4 Commits

Include renames

Author	SHA1	Message	Date
clawbot	4d4ae61abf	Rename the settings whose names do not say what they control (closes #234) ... Applies the setting renames of the naming audit under the SWW_WAF_ and SWW_RPROXY_ prefixes, with sneak's names for the IP reputation cache time and the two time limits, which now take milliseconds. The rproxy log field default_disposition becomes waf_backend_no_answer, and config.Config and config.FromEnvironment become config.WAF and config.WAFFromEnvironment. Go fields, test names and prose follow. No aliases; nothing reads the old names. Model: opus-5-5	2026-11-12 09:48:09 +00:00
clawbot	0cb6dded98	Read every setting through viper and rename the settings (closes #211) ... Every setting of waf and rproxy is read through viper, in place of the os.LookupEnv function Main passed down. NewViper turns AutomaticEnv and AllowEmptyEnv on, so a setting that is set but empty reads as set. A setting may also be given as a file, the _FILE form, which rproxy's settings now have too; rproxy still writes nothing to disk. The settings are renamed: waf's take the prefix SWW_WAF_, rproxy's take SWW_RPROXY_, and the shared SWW_COMMAND keeps SWW_. The Core Rule Set's settings take SWW_WAF_CORE_RULE_SET_ rather than SWW_WAF_WAF_. Model: deepseek-v4-pro (first version); opus-5-5 (rework)	2026-11-12 05:43:47 +01:00
clawbot	75f30a34b2	Core Rule Set: a repository's name passes in the adopt form's id (closes #365) ... While bodies are read, the forms that adopt or delete an unadopted repository were refused when the repository's name held a command, a system file's name or a shell path, such as alice/python3-app, alice/.profile or robin/assets. id there now skips 930120, 932120, 932160 and 932260. The paths are gitea's /-/admin/repos/unadopted, Forgejo's /admin/repos/unadopted, and /user/settings/repos/unadopted, which both serve. Model: opus-5-5	2026-11-12 03:43:51 +01:00
clawbot	4ebe8be8c1	Core Rule Set: the searches of the pages gitea and Forgejo share pass (closes #352) ... Recorded with python3, powershell, ls -la, .htaccess, file names and plain words from gitea 1.27.3 and Forgejo 17.0.1. q on these searches now skips 930120, 932120, 932250 and 932260 (900603), on gitea's /-/admin/ and Forgejo's /admin/ alike, and in the body of the admin forms that adopt a repository or activate an email. The issue and pull request searches of a team and of a milestone join 900600 and 900601, as a repository's do. A repository's packages page and the admin packages page join 900602, which also skips 944130. 900605, which lets /bin/sh through in q on branches and owner packages, now also covers the tags page and those two pages, since tag and package names can hold a slash. Model: opus-5-5 Co-authored-by: clawbot <sneak+clawbot@sneak.cloud>	2026-11-12 03:00:15 +01:00