 10;
 	ctx->cfg.summary_tags = 10;
 	ctx->env.cgit_config = xstrdupn(getenv("CGIT_CONFIG"));
 	ctx->env.http_host = xstrdupn(getenv("HTTP_HOST"));
 	ctx->env.https = xstrdupn(getenv("HTTPS"));
 	ctx->env.no_http = xstrdupn(getenv("NO_HTTP"));
 	ctx->env.path_info = xstrdupn(getenv("PATH_INFO"));
 	ctx->env.query_string = xstrdupn(getenv("QUERY_STRING"));
 	ctx->env.request_method = xstrdupn(getenv("REQUEST_METHOD"));
 	ctx->env.script_name = xstrdupn(getenv("SCRIPT_NAME"));
 	ctx->env.server_name = xstrdupn(getenv("SERVER_NAME"));
 	ctx->env.server_port = xstrdupn(getenv("SERVER_PORT"));
 	ctx->page.mimetype = "text/html";
 	ctx->page.charset = PAGE_ENCODING;
 	ctx->page.filename = NULL;
 	ctx->page.size = 0;
 	ctx->page.modified = time(NULL);
 	ctx->page.expires = ctx->page.modified;
 	ctx->page.etag = NULL;
 	memset(&ctx->cfg.mimetypes, 0, sizeof(struct string_list));
 	if (ctx->env.script_name)
 		ctx->cfg.script_name = ctx->env.script_name;
 	if (ctx->env.query_string)
 		ctx->qry.raw = ctx->env.query_string;
 	if (!ctx->env.cgit_config)
 		ctx->env.cgit_config = CGIT_CONFIG;
 }
 
 struct refmatch {
 	char *req_ref;
 	char *first_ref;
 	int match;
 };
 
 int find_current_ref(const char *refname, const unsigned char *sha1,
 		     int flags, void *cb_data)
 {
 	struct refmatch *info;
 
 	info = (struct refmatch *)cb_data;
 	if (!strcmp(refname, info->req_ref))
 		info->match = 1;
 	if (!info->first_ref)
 		info->first_ref = xstrdup(refname);
 	return info->match;
 }
 
 char *find_default_branch(struct cgit_repo *repo)
 {
 	struct refmatch info;
 	char *ref;
 
 	info.req_ref = repo->defbranch;
 	info.first_ref = NULL;
 	info.match = 0;
 	for_each_branch_ref(find_current_ref, &info);
 	if (info.match)
 		ref = info.req_ref;
 	else
 		ref = info.first_ref;
 	if (ref)
 		ref = xstrdup(ref);
 	return ref;
 }
 
 static int prepare_repo_cmd(struct cgit_context *ctx)
 {
 	char *tmp;
 	unsigned char sha1[20];
 	int nongit = 0;
 
 	setenv("GIT_DIR", ctx->repo->path, 1);
 	setup_git_directory_gently(&nongit);
 	if (nongit) {
 		ctx->page.title = fmt("%s - %s", ctx->cfg.root_title,
 				      "config error");
 		tmp = fmt("Not a git repository: '%s'", ctx->repo->path);
 		ctx->repo = NULL;
 		cgit_print_http_headers(ctx);
 		cgit_print_docstart(ctx);
 		cgit_print_pageheader(ctx);
 		cgit_print_error(tmp);
 		cgit_print_docend();
 		return 1;
 	}
 	ctx->page.title = fmt("%s - %s", ctx->repo->name, ctx->repo->desc);
 
 	if (!ctx->qry.head) {
 		ctx->qry.nohead = 1;
 		ctx->qry.head = find_default_branch(ctx->repo);
 		ctx->repo->defbranch = ctx->qry.head;
 	}
 
 	if (!ctx->qry.head) {
 		cgit_print_http_headers(ctx);
 		cgit_print_docstart(ctx);
 		cgit_print_pageheader(ctx);
 		cgit_print_error("Repository seems to be empty");
 		cgit_print_docend();
 		return 1;
 	}
 
 	if (get_sha1(ctx->qry.head, sha1)) {
 		tmp = xstrdup(ctx->qry.head);
 		ctx->qry.head = ctx->repo->defbranch;
 		ctx->page.status = 404;
 		ctx->page.statusmsg = "not found";
 		cgit_print_http_headers(ctx);
 		cgit_print_docstart(ctx);
 		cgit_print_pageheader(ctx);
 		cgit_print_error(fmt("Invalid branch: %s", tmp));
 		cgit_print_docend();
 		return 1;
 	}
 	return 0;
 }
 
 static void process_request(void *cbdata)
 {
 	struct cgit_context *ctx = cbdata;
 	struct cgit_cmd *cmd;
 
 	cmd = cgit_get_cmd(ctx);
 	if (!cmd) {
 		ctx->page.title = "cgit error";
 		cgit_print_http_headers(ctx);
 		cgit_print_docstart(ctx);
 		cgit_print_pageheader(ctx);
 		cgit_print_error("Invalid request");
 		cgit_print_docend();
 		return;
 	}
 
 	if (cmd->want_repo && !ctx->repo) {
 		cgit_print_http_headers(ctx);
 		cgit_print_docstart(ctx);
 		cgit_print_pageheader(ctx);
 		cgit_print_error(fmt("No repository selected"));
 		cgit_print_docend();
 		return;
 	}
 
 	if (ctx->repo && prepare_repo_cmd(ctx))
 		return;
 
 	if (cmd->want_layout) {
 		cgit_print_http_headers(ctx);
 		cgit_print_docstart(ctx);
 		cgit_print_pageheader(ctx);
 	}
 
 	cmd->fn(ctx);
 
 	if (cmd->want_layout)
 		cgit_print_docend();
 }
 
 int cmp_repos(const void *a, const void *b)
 {
 	const struct cgit_repo *ra = a, *rb = b;
 	return strcmp(ra->url, rb->url);
 }
 
 char *build_snapshot_setting(int bitmap)
 {
 	const struct cgit_snapshot_format *f;
 	char *result = xstrdup("");
 	char *tmp;
 	int len;
 
 	for (f = cgit_snapshot_formats; f->suffix; f++) {
 		if (f->bit & bitmap) {
 			tmp = result;
 			result = xstrdup(fmt("%s%s ", tmp, f->suffix));
 			free(tmp);
 		}
 	}
 	len = strlen(result);
 	if (len)
 		result[len - 1] = '\0';
 	return result;
 }
 
 char *get_first_line(char *txt)
 {
 	char *t = xstrdup(txt);
 	char *p = strchr(t, '\n');
 	if (p)
 		*p = '\0';
 	return t;
 }
 
 void print_repo(FILE *f, struct cgit_repo *repo)
 {
 	fprintf(f, "repo.url=%s\n", repo->url);
 	fprintf(f, "repo.name=%s\n", repo->name);
 	fprintf(f, "repo.path=%s\n", repo->path);
 	if (repo->owner)
 		fprintf(f, "repo.owner=%s\n", repo->owner);
 	if (repo->desc) {
 		char *tmp = get_first_line(repo->desc);
 		fprintf(f, "repo.desc=%s\n", tmp);
 		free(tmp);
 	}
 	if (repo->readme)
 		fprintf(f, "repo.readme=%s\n", repo->readme);
 	if (repo->defbranch)
 		fprintf(f, "repo.defbranch=%s\n", repo->defbranch);
 	if (repo->module_link)
 		fprintf(f, "repo.module-link=%s\n", repo->module_link);
 	if (repo->section)
 		fprintf(f, "repo.section=%s\n", repo->section);
 	if (repo->clone_url)
 		fprintf(f, "repo.clone-url=%s\n", repo->clone_url);
 	fprintf(f, "repo.enable-log-filecount=%d\n",
 	        repo->enable_log_filecount);
 	fprintf(f, "repo.enable-log-linecount=%d\n",
 	        repo->enable_log_linecount);
 	if (repo->about_filter && repo->about_filter != ctx.cfg.about_filter)
 		fprintf(f, "repo.about-filter=%s\n", repo->about_filter->cmd);
 	if (repo->commit_filter && repo->commit_filter != ctx.cfg.commit_filter)
 		fprintf(f, "repo.commit-filter=%s\n", repo->commit_filter->cmd);
 	if (repo->source_filter && repo->source_filter != ctx.cfg.source_filter)
 		fprintf(f, "repo.source-filter=%s\n", repo->source_filter->cmd);
 	if (repo->snapshots != ctx.cfg.snapshots) {
 		char *tmp = build_snapshot_setting(repo->snapshots);
 		fprintf(f, "repo.snapshots=%s\n", tmp);
 		free(tmp);
 	}
 	if (repo->max_stats != ctx.cfg.max_stats)
 		fprintf(f, "repo.max-stats=%s\n",
 		        cgit_find_stats_periodname(repo->max_stats));
 	fprintf(f, "\n");
 }
 
 void print_repolist(FILE *f, struct cgit_repolist *list, int start)
 {
 	int i;
 
 	for(i = start; i < list->count; i++)
 		print_repo(f, &list->repos[i]);
 }
 
 /* Scan 'path' for git repositories, save the resulting repolist in 'cached_rc'
  * and return 0 on success.
  */
 static int generate_cached_repolist(const char *path, const char *cached_rc)
 {
 	char *locked_rc;
 	int idx;
 	FILE *f;
 
 	locked_rc = xstrdup(fmt("%s.lock", cached_rc));
 	f = fopen(locked_rc, "wx");
 	if (!f) {
 		/* Inform about the error unless the lockfile already existed,
 		 * since that only means we've got concurrent requests.
 		 */
 		if (errno != EEXIST)
 			fprintf(stderr, "[cgit] Error opening %s: %s (%d)\n",
 				locked_rc, strerror(errno), errno);
 		return errno;
 	}
 	idx = cgit_repolist.count;
 	scan_tree(path, repo_config);
 	print_repolist(f, &cgit_repolist, idx);
 	if (rename(locked_rc, cached_rc))
 		fprintf(stderr, "[cgit] Error renaming %s to %s: %s (%d)\n",
 			locked_rc, cached_rc, strerror(errno), errno);
 	fclose(f);
 	return 0;
 }
 
 static void process_cached_repolist(const char *path)
 {
 	struct stat st;
 	char *cached_rc;
 	time_t age;
 
 	cached_rc = xstrdup(fmt("%s/rc-%8x", ctx.cfg.cache_root,
 		hash_str(path)));
 
 	if (stat(cached_rc, &st)) {
 		/* Nothing is cached, we need to scan without forking. And
 		 * if we fail to generate a cached repolist, we need to
 		 * invoke scan_tree manually.
 		 */
 		if (generate_cached_repolist(path, cached_rc))
 			scan_tree(path, repo_config);
 		return;
 	}
 
 	parse_configfile(cached_rc, config_cb);
 
 	/* If the cached configfile hasn't expired, lets exit now */
 	age = time(NULL) - st.st_mtime;
 	if (age <= (ctx.cfg.cache_scanrc_ttl * 60))
 		return;
 
 	/* The cached repolist has been parsed, but it was old. So lets
 	 * rescan the specified path and generate a new cached repolist
 	 * in a child-process to avoid latency for the current request.
 	 */
 	if (fork())
 		return;
 
 	exit(generate_cached_repolist(path, cached_rc));
 }
 
 static void cgit_parse_args(int argc, const char **argv)
 {
 	int i;
 	int scan = 0;
 
 	for (i = 1; i < argc; i++) {
 		if (!strncmp(argv[i], "--cache=", 8)) {
 			ctx.cfg.cache_root = xstrdup(argv[i]+8);
 		}
 		if (!strcmp(argv[i], "--nocache")) {
 			ctx.cfg.nocache = 1;
 		}
 		if (!strcmp(argv[i], "--nohttp")) {
 			ctx.env.no_http = "1";
 		}
 		if (!strncmp(argv[i], "--query=", 8)) {
 			ctx.qry.raw = xstrdup(argv[i]+8);
 		}
 		if (!strncmp(argv[i], "--repo=", 7)) {
 			ctx.qry.repo = xstrdup(argv[i]+7);
 		}
 		if (!strncmp(argv[i], "--page=", 7)) {
 			ctx.qry.page = xstrdup(argv[i]+7);
 		}
 		if (!strncmp(argv[i], "--head=", 7)) {
 			ctx.qry.head = xstrdup(argv[i]+7);
 			ctx.qry.has_symref = 1;
 		}
 		if (!strncmp(argv[i], "--sha1=", 7)) {
 			ctx.qry.sha1 = xstrdup(argv[i]+7);
 			ctx.qry.has_sha1 = 1;
 		}
 		if (!strncmp(argv[i], "--ofs=", 6)) {
 			ctx.qry.ofs = atoi(argv[i]+6);
 		}
 		if (!strncmp(argv[i], "--scan-tree=", 12) ||
 		    !strncmp(argv[i], "--scan-path=", 12)) {
 			/* HACK: the global snapshot bitmask defines the
 			 * set of allowed snapshot formats, but the config
 			 * file hasn't been parsed yet so the mask is
 			 * currently 0. By setting all bits high before
 			 * scanning we make sure that any in-repo cgitrc
 			 * snapshot setting is respected by scan_tree().
 			 * BTW: we assume that there'll never be more than
 			 * 255 different snapshot formats supported by cgit...
 			 */
 			ctx.cfg.snapshots = 0xFF;
 			scan++;
 			scan_tree(argv[i] + 12, repo_config);
 		}
 	}
 	if (scan) {
 		qsort(cgit_repolist.repos, cgit_repolist.count,
 			sizeof(struct cgit_repo), cmp_repos);
 		print_repolist(stdout, &cgit_repolist, 0);
 		exit(0);
 	}
 }
 
 static int calc_ttl()
 {
 	if (!ctx.repo)
 		return ctx.cfg.cache_root_ttl;
 
 	if (!ctx.qry.page)
 		return ctx.cfg.cache_repo_ttl;
 
 	if (ctx.qry.has_symref)
 		return ctx.cfg.cache_dynamic_ttl;
 
 	if (ctx.qry.has_sha1)
 		return ctx.cfg.cache_static_ttl;
 
 	return ctx.cfg.cache_repo_ttl;
 }
 
 int main(int argc, const char **argv)
 {
 	const char *path;
 	char *qry;
 	int err, ttl;
 
 	prepare_context(&ctx);
 	cgit_repolist.length = 0;
 	cgit_repolist.count = 0;
 	cgit_repolist.repos = NULL;
 
 	cgit_parse_args(argc, argv);
 	parse_configfile(ctx.env.cgit_config, config_cb);
 	ctx.repo = NULL;
 	http_parse_querystring(ctx.qry.raw, querystring_cb);
 
 	/* If virtual-root isn't specified in cgitrc, lets pretend
 	 * that virtual-root equals SCRIPT_NAME.
 	 */
 	if (!ctx.cfg.virtual_root)
 		ctx.cfg.virtual_root = ctx.cfg.script_name;
 
 	/* If no url parameter is specified on the querystring, lets
 	 * use PATH_INFO as url. This allows cgit to work with virtual
 	 * urls without the need for rewriterules in the webserver (as
 	 * long as PATH_INFO is included in the cache lookup key).
 	 */
 	path = ctx.env.path_info;
 	if (!ctx.qry.url && path) {
 		if (path[0] == '/')
 			path++;
 		ctx.qry.url = xstrdup(path);
 		if (ctx.qry.raw) {
 			qry = ctx.qry.raw;
 			ctx.qry.raw = xstrdup(fmt("%s?%s", path, qry));
 			free(qry);
 		} else
 			ctx.qry.raw = xstrdup(ctx.qry.url);
 		cgit_parse_url(ctx.qry.url);
 	}
 
 	ttl = calc_ttl();
 	ctx.page.expires += ttl*60;
 	if (ctx.env.request_method && !strcmp(ctx.env.request_method, "HEAD"))
 		ctx.cfg.nocache = 1;
 	if (ctx.cfg.nocache)
 		ctx.cfg.cache_size = 0;
 	err = cache_process(ctx.cfg.cache_size, ctx.cfg.cache_root,
 			    ctx.qry.raw, ttl, process_request, &ctx);
 	if (err)
 		cgit_print_error(fmt("Error processing page: %s (%d)",
 				     strerror(err), err));
 	return err;
 }
diff --git a/git b/git
-Subproject 7fb6bcff2dece2ff9fbc5ebfe526d9b2a7e764c
+Subproject 87b50542a08ac6caa083ddc376e674424e37940
diff --git a/ui-plain.c b/ui-plain.c
index 66cb19c..5569a7c 100644
--- a/ui-plain.c
+++ b/ui-plain.c
@@ -1,94 +1,94 @@
 /* ui-plain.c: functions for output of plain blobs by path
  *
  * Copyright (C) 2008 Lars Hjemli
  *
  * Licensed under GNU General Public License v2
  *   (see COPYING for full license text)
  */
 
 #include "cgit.h"
 #include "html.h"
 #include "ui-shared.h"
 
 char *curr_rev;
 char *match_path;
 int match;
 
 static void print_object(const unsigned char *sha1, const char *path)
 {
 	enum object_type type;
 	char *buf, *ext;
 	unsigned long size;
 	struct string_list_item *mime;
 
 	type = sha1_object_info(sha1, &size);
 	if (type == OBJ_BAD) {
 		html_status(404, "Not found", 0);
 		return;
 	}
 
 	buf = read_sha1_file(sha1, &type, &size);
 	if (!buf) {
 		html_status(404, "Not found", 0);
 		return;
 	}
 	ctx.page.mimetype = NULL;
 	ext = strrchr(path, '.');
 	if (ext && *(++ext)) {
-		mime = string_list_lookup(ext, &ctx.cfg.mimetypes);
+		mime = string_list_lookup(&ctx.cfg.mimetypes, ext);
 		if (mime)
 			ctx.page.mimetype = (char *)mime->util;
 	}
 	if (!ctx.page.mimetype) {
 		if (buffer_is_binary(buf, size))
 			ctx.page.mimetype = "application/octet-stream";
 		else
 			ctx.page.mimetype = "text/plain";
 	}
 	ctx.page.filename = fmt("%s", path);
 	ctx.page.size = size;
 	ctx.page.etag = sha1_to_hex(sha1);
 	cgit_print_http_headers(&ctx);
 	html_raw(buf, size);
 	match = 1;
 }
 
 static int walk_tree(const unsigned char *sha1, const char *base, int baselen,
 		     const char *pathname, unsigned mode, int stage,
 		     void *cbdata)
 {
 	if (S_ISDIR(mode))
 		return READ_TREE_RECURSIVE;
 
 	if (S_ISREG(mode) && !strncmp(base, match_path, baselen) &&
 	    !strcmp(pathname, match_path + baselen))
 		print_object(sha1, pathname);
 
 	return 0;
 }
 
 void cgit_print_plain(struct cgit_context *ctx)
 {
 	const char *rev = ctx->qry.sha1;
 	unsigned char sha1[20];
 	struct commit *commit;
 	const char *paths[] = {ctx->qry.path, NULL};
 
 	if (!rev)
 		rev = ctx->qry.head;
 
 	curr_rev = xstrdup(rev);
 	if (get_sha1(rev, sha1)) {
 		html_status(404, "Not found", 0);
 		return;
 	}
 	commit = lookup_commit_reference(sha1);
 	if (!commit || parse_commit(commit)) {
 		html_status(404, "Not found", 0);
 		return;
 	}
 	match_path = ctx->qry.path;
 	read_tree_recursive(commit->tree, "", 0, 0, paths, walk_tree, NULL);
 	if (!match)
 		html_status(404, "Not found", 0);
 }
diff --git a/ui-stats.c b/ui-stats.c
index bdaf9cc..50c2540 100644
--- a/ui-stats.c
+++ b/ui-stats.c
@@ -1,418 +1,418 @@
 #include <string-list.h>
 
 #include "cgit.h"
 #include "html.h"
 #include "ui-shared.h"
 #include "ui-stats.h"
 
 #define MONTHS 6
 
 struct authorstat {
 	long total;
 	struct string_list list;
 };
 
 #define DAY_SECS (60 * 60 * 24)
 #define WEEK_SECS (DAY_SECS * 7)
 
 static void trunc_week(struct tm *tm)
 {
 	time_t t = timegm(tm);
 	t -= ((tm->tm_wday + 6) % 7) * DAY_SECS;
 	gmtime_r(&t, tm);	
 }
 
 static void dec_week(struct tm *tm)
 {
 	time_t t = timegm(tm);
 	t -= WEEK_SECS;
 	gmtime_r(&t, tm);	
 }
 
 static void inc_week(struct tm *tm)
 {
 	time_t t = timegm(tm);
 	t += WEEK_SECS;
 	gmtime_r(&t, tm);	
 }
 
 static char *pretty_week(struct tm *tm)
 {
 	static char buf[10];
 
 	strftime(buf, sizeof(buf), "W%V %G", tm);
 	return buf;
 }
 
 static void trunc_month(struct tm *tm)
 {
 	tm->tm_mday = 1;
 }
 
 static void dec_month(struct tm *tm)
 {
 	tm->tm_mon--;
 	if (tm->tm_mon < 0) {
 		tm->tm_year--;
 		tm->tm_mon = 11;
 	}
 }
 
 static void inc_month(struct tm *tm)
 {
 	tm->tm_mon++;
 	if (tm->tm_mon > 11) {
 		tm->tm_year++;
 		tm->tm_mon = 0;
 	}
 }
 
 static char *pretty_month(struct tm *tm)
 {
 	static const char *months[] = {
 		"Jan", "Feb", "Mar", "Apr", "May", "Jun",
 		"Jul", "Aug", "Sep", "Oct", "Nov", "Dec"
 	};
 	return fmt("%s %d", months[tm->tm_mon], tm->tm_year + 1900);
 }
 
 static void trunc_quarter(struct tm *tm)
 {
 	trunc_month(tm);
 	while(tm->tm_mon % 3 != 0)
 		dec_month(tm);
 }
 
 static void dec_quarter(struct tm *tm)
 {
 	dec_month(tm);
 	dec_month(tm);
 	dec_month(tm);
 }
 
 static void inc_quarter(struct tm *tm)
 {
 	inc_month(tm);
 	inc_month(tm);
 	inc_month(tm);
 }
 
 static char *pretty_quarter(struct tm *tm)
 {
 	return fmt("Q%d %d", tm->tm_mon / 3 + 1, tm->tm_year + 1900);
 }
 
 static void trunc_year(struct tm *tm)
 {
 	trunc_month(tm);
 	tm->tm_mon = 0;
 }
 
 static void dec_year(struct tm *tm)
 {
 	tm->tm_year--;
 }
 
 static void inc_year(struct tm *tm)
 {
 	tm->tm_year++;
 }
 
 static char *pretty_year(struct tm *tm)
 {
 	return fmt("%d", tm->tm_year + 1900);
 }
 
 struct cgit_period periods[] = {
 	{'w', "week", 12, 4, trunc_week, dec_week, inc_week, pretty_week},
 	{'m', "month", 12, 4, trunc_month, dec_month, inc_month, pretty_month},
 	{'q', "quarter", 12, 4, trunc_quarter, dec_quarter, inc_quarter, pretty_quarter},
 	{'y', "year", 12, 4, trunc_year, dec_year, inc_year, pretty_year},
 };
 
 /* Given a period code or name, return a period index (1, 2, 3 or 4)
  * and update the period pointer to the correcsponding struct.
  * If no matching code is found, return 0.
  */
 int cgit_find_stats_period(const char *expr, struct cgit_period **period)
 {
 	int i;
 	char code = '\0';
 
 	if (!expr)
 		return 0;
 
 	if (strlen(expr) == 1)
 		code = expr[0];
 
 	for (i = 0; i < sizeof(periods) / sizeof(periods[0]); i++)
 		if (periods[i].code == code || !strcmp(periods[i].name, expr)) {
 			if (period)
 				*period = &periods[i];
 			return i+1;
 		}
 	return 0;
 }
 
 const char *cgit_find_stats_periodname(int idx)
 {
 	if (idx > 0 && idx < 4)
 		return periods[idx - 1].name;
 	else
 		return "";
 }
 
 static void add_commit(struct string_list *authors, struct commit *commit,
 	struct cgit_period *period)
 {
 	struct commitinfo *info;
 	struct string_list_item *author, *item;
 	struct authorstat *authorstat;
 	struct string_list *items;
 	char *tmp;
 	struct tm *date;
 	time_t t;
 
 	info = cgit_parse_commit(commit);
 	tmp = xstrdup(info->author);
-	author = string_list_insert(tmp, authors);
+	author = string_list_insert(authors, tmp);
 	if (!author->util)
 		author->util = xcalloc(1, sizeof(struct authorstat));
 	else
 		free(tmp);
 	authorstat = author->util;
 	items = &authorstat->list;
 	t = info->committer_date;
 	date = gmtime(&t);
 	period->trunc(date);
 	tmp = xstrdup(period->pretty(date));
-	item = string_list_insert(tmp, items);
+	item = string_list_insert(items, tmp);
 	if (item->util)
 		free(tmp);
 	item->util++;
 	authorstat->total++;
 	cgit_free_commitinfo(info);
 }
 
 static int cmp_total_commits(const void *a1, const void *a2)
 {
 	const struct string_list_item *i1 = a1;
 	const struct string_list_item *i2 = a2;
 	const struct authorstat *auth1 = i1->util;
 	const struct authorstat *auth2 = i2->util;
 
 	return auth2->total - auth1->total;
 }
 
 /* Walk the commit DAG and collect number of commits per author per
  * timeperiod into a nested string_list collection.
  */
 struct string_list collect_stats(struct cgit_context *ctx,
 	struct cgit_period *period)
 {
 	struct string_list authors;
 	struct rev_info rev;
 	struct commit *commit;
 	const char *argv[] = {NULL, ctx->qry.head, NULL, NULL, NULL, NULL};
 	int argc = 3;
 	time_t now;
 	long i;
 	struct tm *tm;
 	char tmp[11];
 
 	time(&now);
 	tm = gmtime(&now);
 	period->trunc(tm);
 	for (i = 1; i < period->count; i++)
 		period->dec(tm);
 	strftime(tmp, sizeof(tmp), "%Y-%m-%d", tm);
 	argv[2] = xstrdup(fmt("--since=%s", tmp));
 	if (ctx->qry.path) {
 		argv[3] = "--";
 		argv[4] = ctx->qry.path;
 		argc += 2;
 	}
 	init_revisions(&rev, NULL);
 	rev.abbrev = DEFAULT_ABBREV;
 	rev.commit_format = CMIT_FMT_DEFAULT;
 	rev.no_merges = 1;
 	rev.verbose_header = 1;
 	rev.show_root_diff = 0;
 	setup_revisions(argc, argv, &rev, NULL);
 	prepare_revision_walk(&rev);
 	memset(&authors, 0, sizeof(authors));
 	while ((commit = get_revision(&rev)) != NULL) {
 		add_commit(&authors, commit, period);
 		free(commit->buffer);
 		free_commit_list(commit->parents);
 	}
 	return authors;
 }
 
 void print_combined_authorrow(struct string_list *authors, int from, int to,
 	const char *name, const char *leftclass, const char *centerclass,
 	const char *rightclass, struct cgit_period *period)
 {
 	struct string_list_item *author;
 	struct authorstat *authorstat;
 	struct string_list *items;
 	struct string_list_item *date;
 	time_t now;
 	long i, j, total, subtotal;
 	struct tm *tm;
 	char *tmp;
 
 	time(&now);
 	tm = gmtime(&now);
 	period->trunc(tm);
 	for (i = 1; i < period->count; i++)
 		period->dec(tm);
 
 	total = 0;
 	htmlf("<tr><td class='%s'>%s</td>", leftclass,
 		fmt(name, to - from + 1));
 	for (j = 0; j < period->count; j++) {
 		tmp = period->pretty(tm);
 		period->inc(tm);
 		subtotal = 0;
 		for (i = from; i <= to; i++) {
 			author = &authors->items[i];
 			authorstat = author->util;
 			items = &authorstat->list;
-			date = string_list_lookup(tmp, items);
+			date = string_list_lookup(items, tmp);
 			if (date)
 				subtotal += (size_t)date->util;
 		}
 		htmlf("<td class='%s'>%d</td>", centerclass, subtotal);
 		total += subtotal;
 	}
 	htmlf("<td class='%s'>%d</td></tr>", rightclass, total);
 }
 
 void print_authors(struct string_list *authors, int top,
 		   struct cgit_period *period)
 {
 	struct string_list_item *author;
 	struct authorstat *authorstat;
 	struct string_list *items;
 	struct string_list_item *date;
 	time_t now;
 	long i, j, total;
 	struct tm *tm;
 	char *tmp;
 
 	time(&now);
 	tm = gmtime(&now);
 	period->trunc(tm);
 	for (i = 1; i < period->count; i++)
 		period->dec(tm);
 
 	html("<table class='stats'><tr><th>Author</th>");
 	for (j = 0; j < period->count; j++) {
 		tmp = period->pretty(tm);
 		htmlf("<th>%s</th>", tmp);
 		period->inc(tm);
 	}
 	html("<th>Total</th></tr>\n");
 
 	if (top <= 0 || top > authors->nr)
 		top = authors->nr;
 
 	for (i = 0; i < top; i++) {
 		author = &authors->items[i];
 		html("<tr><td class='left'>");
 		html_txt(author->string);
 		html("</td>");
 		authorstat = author->util;
 		items = &authorstat->list;
 		total = 0;
 		for (j = 0; j < period->count; j++)
 			period->dec(tm);
 		for (j = 0; j < period->count; j++) {
 			tmp = period->pretty(tm);
 			period->inc(tm);
-			date = string_list_lookup(tmp, items);
+			date = string_list_lookup(items, tmp);
 			if (!date)
 				html("<td>0</td>");
 			else {
 				htmlf("<td>%d</td>", date->util);
 				total += (size_t)date->util;
 			}
 		}
 		htmlf("<td class='sum'>%d</td></tr>", total);
 	}
 
 	if (top < authors->nr)
 		print_combined_authorrow(authors, top, authors->nr - 1,
 			"Others (%d)", "left", "", "sum", period);
 
 	print_combined_authorrow(authors, 0, authors->nr - 1, "Total",
 		"total", "sum", "sum", period);
 	html("</table>");
 }
 
 /* Create a sorted string_list with one entry per author. The util-field
  * for each author is another string_list which is used to calculate the
  * number of commits per time-interval.
  */
 void cgit_show_stats(struct cgit_context *ctx)
 {
 	struct string_list authors;
 	struct cgit_period *period;
 	int top, i;
 	const char *code = "w";
 
 	if (ctx->qry.period)
 		code = ctx->qry.period;
 
 	i = cgit_find_stats_period(code, &period);
 	if (!i) {
 		cgit_print_error(fmt("Unknown statistics type: %c", code));
 		return;
 	}
 	if (i > ctx->repo->max_stats) {
 		cgit_print_error(fmt("Statistics type disabled: %s",
 				     period->name));
 		return;
 	}
 	authors = collect_stats(ctx, period);
 	qsort(authors.items, authors.nr, sizeof(struct string_list_item),
 		cmp_total_commits);
 
 	top = ctx->qry.ofs;
 	if (!top)
 		top = 10;
 	htmlf("<h2>Commits per author per %s", period->name);
 	if (ctx->qry.path) {
 		html(" (path '");
 		html_txt(ctx->qry.path);
 		html("')");
 	}
 	html("</h2>");
 
 	html("<form method='get' action='' style='float: right; text-align: right;'>");
 	cgit_add_hidden_formfields(1, 0, "stats");
 	if (ctx->repo->max_stats > 1) {
 		html("Period: ");
 		html("<select name='period' onchange='this.form.submit();'>");
 		for (i = 0; i < ctx->repo->max_stats; i++)
 			htmlf("<option value='%c'%s>%s</option>",
 				periods[i].code,
 				period == &periods[i] ? " selected" : "",
 				periods[i].name);
 		html("</select><br/><br/>");
 	}
 	html("Authors: ");
 	html("");
 	html("<select name='ofs' onchange='this.form.submit();'>");
 	htmlf("<option value='10'%s>10</option>", top == 10 ? " selected" : "");
 	htmlf("<option value='25'%s>25</option>", top == 25 ? " selected" : "");
 	htmlf("<option value='50'%s>50</option>", top == 50 ? " selected" : "");
 	htmlf("<option value='100'%s>100</option>", top == 100 ? " selected" : "");
 	htmlf("<option value='-1'%s>All</option>", top == -1 ? " selected" : "");
 	html("</select>");
 	html("<noscript>&nbsp;&nbsp;<input type='submit' value='Reload'/></noscript>");
 	html("</form>");
 	print_authors(&authors, top, period);
 }