From: Junio C Hamano <gitster@pobox.com>
Date: Wed, 15 Dec 2010 19:38:19 +0000 (-0800)
Subject: Git 1.7.0.9
X-Git-Tag: v1.7.0.9^0
X-Git-Url: https://git.tokkee.org/?a=commitdiff_plain;h=cb198b3b67feb2c0a6f22199ec14fa48d18ac1ce;p=git.git

Git 1.7.0.9

Signed-off-by: Junio C Hamano <gitster@pobox.com>
---

cb198b3b67feb2c0a6f22199ec14fa48d18ac1ce
diff --cc Documentation/RelNotes/1.7.0.9.txt
index 000000000,000000000..bfb316638
new file mode 100644
--- /dev/null
+++ b/Documentation/RelNotes/1.7.0.9.txt
@@@ -1,0 -1,0 +1,8 @@@
++Git v1.7.0.9 Release Notes
++==========================
++
++Fixes since v1.7.0.8
++--------------------
++
++ * "gitweb" can sometimes be tricked into parrotting a filename argument
++   given in a request without properly quoting.
diff --cc GIT-VERSION-GEN
index 4149fa9eb,7d16b0138..c07c5959b
--- a/GIT-VERSION-GEN
+++ b/GIT-VERSION-GEN
@@@ -1,7 -1,7 +1,7 @@@
  #!/bin/sh
  
  GVF=GIT-VERSION-FILE
- DEF_VER=v1.7.0.8
 -DEF_VER=v1.6.6.3
++DEF_VER=v1.7.0.9
  
  LF='
  '
diff --cc RelNotes
index 882532b04,3dad2389f..2e4322a07
--- a/RelNotes
+++ b/RelNotes
@@@ -1,1 -1,1 +1,1 @@@
- Documentation/RelNotes/1.7.0.8.txt
 -Documentation/RelNotes/1.6.6.3.txt
++Documentation/RelNotes/1.7.0.9.txt
diff --cc gitweb/gitweb.perl
index 9d4c58238,0fe853932..f1d857961
--- a/gitweb/gitweb.perl
+++ b/gitweb/gitweb.perl
@@@ -3364,9 -3334,8 +3371,9 @@@ sub git_footer_html 
  		insert_file($site_footer);
  	}
  
- 	print qq!<script type="text/javascript" src="$javascript"></script>\n!;
+ 	print qq!<script type="text/javascript" src="!.esc_url($javascript).qq!"></script>\n!;
 -	if ($action eq 'blame_incremental') {
 +	if (defined $action &&
 +	    $action eq 'blame_incremental') {
  		print qq!<script type="text/javascript">\n!.
  		      qq!startBlame("!. href(action=>"blame_data", -replay=>1) .qq!",\n!.
  		      qq!           "!. href() .qq!");\n!.