4 Commits

Include renames

Author	SHA1	Message	Date
clawbot	4af778747f	Core Rule Set: the searches of the pages gitea and Forgejo share pass (closes #352) ... Recorded with python3, powershell, ls -la, .htaccess, file names and plain words from gitea 1.27.3 and Forgejo 17.0.1. q on these searches now skips 930120, 932120, 932250 and 932260 (900603), on gitea's /-/admin/ and Forgejo's /admin/ alike, and in the body of the admin forms that adopt a repository or activate an email. 900605, which lets /bin/sh through in q on branches and owner packages, now also covers the tags page, a repository's packages page and the admin packages page, since tag and package names can hold a slash. Model: opus-5-5	2026-11-11 14:53:44 +00:00
clawbot	f9bec5146b	Core Rule Set: Forgejo's searches at a branch or tag, of releases and of job logs pass (closes #350) ... `testdata/forgejo-requests.txt` records these Forgejo 17.0.1 searches with the hard values, file names and plain words, and the code search with code and a page opened from each search. `forgejo.conf` lets them through: - the code search at a branch or tag, where the home page's search box sends its search without a code indexer: `q` skips what it skips on gitea's code search, and `Referer` what it skips after gitea's searches; - the release search, page and API: `q` skips 930120, 932120, 932160, 932250 and 932260, since it matches tag names; - the job log search in the API: the same, without 932160. In `gitea.conf`, `q` on a repository's branches page and an owner's packages page also skips 932160, so `/bin/sh` passes there. `SPEC.md` lists both. Model: opus-5-5	2026-11-11 15:44:31 +01:00
clawbot	883969a9cd	Core Rule Set: ls -la passes in q on a gitea user's or organisation's page (closes #349) ... On a path of one segment made of the characters a user's or an organisation's name may hold, q now skips 932250 too, unless the path ends in a server-side script's extension, such as .php or .cgi. The searches on a user's and an organisation's page are recorded from gitea 1.27.3 and Forgejo 17.0.1. Model: opus-5-5	2026-11-11 14:13:33 +01:00
clawbot	b6aa2cbc4b	Core Rule Set: Forgejo's ordinary requests pass by default (closes #342) ... Forgejo 17.0.1's ordinary traffic, recorded in `testdata/forgejo-requests.txt` (pages signed in and out, admin pages, the API with a token, git clone and push, the generic and container registries, uploads), passes at the default settings. What Forgejo sends and gitea does not: its flash cookie `flash` joins the cookies left out, and in the new `forgejo.conf` `q` on its wiki search skips five rules. In `gitea.conf`, the API's package search joins the name searches, and `q` there also skips 932250, except on user and organisation pages. `README.md` lists Forgejo; `SPEC.md` lists the changes. - Still refused, each tracked: `ls -la` on user and organisation pages; file and branch names in bodies while bodies are read; Forgejo's searches at a branch or tag, of releases and of job logs; other search fields not yet recorded. Model: opus-5-5	2026-11-11 12:12:50 +01:00