- struct tag *tag;
- struct taginfo *info;
- char *url, *name = (char *)ref->refname;
-
- if (ref->object->type == OBJ_TAG) {
- tag = (struct tag *)ref->object;
- info = ref->tag;
- if (!tag || !info)
- return 1;
- html("<tr><td>");
- url = cgit_pageurl(ctx.qry.repo, "tag",
- fmt("id=%s", name));
- html_link_open(url, NULL, NULL);
- html_txt(name);
- html_link_close();
- html("</td><td>");
- if (info->tagger_date > 0)
- cgit_print_age(info->tagger_date, -1, NULL);
- html("</td><td>");
- if (info->tagger)
- html(info->tagger);
- html("</td><td>");
- cgit_object_link(tag->tagged);
- html("</td></tr>\n");
- } else {
- if (!header)
- print_tag_header();
- html("<tr><td>");
- html_txt(name);
- html("</td><td colspan='2'/><td>");
- cgit_object_link(ref->object);
- html("</td></tr>\n");
+ char *file, *base_dir, *full_path, *resolved_base = NULL, *resolved_full = NULL;
+ /* If a subpath is specified for the about page, make it relative
+ * to the directory containing the configured readme. */
+
+ file = xstrdup(filename);
+ base_dir = dirname(file);
+ if (!strcmp(base_dir, ".") || !strcmp(base_dir, "..")) {
+ if (!ref) {
+ free(file);
+ return NULL;
+ }
+ full_path = xstrdup(path);
+ } else
+ full_path = fmtalloc("%s/%s", base_dir, path);
+
+ if (!ref) {
+ resolved_base = realpath(base_dir, NULL);
+ resolved_full = realpath(full_path, NULL);
+ if (!resolved_base || !resolved_full || !starts_with(resolved_full, resolved_base)) {
+ free(full_path);
+ full_path = NULL;
+ }