--- cvsweb-3.0.1.new/cvsweb.cgi	2004-08-19 14:06:58.000000000 +0200
+++ cvsweb-3.0.6/cvsweb.cgi	2007-10-06 15:27:43.849021395 +0300
@@ -214,7 +214,8 @@
 
 # == EDIT this ==
 # Locations to search for user configuration, in order:
-for (catfile($mydir, 'cvsweb.conf'), '/usr/local/etc/cvsweb/cvsweb.conf') {
+my ($CVSWEB_CONFIG) = $1 if $ENV{CVSWEB_CONFIG} =~ /(.*)/; # untaint
+for ($CVSWEB_CONFIG, catfile($mydir, 'cvsweb.conf'), '/etc/webapps/cvsweb/cvsweb.conf') {
   if (-r $_) {
     $config = $_;
     last;
--- cvsweb-3.0.1/cvsweb.conf	2004-05-05 01:40:50.000000000 +0200
+++ cvsweb-3.0.1.new/cvsweb.conf	2004-08-19 14:08:34.000000000 +0200
@@ -19,7 +19,7 @@
 #   cvsgraph (if you enable $allow_graph)
 #   enscript (if you enable $allow_enscript)
 #
-@command_path = qw(/bin /usr/bin /usr/local/bin);
+@command_path = qw(/bin /usr/bin);
 
 # Search the above directories for each command (prefer gtar over tar).
 #
@@ -47,7 +47,7 @@
 # 'symbolic_name' => ['Name to display',  '/path/to/cvsroot']
 #
 @CVSrepositories = (
-        'local'   => ['Local Repository', '/var/cvs'],
+        'local'   => ['Local Repository', '/home/services/cvsroot'],
 #       'freebsd' => ['FreeBSD',          '/var/ncvs'],
 #       'openbsd' => ['OpenBSD',          '/var/ncvs'],
 #       'netbsd'  => ['NetBSD',           '/var/ncvs'],
@@ -62,7 +62,7 @@
 # For example:
 #
 #$cvstreedefault = $CVSrepositories[2 * 0];
-#$cvstreedefault = 'local';
+$cvstreedefault = 'local';
 
 # Bug tracking system linking options ("PR" means Problem Report, as in GNATS)
 #
@@ -86,7 +86,7 @@
 # Manual gateway linking.
 #
 $mancgi =
-    "http://www.FreeBSD.org/cgi/man.cgi?apropos=0&sektion=%s&query=%s&manpath=FreeBSD+5.0-current&format=html";
+    "http://linux.die.net/man/%s/%s";
 
 # Defaults for user options.
 #
@@ -202,7 +202,7 @@
 # check out the "mini" versions in the icons/ directory; they have a
 # width/height of 16/16.
 #
-my $iconsdir = '/icons';
+my $iconsdir = '/cvsweb/icons';
 
 # format:          TEXT       ICON-URL                  width height
 %ICONS = (
@@ -216,7 +216,7 @@
 
 # An URL where to find the CSS.
 #
-$cssurl = '/css/cvsweb.css';
+$cssurl = '/cvsweb/css/cvsweb.css';
 
 # The length to which the last log entry should be truncated when shown
 # in the directory view.
@@ -344,7 +344,7 @@
 # The traditional mime.types file, eg. the one from Apache is fine.
 # See above where this gets used.
 #
-$mime_types = '/usr/local/etc/apache/mime.types';
+$mime_types = '/etc/mime.types';
 
 # Charset appended to the Content-Type HTTP header for text/* MIME types.
 # Note that the web server may default to some charset which may take effect
@@ -470,7 +470,7 @@
 # settings in the configuration file with command line options, see
 # doGraph() and doGraphView() in cvsweb.cgi for details.
 #
-#$cvsgraph_config = "/etc/cvsgraph.conf";
+#$cvsgraph_config = "/etc/cvsgraph/cvsgraph.conf";
 
 # URL to the CVSHistory script.  This should be absolute (but does not need
 # to include the host and port if the script is on the same server as
@@ -610,6 +600,7 @@
    'nroff'        => qr/\.man$/o,
    'pascal'       => qr/\.p(as|p)?$/io,
    'perl'         => qr/\.p(m|(er)?l)$/io,
+   'php'          => qr/\.php$/io,
    'postscript'   => qr/\.e?ps$/io,
    'python'       => qr/\.py$/o,
    'rfc'          => qr/\b((rfc|draft)\..*\.txt)$/o,