Fossil

Check-in [3fec387cc3]
Login
☰Home Timeline Docs Forum Download

Many hyperlinks are disabled.
Use anonymous login to enable hyperlinks.

Overview
Comment:Fix various documentation typos.
Downloads: Tarball | ZIP archive
Timelines: family | ancestors | descendants | both | trunk
Files: files | file ages | folders
SHA3-256: 3fec387cc3a0fff810321673f6e1f5a06718e36af95bba1ea8ba38c31a4e01d2
User & Date: drh 2021-06-26 18:08:12.877
Context
2021-06-29
05:05
Fixed a && which was supposed to be a & in the new patch code. Caught by gcc. ... (check-in: 1fd6961005 user: stephan tags: trunk)
2021-06-26
18:08
Fix various documentation typos. ... (check-in: 3fec387cc3 user: drh tags: trunk)
2021-06-25
17:12
Fix a busted hyperlink in the change-log. ... (check-in: cd80b9f70f user: drh tags: trunk)
Changes
Unified Diff Ignore Whitespace Patch
Changes to www/changes.wiki.
︙︙
30
31
32
33
34
35
36

37
38
39
40
41
42
43

     The [/help?cmd=tag|tag command] can now manipulate and list such tags.
  *  [./caps/login-groups.md|Login-Groups] are now show on the repository
     list of the "[/help?cmd=all|fossil all ui]" command.
  *  Administrators can configure [./alerts.md|email alerts] to expire
     a specific number of days (ex: 365) after the last user contact with
     the Fossil server. This prevents alert emails being sent to
     abandoned email accounts forever.


<a name='v2_15'></a>
<h2>Changes for Version 2.15 (2021-03-26) and Patch 2.15.1 on (2021-04-07)
    and 2.15.2 on (2021-06-15)</h2>
  *  <b>Patch 2.15.2:</b> Fix the client-side TLS so that it verifies that the
     server hostname matches its certificate. <b>Upgrading to
     the patch is recommended.</b>








>








30
31
32
33
34
35
36
37
38
39
40
41
42
43
44

     The [/help?cmd=tag|tag command] can now manipulate and list such tags.
  *  [./caps/login-groups.md|Login-Groups] are now show on the repository
     list of the "[/help?cmd=all|fossil all ui]" command.
  *  Administrators can configure [./alerts.md|email alerts] to expire
     a specific number of days (ex: 365) after the last user contact with
     the Fossil server. This prevents alert emails being sent to
     abandoned email accounts forever.
  *  Update the built-in SQLite to version 3.36.0.

<a name='v2_15'></a>
<h2>Changes for Version 2.15 (2021-03-26) and Patch 2.15.1 on (2021-04-07)
    and 2.15.2 on (2021-06-15)</h2>
  *  <b>Patch 2.15.2:</b> Fix the client-side TLS so that it verifies that the
     server hostname matches its certificate. <b>Upgrading to
     the patch is recommended.</b>
︙︙
Changes to www/customskin.md.
︙︙
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250

<p>Both the footer.txt and header.txt file are 
[processed using TH1](#headfoot) prior to being output as 
part of the overall web page.</dd>

<dt><b>js.txt</b></dt><dd>

<p>The js.txt file is optional.  It is intended to be javascript.
The complete text of this javascript is might be inserted into
the Content Footer, after being processed using TH1, using
code like the following in the "footer.txt" file:

<blockquote><pre>
&lt;script nonce="$nonce"&gt;
  &lt;th1&gt;styleScript&lt;/th1&gt;
&lt;/script&gt;








|








236
237
238
239
240
241
242
243
244
245
246
247
248
249
250

<p>Both the footer.txt and header.txt file are 
[processed using TH1](#headfoot) prior to being output as 
part of the overall web page.</dd>

<dt><b>js.txt</b></dt><dd>

<p>The js.txt file is optional.  It is intended to be javascript.
The complete text of this javascript might be inserted into
the Content Footer, after being processed using TH1, using
code like the following in the "footer.txt" file:

<blockquote><pre>
&lt;script nonce="$nonce"&gt;
  &lt;th1&gt;styleScript&lt;/th1&gt;
&lt;/script&gt;
︙︙
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366


## <a name="menu"></a>Customizing the ≡ Hamburger Menu

The menu bar of the default skin has an entry to open a drop-down menu with
additional navigation links, represented by the ≡ button (hence the name
"hamburger menu"). The Javascript logic to open and close the hamburger menu
when the button is clicked is usually handled by a script named
"hbmenu.js" that is one of the [built-in resource files](/test-builtin-list)
that are part of Fossil.

The ≡ button for the hamburger menu is added to the menu bar by the following
TH1 commands in the `header.txt` file, right before the menu bar links:

        html "<a id='hbbtn' href='$home/sitemap'>&#9776;</a>"
        builtin_request_js hbmenu.js








|








352
353
354
355
356
357
358
359
360
361
362
363
364
365
366


## <a name="menu"></a>Customizing the ≡ Hamburger Menu

The menu bar of the default skin has an entry to open a drop-down menu with
additional navigation links, represented by the ≡ button (hence the name
"hamburger menu"). The Javascript logic to open and close the hamburger menu
when the button is clicked is usually handled by a script named
"hbmenu.js" that is one of the [built-in resource files](/test-builtin-files)
that are part of Fossil.

The ≡ button for the hamburger menu is added to the menu bar by the following
TH1 commands in the `header.txt` file, right before the menu bar links:

        html "<a id='hbbtn' href='$home/sitemap'>&#9776;</a>"
        builtin_request_js hbmenu.js
︙︙
Changes to www/defcsp.md. 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21

# The Default Content Security Policy (CSP)

When Fossil’s web interface generates an HTML page, it normally includes
a [Content Security Policy][csp] (CSP) in the `<head>`.  The CSP specifies
allowed sources for external resources such as images,
CSS, javascript, and so froth.
The purpose of CSP is to provide an extra layer of protection against
[cross-site scripting][xss] (XSS) and code injection
attacks.  Compatible web browsers will not use external resources unless
they are specifically allowed by the CSP, which dramatically reduces
the attack surface of the application.

Fossil does not rely on CSP for security.
A Fossil server should be secure from attack even with out CSP.
Fossil includes built-in server-side content filtering logic.
For example, Fossil purposely breaks `<script>` tags when it finds
them in Markdown and Fossil Wiki documents.  And the Fossil build
process scans the source code for potential injection vulnerabilities
and refuses to compile if any problems are found.
However, CSP provides an additional layer of defense against undetected
bugs that might lead to a vulnerability.






|







|








1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21

# The Default Content Security Policy (CSP)

When Fossil’s web interface generates an HTML page, it normally includes
a [Content Security Policy][csp] (CSP) in the `<head>`.  The CSP specifies
allowed sources for external resources such as images,
CSS, javascript, and so forth.
The purpose of CSP is to provide an extra layer of protection against
[cross-site scripting][xss] (XSS) and code injection
attacks.  Compatible web browsers will not use external resources unless
they are specifically allowed by the CSP, which dramatically reduces
the attack surface of the application.

Fossil does not rely on CSP for security.
A Fossil server should be secure from attack even without CSP.
Fossil includes built-in server-side content filtering logic.
For example, Fossil purposely breaks `<script>` tags when it finds
them in Markdown and Fossil Wiki documents.  And the Fossil build
process scans the source code for potential injection vulnerabilities
and refuses to compile if any problems are found.
However, CSP provides an additional layer of defense against undetected
bugs that might lead to a vulnerability.
︙︙
Changes to www/index.wiki.
︙︙
22
23
24
25
26
27
28
29

30
31
32
33
34
35
36

<p>Fossil is a simple, high-reliability, distributed software configuration
management system with these advanced features:

  1.  <b>Project Management</b> -
      In addition to doing [./concepts.wiki | distributed version control]
      like Git and Mercurial,
      Fossil also supports [./bugtheory.wiki | bug tracking],
      [./wikitheory.wiki | wiki], [./forum.wiki | forum], [./chat.md | chat], and

      [./event.wiki | technotes].

  2.  <b>Built-in Web Interface</b> -
      Fossil has a built-in, [/skins | themeable], [./serverext.wiki | extensible],
      and intuitive [./webui.wiki | web interface]
      with a rich variety of information pages
      ([./webpage-ex.md|examples]) promoting situational awareness.








|
>








22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37

<p>Fossil is a simple, high-reliability, distributed software configuration
management system with these advanced features:

  1.  <b>Project Management</b> -
      In addition to doing [./concepts.wiki | distributed version control]
      like Git and Mercurial,
      Fossil also supports [./bugtheory.wiki | bug tracking],
      [./wikitheory.wiki | wiki], [./forum.wiki | forum],
      [./alerts.md|email alerts], [./chat.md | chat], and
      [./event.wiki | technotes].

  2.  <b>Built-in Web Interface</b> -
      Fossil has a built-in, [/skins | themeable], [./serverext.wiki | extensible],
      and intuitive [./webui.wiki | web interface]
      with a rich variety of information pages
      ([./webpage-ex.md|examples]) promoting situational awareness.
︙︙
93
94
95
96
97
98
99
100
101
102
103
104
105
106

  *  [/timeline?t=release|Timeline of all past releases]

<hr>
<h3>Quick Start</h3>

  1.  [/uv/download.html|Download] or install using a package manager or
      [./build.wiki|compile from sources].
  2.  <tt>fossil init</tt> <i>REPOSTORE-DIR/new-repository</i>
  3.  <tt>fossil open</tt> <i>REPOSTORE-DIR/new-repository</i>
  4.  <tt>fossil add</tt> <i>files-or-directories</i>
  5.  <tt>fossil commit -m</tt> "<i>commit message</i>"
  6.  <tt>fossil ui</tt>
  7.  Repeat steps 4, 5, and 6, in any order, as necessary.
      See the [./quickstart.wiki|Quick Start Guide] for more detail.








|
|






94
95
96
97
98
99
100
101
102
103
104
105
106
107

  *  [/timeline?t=release|Timeline of all past releases]

<hr>
<h3>Quick Start</h3>

  1.  [/uv/download.html|Download] or install using a package manager or
      [./build.wiki|compile from sources].
  2.  <tt>fossil init</tt> <i>REPOSITORY-DIR/new-repository</i>
  3.  <tt>fossil open</tt> <i>REPOSITORY-DIR/new-repository</i>
  4.  <tt>fossil add</tt> <i>files-or-directories</i>
  5.  <tt>fossil commit -m</tt> "<i>commit message</i>"
  6.  <tt>fossil ui</tt>
  7.  Repeat steps 4, 5, and 6, in any order, as necessary.
      See the [./quickstart.wiki|Quick Start Guide] for more detail.
Changes to www/th1.md.
︙︙
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122

terminal width while telling the interpreter to consider those three
lines as a single command.


Summary of Core TH1 Commands
----------------------------

The original Tcl language after when TH1 is modeled has a very rich
repertoire of commands.  TH1, as it is designed to be minimalist and
embedded has a greatly reduced command set.  The following bullets
summarize the commands available in TH1:

  *  array exists VARNAME
  *  array names VARNAME
  *  break








|








108
109
110
111
112
113
114
115
116
117
118
119
120
121
122

terminal width while telling the interpreter to consider those three
lines as a single command.


Summary of Core TH1 Commands
----------------------------

The original Tcl language (after which TH1 is modeled) has a very rich
repertoire of commands.  TH1, as it is designed to be minimalist and
embedded has a greatly reduced command set.  The following bullets
summarize the commands available in TH1:

  *  array exists VARNAME
  *  array names VARNAME
  *  break
︙︙
282
283
284
285
286
287
288

289
290
291
292
293
294
295
296

-----------------------------------------------------

Added in Fossil 2.15.

  *  capexpr CAPABILITY-EXPR

The capability expression is a list. Each term of the list is a

cluster of capability letters. The overall expression is true if any
one term is true. A single term is true if all letters within that
term are true. Or, if the term begins with "!", then the term is true
if none of the terms or true. Or, if the term begins with "@" then
the term is true if all of the capability letters in that term are
available to the "anonymous" user. Or, if the term is "*" then it is
always true.









>
|








282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297

-----------------------------------------------------

Added in Fossil 2.15.

  *  capexpr CAPABILITY-EXPR

The capability expression is a list. Each term of the list is a
cluster of [capability letters](./caps/ref.html). 
The overall expression is true if any
one term is true. A single term is true if all letters within that
term are true. Or, if the term begins with "!", then the term is true
if none of the terms or true. Or, if the term begins with "@" then
the term is true if all of the capability letters in that term are
available to the "anonymous" user. Or, if the term is "*" then it is
always true.
︙︙
This page was generated in about 0.028s by Fossil 2.26 [1205ec86cb] 2025-04-30 16:57:32