use untrusted settings in hgweb The only exceptions are web.static and web.templates, since they can be used to get any file that is readable by the user running the CGI script. Other options can be (ab)used to increase the use of the cpu (allow_bz2) or of the bandwidth (server.uncompressed), but they're trusted anyway.

syntax: glob

*.elc
*.orig
*.rej
*~
*.o
*.so
*.pyc
*.swp
*.prof
tests/.coverage*
tests/annotated
tests/*.err
build
contrib/hgsh/hgsh
dist
doc/*.[0-9]
doc/*.[0-9].gendoc.txt
doc/*.[0-9].{x,ht}ml
MANIFEST
patches
mercurial/__version__.py
.DS_Store

syntax: regexp
^\.pc/
Output/Mercurial-[0-9.]*.exe