Fossil

  }
  zScript = xfer_push_code();
  if( zScript ){ /* NOTE: Are TH1 transfer hooks enabled? */
    pzUuidList = &zUuidList;
    pnUuidList = &nUuidList;
  }
  if( g.syncInfo.zLoginCard ){
    /* Login card received via HTTP header "X-Fossil-Xfer-Login" or
    ** "x-f-x-l" URL parameter. */
    assert( g.syncInfo.bLoginCardHeader && "Set via HTTP header/URL arg" );
    blob_zero(&xfer.line);
    blob_append(&xfer.line, g.syncInfo.zLoginCard, -1);
    xfer.nToken = blob_tokenize(&xfer.line, xfer.aToken,
                                count(xfer.aToken));
    fossil_free( g.syncInfo.zLoginCard );
    g.syncInfo.zLoginCard = 0;
    if( xfer.nToken==4

       so that it works with other query parameters like p=, d=, from=, and to=.
  <li> Always include nodes identify by sel1= and sel2= in the /timeline display.
  <li> Enable the --editor option on the [/help?cmd=amend|fossil amend] command.
  <li> Require at least an anonymous login to access the /blame page and similar,
       to help prevent robots from soaking up excess CPU time on such pages.
  <li> When walking the filesystem looking for Fossil repositories, avoid descending
       into directories named "/proc".
  <ll> Reduce memory requirements for sending authenticated sync protocol
       messages.
  </ol>

<h2 id='v2_26'>Changes for version 2.26 (2025-04-30)</h2><ol>
 <li>Enhancements to [/help?cmd=diff|fossil diff] and similar:
     <ol type="a">
     <li> The argument to the --from option can be a directory name, causing
          Fossil to use files under that directory as the baseline for the diff.

<h3 id="login">3.2 Login Cards</h3>

Every message from client to server begins with one or more login
cards.  Each login card has the following format:

<pre><b>login</b>  <i>userid  nonce  signature</i></pre>

The userid is the name of the user that is requesting service from the
server, encoded in "fossilized" form (exactly as described for <a
href="#error">the error card</a>).  The nonce is the SHA1 hash of the
remainder of the message - all text that follows the newline character
that terminates the login card.  The signature is the SHA1 hash of the
concatenation of the nonce and the users password.

When receving a login card, the server looks up the user and verifies
that the nonce matches the SHA1 hash of the remainder of the message.
It then checks the signature hash to make sure the signature matches.
If everything checks out, then the client is granted all privileges of
the specified user.

Only one login card is permitted. A second login card will trigger
a sync error. (Prior to 2025-07-21, the protocol permitted multiple
logins, treating the login as the union of all privileges from all
login cards. That capability was never used and has been removed.)

As of version 2.27, Fossil supports transfering of the login card
outside of the payload body, in one of the following ways:

<ul>
<li> URL parameter named "x-f-x-l". The value must be URL-encoded.
<li> An HTTP header named "X-Fossil-Xfer-Login". The caveat for the
     header is that CGI-hosted fossils cannot see the headers. It
     works for standalone severs and those running via fossil's
     "test-http" mechanism. This approach is retained, despite the CGI
     disadvantage, because the URL parameter approach cannot be used
     to capture sync payload bodies for re-use with the "test-http"
     mechanism, a capability useful in testing.
</ul>


<h3 id="file">3.3 File Cards</h3>

Artifacts are transferred using either "file" cards, or "cfile"
or "uvfile" cards.
The name "file" card comes from the fact that most artifacts correspond to
files that are under version control.