From 353347b0b811fcdb7c7064a85d1729433c0b8d51 Mon Sep 17 00:00:00 2001 From: Kay Sievers Date: Mon, 14 Nov 2005 05:47:18 +0100 Subject: [PATCH] escape '+' and ' ' in url's --- gitweb.cgi | 390 +++++++++++++++++++++++++++-------------------------- 1 file changed, 199 insertions(+), 191 deletions(-) diff --git a/gitweb.cgi b/gitweb.cgi index 615af99e2..c477bf1ba 100755 --- a/gitweb.cgi +++ b/gitweb.cgi @@ -78,7 +78,8 @@ if (defined $project) { undef $project; die_error(undef, "No such project."); } - $rss_link = ""; + $rss_link = ""; $ENV{'GIT_DIR'} = "$projectroot/$project"; } else { git_project_list(); @@ -206,6 +207,13 @@ if (!defined $action || $action eq "summary") { exit; } +sub esc { + my $str = shift; + $str =~ s/ /\+/g; + $str =~ s/\+/%2b/g; + return $str; +} + sub git_header_html { my $status = shift || "200 OK"; my $expires = shift; @@ -286,11 +294,11 @@ a.rss_logo:hover { background-color:#ee5500; } EOF print "
\n" . "" . - "\"git\"" . + "\"git\"" . "\n"; - print $cgi->a({-href => $home_link}, "projects") . " / "; + print $cgi->a({-href => esc($home_link)}, "projects") . " / "; if (defined $project) { - print $cgi->a({-href => "$my_uri?p=$project;a=summary"}, escapeHTML($project)); + print $cgi->a({-href => esc("$my_uri?p=$project;a=summary")}, escapeHTML($project)); if (defined $action) { print " / $action"; } @@ -306,7 +314,7 @@ EOF } $cgi->param("a", "search"); $cgi->param("h", $search_hash); - print $cgi->startform(-method => "get", -action => "$my_uri") . + print $cgi->startform(-method => "get", -action => $my_uri) . "
\n" . $cgi->hidden(-name => "p") . "\n" . $cgi->hidden(-name => "a") . "\n" . @@ -325,9 +333,9 @@ sub git_footer_html { if (defined $descr) { print "
" . escapeHTML($descr) . "
\n"; } - print $cgi->a({-href => "$my_uri?p=$project;a=rss", -class => "rss_logo"}, "RSS") . "\n"; + print $cgi->a({-href => esc("$my_uri?p=$project;a=rss"), -class => "rss_logo"}, "RSS") . "\n"; } else { - print $cgi->a({-href => "$my_uri?a=opml", -class => "rss_logo"}, "OPML") . "\n"; + print $cgi->a({-href => esc("$my_uri?a=opml"), -class => "rss_logo"}, "OPML") . "\n"; } print "
\n" . "\n" . @@ -668,7 +676,7 @@ sub format_log_line_html { if ($line =~ m/([0-9a-fA-F]{40})/) { my $hash_text = $1; if (git_get_type($hash_text) eq "commit") { - my $link = $cgi->a({-class => "text", -href => "$my_uri?p=$project;a=commit;h=$hash_text"}, $hash_text); + my $link = $cgi->a({-class => "text", -href => esc("$my_uri?p=$project;a=commit;h=$hash_text")}, $hash_text); $line =~ s/$hash_text/$link/; } } @@ -816,25 +824,25 @@ sub git_project_list { @projects = sort {$a->{'path'} cmp $b->{'path'}} @projects; print "Project\n"; } else { - print "" . $cgi->a({-class => "header", -href => "$my_uri?o=project"}, "Project") . "\n"; + print "" . $cgi->a({-class => "header", -href => esc("$my_uri?o=project")}, "Project") . "\n"; } if (defined($order) && ($order eq "descr")) { @projects = sort {$a->{'descr'} cmp $b->{'descr'}} @projects; print "Description\n"; } else { - print "" . $cgi->a({-class => "header", -href => "$my_uri?o=descr"}, "Description") . "\n"; + print "" . $cgi->a({-class => "header", -href => esc("$my_uri?o=descr")}, "Description") . "\n"; } if (defined($order) && ($order eq "owner")) { @projects = sort {$a->{'owner'} cmp $b->{'owner'}} @projects; print "Owner\n"; } else { - print "" . $cgi->a({-class => "header", -href => "$my_uri?o=owner"}, "Owner") . "\n"; + print "" . $cgi->a({-class => "header", -href => esc("$my_uri?o=owner")}, "Owner") . "\n"; } if (defined($order) && ($order eq "age")) { @projects = sort {$a->{'commit'}{'age'} <=> $b->{'commit'}{'age'}} @projects; print "Last Change\n"; } else { - print "" . $cgi->a({-class => "header", -href => "$my_uri?o=age"}, "Last Change") . "\n"; + print "" . $cgi->a({-class => "header", -href => esc("$my_uri?o=age")}, "Last Change") . "\n"; } print "\n" . "\n"; @@ -846,7 +854,7 @@ sub git_project_list { print "\n"; } $alternate ^= 1; - print "" . $cgi->a({-href => "$my_uri?p=$pr->{'path'};a=summary", -class => "list"}, escapeHTML($pr->{'path'})) . "\n" . + print "" . $cgi->a({-href => esc("$my_uri?p=$pr->{'path'};a=summary"), -class => "list"}, escapeHTML($pr->{'path'})) . "\n" . "$pr->{'descr'}\n" . "" . chop_str($pr->{'owner'}, 15) . "\n"; my $colored_age; @@ -859,9 +867,9 @@ sub git_project_list { } print "$colored_age\n" . "" . - $cgi->a({-href => "$my_uri?p=$pr->{'path'};a=summary"}, "summary") . - " | " . $cgi->a({-href => "$my_uri?p=$pr->{'path'};a=shortlog"}, "shortlog") . - " | " . $cgi->a({-href => "$my_uri?p=$pr->{'path'};a=log"}, "log") . + $cgi->a({-href => esc("$my_uri?p=$pr->{'path'};a=summary")}, "summary") . + " | " . $cgi->a({-href => esc("$my_uri?p=$pr->{'path'};a=shortlog")}, "shortlog") . + " | " . $cgi->a({-href => esc("$my_uri?p=$pr->{'path'};a=log")}, "log") . "\n" . "\n"; } @@ -960,11 +968,11 @@ sub git_summary { git_header_html(); print "
\n" . "summary". - " | " . $cgi->a({-href => "$my_uri?p=$project;a=shortlog"}, "shortlog") . - " | " . $cgi->a({-href => "$my_uri?p=$project;a=log"}, "log") . - " | " . $cgi->a({-href => "$my_uri?p=$project;a=commit;h=$head"}, "commit") . - " | " . $cgi->a({-href => "$my_uri?p=$project;a=commitdiff;h=$head"}, "commitdiff") . - " | " . $cgi->a({-href => "$my_uri?p=$project;a=tree"}, "tree") . + " | " . $cgi->a({-href => esc("$my_uri?p=$project;a=shortlog")}, "shortlog") . + " | " . $cgi->a({-href => esc("$my_uri?p=$project;a=log")}, "log") . + " | " . $cgi->a({-href => esc("$my_uri?p=$project;a=commit;h=$head")}, "commit") . + " | " . $cgi->a({-href => esc("$my_uri?p=$project;a=commitdiff;h=$head")}, "commitdiff") . + " | " . $cgi->a({-href => esc("$my_uri?p=$project;a=tree")}, "tree") . "

\n" . "
\n"; print "
 
\n"; @@ -977,7 +985,7 @@ sub git_summary { my (@revlist) = map { chomp; $_ } <$fd>; close $fd; print "
\n" . - $cgi->a({-href => "$my_uri?p=$project;a=shortlog", -class => "title"}, "shortlog") . + $cgi->a({-href => esc("$my_uri?p=$project;a=shortlog"), -class => "title"}, "shortlog") . "
\n"; my $i = 16; print "\n"; @@ -996,20 +1004,20 @@ sub git_summary { "\n" . "\n" . "\n" . ""; } else { - print "\n" . + print "\n" . ""; last; } @@ -1019,7 +1027,7 @@ sub git_summary { my $taglist = git_read_refs("refs/tags"); if (defined @$taglist) { print "
\n" . - $cgi->a({-href => "$my_uri?p=$project;a=tags", -class => "title"}, "tags") . + $cgi->a({-href => esc("$my_uri?p=$project;a=tags"), -class => "title"}, "tags") . "
\n"; my $i = 16; print "
" . escapeHTML(chop_str($co{'author_name'}, 10)) . ""; if (length($co{'title_short'}) < length($co{'title'})) { - print $cgi->a({-href => "$my_uri?p=$project;a=commit;h=$commit", -class => "list", -title => "$co{'title'}"}, + print $cgi->a({-href => esc("$my_uri?p=$project;a=commit;h=$commit"), -class => "list", -title => "$co{'title'}"}, "" . escapeHTML($co{'title_short'}) . ""); } else { - print $cgi->a({-href => "$my_uri?p=$project;a=commit;h=$commit", -class => "list"}, + print $cgi->a({-href => esc("$my_uri?p=$project;a=commit;h=$commit"), -class => "list"}, "" . escapeHTML($co{'title'}) . ""); } print "" . - $cgi->a({-href => "$my_uri?p=$project;a=commit;h=$commit"}, "commit") . - " | " . $cgi->a({-href => "$my_uri?p=$project;a=commitdiff;h=$commit"}, "commitdiff") . + $cgi->a({-href => esc("$my_uri?p=$project;a=commit;h=$commit")}, "commit") . + " | " . $cgi->a({-href => esc("$my_uri?p=$project;a=commitdiff;h=$commit")}, "commitdiff") . "
" . $cgi->a({-href => "$my_uri?p=$project;a=shortlog"}, "...") . "" . $cgi->a({-href => esc("$my_uri?p=$project;a=shortlog")}, "...") . "
\n"; @@ -1040,27 +1048,27 @@ sub git_summary { if ($i-- > 0) { print "\n" . "\n" . "\n" . "\n" . ""; } else { - print "\n" . + print "\n" . ""; last; } @@ -1071,7 +1079,7 @@ sub git_summary { my $headlist = git_read_refs("refs/heads"); if (defined @$headlist) { print "
\n" . - $cgi->a({-href => "$my_uri?p=$project;a=heads", -class => "title"}, "heads") . + $cgi->a({-href => esc("$my_uri?p=$project;a=heads"), -class => "title"}, "heads") . "
\n"; my $i = 16; print "
$tag{'age'}" . - $cgi->a({-href => "$my_uri?p=$project;a=$tag{'reftype'};h=$tag{'refid'}", -class => "list"}, + $cgi->a({-href => esc("$my_uri?p=$project;a=$tag{'reftype'};h=$tag{'refid'}"), -class => "list"}, "" . escapeHTML($tag{'name'}) . "") . ""; if (defined($comment)) { - print $cgi->a({-class => "list", -href => "$my_uri?p=$project;a=tag;h=$tag{'id'}"}, $comment); + print $cgi->a({-class => "list", -href => esc("$my_uri?p=$project;a=tag;h=$tag{'id'}")}, $comment); } print ""; if ($tag{'type'} eq "tag") { - print $cgi->a({-href => "$my_uri?p=$project;a=tag;h=$tag{'id'}"}, "tag") . " | "; + print $cgi->a({-href => esc("$my_uri?p=$project;a=tag;h=$tag{'id'}")}, "tag") . " | "; } - print $cgi->a({-href => "$my_uri?p=$project;a=$tag{'reftype'};h=$tag{'refid'}"}, $tag{'reftype'}); + print $cgi->a({-href => esc("$my_uri?p=$project;a=$tag{'reftype'};h=$tag{'refid'}")}, $tag{'reftype'}); if ($tag{'reftype'} eq "commit") { - print " | " . $cgi->a({-href => "$my_uri?p=$project;a=shortlog;h=$tag{'name'}"}, "shortlog") . - " | " . $cgi->a({-href => "$my_uri?p=$project;a=log;h=$tag{'refid'}"}, "log"); + print " | " . $cgi->a({-href => esc("$my_uri?p=$project;a=shortlog;h=$tag{'name'}")}, "shortlog") . + " | " . $cgi->a({-href => esc("$my_uri?p=$project;a=log;h=$tag{'refid'}")}, "log"); } print "
" . $cgi->a({-href => "$my_uri?p=$project;a=tags"}, "...") . "" . $cgi->a({-href => esc("$my_uri?p=$project;a=tags")}, "...") . "
\n"; @@ -1087,16 +1095,16 @@ sub git_summary { if ($i-- > 0) { print "\n" . "\n" . "\n" . ""; } else { - print "\n" . + print "\n" . ""; last; } @@ -1110,24 +1118,24 @@ sub git_tag { my $head = git_read_hash("$project/HEAD"); git_header_html(); print "
\n" . - $cgi->a({-href => "$my_uri?p=$project;a=summary"}, "summary") . - " | " . $cgi->a({-href => "$my_uri?p=$project;a=shortlog"}, "shortlog") . - " | " . $cgi->a({-href => "$my_uri?p=$project;a=log"}, "log") . - " | " . $cgi->a({-href => "$my_uri?p=$project;a=commit;h=$head"}, "commit") . - " | " . $cgi->a({-href => "$my_uri?p=$project;a=commitdiff;h=$head"}, "commitdiff") . - " | " . $cgi->a({-href => "$my_uri?p=$project;a=tree;hb=$head"}, "tree") . "
\n" . + $cgi->a({-href => esc("$my_uri?p=$project;a=summary")}, "summary") . + " | " . $cgi->a({-href => esc("$my_uri?p=$project;a=shortlog")}, "shortlog") . + " | " . $cgi->a({-href => esc("$my_uri?p=$project;a=log")}, "log") . + " | " . $cgi->a({-href => esc("$my_uri?p=$project;a=commit;h=$head")}, "commit") . + " | " . $cgi->a({-href => esc("$my_uri?p=$project;a=commitdiff;h=$head")}, "commitdiff") . + " | " . $cgi->a({-href => esc("$my_uri?p=$project;a=tree;hb=$head")}, "tree") . "
\n" . "
\n" . "
\n"; my %tag = git_read_tag($hash); print "
\n" . - $cgi->a({-href => "$my_uri?p=$project;a=commit;h=$hash", -class => "title"}, escapeHTML($tag{'name'})) . "\n" . + $cgi->a({-href => esc("$my_uri?p=$project;a=commit;h=$hash"), -class => "title"}, escapeHTML($tag{'name'})) . "\n" . "
\n"; print "
\n" . "
$tag{'age'}" . - $cgi->a({-href => "$my_uri?p=$project;a=shortlog;h=$tag{'name'}", -class => "list"}, + $cgi->a({-href => esc("$my_uri?p=$project;a=shortlog;h=$tag{'name'}"), -class => "list"}, "" . escapeHTML($tag{'name'}) . "") . "" . - $cgi->a({-href => "$my_uri?p=$project;a=shortlog;h=$tag{'name'}"}, "shortlog") . - " | " . $cgi->a({-href => "$my_uri?p=$project;a=log;h=$tag{'name'}"}, "log") . + $cgi->a({-href => esc("$my_uri?p=$project;a=shortlog;h=$tag{'name'}")}, "shortlog") . + " | " . $cgi->a({-href => esc("$my_uri?p=$project;a=log;h=$tag{'name'}")}, "log") . "
" . $cgi->a({-href => "$my_uri?p=$project;a=heads"}, "...") . "" . $cgi->a({-href => esc("$my_uri?p=$project;a=heads")}, "...") . "
\n" . "\n" . "\n" . - "\n" . - "\n" . + "\n" . + "\n" . "\n"; if (defined($tag{'author'})) { my %ad = date_str($tag{'epoch'}, $tag{'tz'}); @@ -1149,17 +1157,17 @@ sub git_tags { my $head = git_read_hash("$project/HEAD"); git_header_html(); print "
\n" . - $cgi->a({-href => "$my_uri?p=$project;a=summary"}, "summary") . - " | " . $cgi->a({-href => "$my_uri?p=$project;a=shortlog"}, "shortlog") . - " | " . $cgi->a({-href => "$my_uri?p=$project;a=log"}, "log") . - " | " . $cgi->a({-href => "$my_uri?p=$project;a=commit;h=$head"}, "commit") . - " | " . $cgi->a({-href => "$my_uri?p=$project;a=commitdiff;h=$head"}, "commitdiff") . - " | " . $cgi->a({-href => "$my_uri?p=$project;a=tree;hb=$head"}, "tree") . "
\n" . + $cgi->a({-href => esc("$my_uri?p=$project;a=summary")}, "summary") . + " | " . $cgi->a({-href => esc("$my_uri?p=$project;a=shortlog")}, "shortlog") . + " | " . $cgi->a({-href => esc("$my_uri?p=$project;a=log")}, "log") . + " | " . $cgi->a({-href => esc("$my_uri?p=$project;a=commit;h=$head")}, "commit") . + " | " . $cgi->a({-href => esc("$my_uri?p=$project;a=commitdiff;h=$head")}, "commitdiff") . + " | " . $cgi->a({-href => esc("$my_uri?p=$project;a=tree;hb=$head")}, "tree") . "
\n" . "
\n" . "
\n"; my $taglist = git_read_refs("refs/tags"); print "
\n" . - $cgi->a({-href => "$my_uri?p=$project;a=summary", -class => "title"}, " ") . + $cgi->a({-href => esc("$my_uri?p=$project;a=summary"), -class => "title"}, " ") . "
\n"; print "
object" . $cgi->a({-class => "list", -href => "$my_uri?p=$project;a=$tag{'type'};h=$tag{'object'}"}, $tag{'object'}) . "" . $cgi->a({-href => "$my_uri?p=$project;a=$tag{'type'};h=$tag{'object'}"}, $tag{'type'}) . "" . $cgi->a({-class => "list", -href => esc("$my_uri?p=$project;a=$tag{'type'};h=$tag{'object'}")}, $tag{'object'}) . "" . $cgi->a({-href => esc("$my_uri?p=$project;a=$tag{'type'};h=$tag{'object'}")}, $tag{'type'}) . "
\n"; my $alternate = 0; @@ -1179,22 +1187,22 @@ sub git_tags { $alternate ^= 1; print "\n" . "\n" . "\n" . "\n" . ""; @@ -1208,17 +1216,17 @@ sub git_heads { my $head = git_read_hash("$project/HEAD"); git_header_html(); print "
\n" . - $cgi->a({-href => "$my_uri?p=$project;a=summary"}, "summary") . - " | " . $cgi->a({-href => "$my_uri?p=$project;a=shortlog"}, "shortlog") . - " | " . $cgi->a({-href => "$my_uri?p=$project;a=log"}, "log") . - " | " . $cgi->a({-href => "$my_uri?p=$project;a=commit;h=$head"}, "commit") . - " | " . $cgi->a({-href => "$my_uri?p=$project;a=commitdiff;h=$head"}, "commitdiff") . - " | " . $cgi->a({-href => "$my_uri?p=$project;a=tree;hb=$head"}, "tree") . "
\n" . + $cgi->a({-href => esc("$my_uri?p=$project;a=summary")}, "summary") . + " | " . $cgi->a({-href => esc("$my_uri?p=$project;a=shortlog")}, "shortlog") . + " | " . $cgi->a({-href => esc("$my_uri?p=$project;a=log")}, "log") . + " | " . $cgi->a({-href => esc("$my_uri?p=$project;a=commit;h=$head")}, "commit") . + " | " . $cgi->a({-href => esc("$my_uri?p=$project;a=commitdiff;h=$head")}, "commitdiff") . + " | " . $cgi->a({-href => esc("$my_uri?p=$project;a=tree;hb=$head")}, "tree") . "
\n" . "
\n" . "
\n"; my $taglist = git_read_refs("refs/heads"); print "
\n" . - $cgi->a({-href => "$my_uri?p=$project;a=summary", -class => "title"}, " ") . + $cgi->a({-href => esc("$my_uri?p=$project;a=summary"), -class => "title"}, " ") . "
\n"; print "
$tag{'age'}" . - $cgi->a({-href => "$my_uri?p=$project;a=$tag{'reftype'};h=$tag{'refid'}", -class => "list"}, + $cgi->a({-href => esc("$my_uri?p=$project;a=$tag{'reftype'};h=$tag{'refid'}"), -class => "list"}, "" . escapeHTML($tag{'name'}) . "") . ""; if (defined($comment)) { - print $cgi->a({-class => "list", -href => "$my_uri?p=$project;a=tag;h=$tag{'id'}"}, $comment); + print $cgi->a({-class => "list", -href => esc("$my_uri?p=$project;a=tag;h=$tag{'id'}")}, $comment); } print ""; if ($tag{'type'} eq "tag") { - print $cgi->a({-href => "$my_uri?p=$project;a=tag;h=$tag{'id'}"}, "tag") . " | "; + print $cgi->a({-href => esc("$my_uri?p=$project;a=tag;h=$tag{'id'}")}, "tag") . " | "; } - print $cgi->a({-href => "$my_uri?p=$project;a=$tag{'reftype'};h=$tag{'refid'}"}, $tag{'reftype'}); + print $cgi->a({-href => esc("$my_uri?p=$project;a=$tag{'reftype'};h=$tag{'refid'}")}, $tag{'reftype'}); if ($tag{'reftype'} eq "commit") { - print " | " . $cgi->a({-href => "$my_uri?p=$project;a=shortlog;h=$tag{'name'}"}, "shortlog") . - " | " . $cgi->a({-href => "$my_uri?p=$project;a=log;h=$tag{'refid'}"}, "log"); + print " | " . $cgi->a({-href => esc("$my_uri?p=$project;a=shortlog;h=$tag{'name'}")}, "shortlog") . + " | " . $cgi->a({-href => esc("$my_uri?p=$project;a=log;h=$tag{'refid'}")}, "log"); } print "
\n"; my $alternate = 0; @@ -1233,11 +1241,11 @@ sub git_heads { $alternate ^= 1; print "\n" . "\n" . "\n" . ""; } @@ -1285,20 +1293,20 @@ sub git_blob { git_header_html(); if (defined $hash_base && (my %co = git_read_commit($hash_base))) { print "
\n" . - $cgi->a({-href => "$my_uri?p=$project;a=summary"}, "summary") . - " | " . $cgi->a({-href => "$my_uri?p=$project;a=shortlog"}, "shortlog") . - " | " . $cgi->a({-href => "$my_uri?p=$project;a=log"}, "log") . - " | " . $cgi->a({-href => "$my_uri?p=$project;a=commit;h=$hash_base"}, "commit") . - " | " . $cgi->a({-href => "$my_uri?p=$project;a=commitdiff;h=$hash_base"}, "commitdiff") . - " | " . $cgi->a({-href => "$my_uri?p=$project;a=tree;h=$co{'tree'};hb=$hash_base"}, "tree") . "
\n"; + $cgi->a({-href => esc("$my_uri?p=$project;a=summary")}, "summary") . + " | " . $cgi->a({-href => esc("$my_uri?p=$project;a=shortlog")}, "shortlog") . + " | " . $cgi->a({-href => esc("$my_uri?p=$project;a=log")}, "log") . + " | " . $cgi->a({-href => esc("$my_uri?p=$project;a=commit;h=$hash_base")}, "commit") . + " | " . $cgi->a({-href => esc("$my_uri?p=$project;a=commitdiff;h=$hash_base")}, "commitdiff") . + " | " . $cgi->a({-href => esc("$my_uri?p=$project;a=tree;h=$co{'tree'};hb=$hash_base")}, "tree") . "
\n"; if (defined $file_name) { - print $cgi->a({-href => "$my_uri?p=$project;a=blob_plain;h=$hash;f=$file_name"}, "plain") . "
\n"; + print $cgi->a({-href => esc("$my_uri?p=$project;a=blob_plain;h=$hash;f=$file_name")}, "plain") . "
\n"; } else { - print $cgi->a({-href => "$my_uri?p=$project;a=blob_plain;h=$hash"}, "plain") . "
\n"; + print $cgi->a({-href => esc("$my_uri?p=$project;a=blob_plain;h=$hash")}, "plain") . "
\n"; } print "
\n". "
" . - $cgi->a({-href => "$my_uri?p=$project;a=commit;h=$hash_base", -class => "title"}, escapeHTML($co{'title'})) . + $cgi->a({-href => esc("$my_uri?p=$project;a=commit;h=$hash_base"), -class => "title"}, escapeHTML($co{'title'})) . "
\n"; } else { print "
\n" . @@ -1361,16 +1369,16 @@ sub git_tree { if (defined $hash_base && (my %co = git_read_commit($hash_base))) { $base_key = ";hb=$hash_base"; print "
\n" . - $cgi->a({-href => "$my_uri?p=$project;a=summary"}, "summary") . - " | " . $cgi->a({-href => "$my_uri?p=$project;a=shortlog;h=$hash_base"}, "shortlog") . - " | " . $cgi->a({-href => "$my_uri?p=$project;a=log;h=$hash_base"}, "log") . - " | " . $cgi->a({-href => "$my_uri?p=$project;a=commit;h=$hash_base"}, "commit") . - " | " . $cgi->a({-href => "$my_uri?p=$project;a=commitdiff;h=$hash_base"}, "commitdiff") . + $cgi->a({-href => esc("$my_uri?p=$project;a=summary")}, "summary") . + " | " . $cgi->a({-href => esc("$my_uri?p=$project;a=shortlog;h=$hash_base")}, "shortlog") . + " | " . $cgi->a({-href => esc("$my_uri?p=$project;a=log;h=$hash_base")}, "log") . + " | " . $cgi->a({-href => esc("$my_uri?p=$project;a=commit;h=$hash_base")}, "commit") . + " | " . $cgi->a({-href => esc("$my_uri?p=$project;a=commitdiff;h=$hash_base")}, "commitdiff") . " | tree" . "

\n" . "
\n"; print "
\n" . - $cgi->a({-href => "$my_uri?p=$project;a=commit;h=$hash_base", -class => "title"}, escapeHTML($co{'title'})) . "\n" . + $cgi->a({-href => esc("$my_uri?p=$project;a=commit;h=$hash_base"), -class => "title"}, escapeHTML($co{'title'})) . "\n" . "
\n"; } else { print "
\n"; @@ -1403,18 +1411,18 @@ sub git_tree { print "
\n"; if ($t_type eq "blob") { print "\n" . "\n"; } elsif ($t_type eq "tree") { print "\n" . "\n"; } print "\n"; @@ -1523,12 +1531,12 @@ sub git_log { } git_header_html(); print "
\n"; - print $cgi->a({-href => "$my_uri?p=$project;a=summary"}, "summary") . - " | " . $cgi->a({-href => "$my_uri?p=$project;a=shortlog;h=$hash"}, "shortlog") . + print $cgi->a({-href => esc("$my_uri?p=$project;a=summary")}, "summary") . + " | " . $cgi->a({-href => esc("$my_uri?p=$project;a=shortlog;h=$hash")}, "shortlog") . " | log" . - " | " . $cgi->a({-href => "$my_uri?p=$project;a=commit;h=$hash"}, "commit") . - " | " . $cgi->a({-href => "$my_uri?p=$project;a=commitdiff;h=$hash"}, "commitdiff") . - " | " . $cgi->a({-href => "$my_uri?p=$project;a=tree;h=$hash;hb=$hash"}, "tree") . "
\n"; + " | " . $cgi->a({-href => esc("$my_uri?p=$project;a=commit;h=$hash")}, "commit") . + " | " . $cgi->a({-href => esc("$my_uri?p=$project;a=commitdiff;h=$hash")}, "commitdiff") . + " | " . $cgi->a({-href => esc("$my_uri?p=$project;a=tree;h=$hash;hb=$hash")}, "tree") . "
\n"; my $limit = sprintf("--max-count=%i", (100 * ($page+1))); open my $fd, "-|", "$gitbin/git-rev-list $limit $hash" or die_error(undef, "Open failed."); @@ -1536,19 +1544,19 @@ sub git_log { close $fd; if ($hash ne $head || $page) { - print $cgi->a({-href => "$my_uri?p=$project;a=log"}, "HEAD"); + print $cgi->a({-href => esc("$my_uri?p=$project;a=log")}, "HEAD"); } else { print "HEAD"; } if ($page > 0) { print " ⋅ " . - $cgi->a({-href => "$my_uri?p=$project;a=log;h=$hash;pg=" . ($page-1), -accesskey => "p", -title => "Alt-p"}, "prev"); + $cgi->a({-href => esc("$my_uri?p=$project;a=log;h=$hash;pg=" . ($page-1)), -accesskey => "p", -title => "Alt-p"}, "prev"); } else { print " ⋅ prev"; } if ($#revlist >= (100 * ($page+1)-1)) { print " ⋅ " . - $cgi->a({-href => "$my_uri?p=$project;a=log;h=$hash;pg=" . ($page+1), -accesskey => "n", -title => "Alt-n"}, "next"); + $cgi->a({-href => esc("$my_uri?p=$project;a=log;h=$hash;pg=" . ($page+1)), -accesskey => "n", -title => "Alt-n"}, "next"); } else { print " ⋅ next"; } @@ -1556,7 +1564,7 @@ sub git_log { "
\n"; if (!@revlist) { print "
\n" . - $cgi->a({-href => "$my_uri?p=$project;a=summary", -class => "title"}, " ") . + $cgi->a({-href => esc("$my_uri?p=$project;a=summary"), -class => "title"}, " ") . "
\n"; my %co = git_read_commit($hash); print "
Last change $co{'age_string'}.

\n"; @@ -1567,13 +1575,13 @@ sub git_log { next if !%co; my %ad = date_str($co{'author_epoch'}); print "
\n" . - $cgi->a({-href => "$my_uri?p=$project;a=commit;h=$commit", -class => "title"}, + $cgi->a({-href => esc("$my_uri?p=$project;a=commit;h=$commit"), -class => "title"}, "$co{'age_string'}" . escapeHTML($co{'title'})) . "\n" . "
\n"; print "
\n" . "
\n" . - $cgi->a({-href => "$my_uri?p=$project;a=commit;h=$commit"}, "commit") . - " | " . $cgi->a({-href => "$my_uri?p=$project;a=commitdiff;h=$commit"}, "commitdiff") . + $cgi->a({-href => esc("$my_uri?p=$project;a=commit;h=$commit")}, "commit") . + " | " . $cgi->a({-href => esc("$my_uri?p=$project;a=commitdiff;h=$commit")}, "commitdiff") . "
\n" . "
\n" . "" . escapeHTML($co{'author_name'}) . " [$ad{'rfc2822'}]
\n" . @@ -1629,22 +1637,22 @@ sub git_commit { } git_header_html(undef, $expires); print "
\n" . - $cgi->a({-href => "$my_uri?p=$project;a=summary"}, "summary") . - " | " . $cgi->a({-href => "$my_uri?p=$project;a=shortlog;h=$hash"}, "shortlog") . - " | " . $cgi->a({-href => "$my_uri?p=$project;a=log;h=$hash"}, "log") . + $cgi->a({-href => esc("$my_uri?p=$project;a=summary")}, "summary") . + " | " . $cgi->a({-href => esc("$my_uri?p=$project;a=shortlog;h=$hash")}, "shortlog") . + " | " . $cgi->a({-href => esc("$my_uri?p=$project;a=log;h=$hash")}, "log") . " | commit"; if (defined $co{'parent'}) { - print " | " . $cgi->a({-href => "$my_uri?p=$project;a=commitdiff;h=$hash"}, "commitdiff"); + print " | " . $cgi->a({-href => esc("$my_uri?p=$project;a=commitdiff;h=$hash")}, "commitdiff"); } - print " | " . $cgi->a({-href => "$my_uri?p=$project;a=tree;h=$co{'tree'};hb=$hash"}, "tree") . "\n" . + print " | " . $cgi->a({-href => esc("$my_uri?p=$project;a=tree;h=$co{'tree'};hb=$hash")}, "tree") . "\n" . "

\n"; if (defined $co{'parent'}) { print "
\n" . - $cgi->a({-href => "$my_uri?p=$project;a=commitdiff;h=$hash", -class => "title"}, escapeHTML($co{'title'})) . "\n" . + $cgi->a({-href => esc("$my_uri?p=$project;a=commitdiff;h=$hash"), -class => "title"}, escapeHTML($co{'title'})) . "\n" . "
\n"; } else { print "
\n" . - $cgi->a({-href => "$my_uri?p=$project;a=tree;h=$co{'tree'};hb=$hash", -class => "title"}, escapeHTML($co{'title'})) . "\n" . + $cgi->a({-href => esc("$my_uri?p=$project;a=tree;h=$co{'tree'};hb=$hash"), -class => "title"}, escapeHTML($co{'title'})) . "\n" . "
\n"; } print "
\n" . @@ -1665,19 +1673,19 @@ sub git_commit { print "
" . "" . "" . - "" . "\n"; my $parents = $co{'parents'}; foreach my $par (@$parents) { print "" . "" . - "" . + "" . "" . "\n"; } @@ -1738,16 +1746,16 @@ sub git_commit { $mode_chng = sprintf(" with mode: %04o", (oct $to_mode) & 0777); } print "\n" . + $cgi->a({-href => esc("$my_uri?p=$project;a=blob;h=$to_id;hb=$hash;f=$file"), -class => "list"}, escapeHTML($file)) . "\n" . "\n" . - "\n"; + "\n"; } elsif ($status eq "D") { print "\n" . + $cgi->a({-href => esc("$my_uri?p=$project;a=blob;h=$from_id;hb=$hash;f=$file"), -class => "list"}, escapeHTML($file)) . "\n" . "\n" . "\n" } elsif ($status eq "M" || $status eq "T") { my $mode_chnge = ""; @@ -1767,18 +1775,18 @@ sub git_commit { } print "\n" . "\n" . "\n"; } elsif ($status eq "R") { my ($from_file, $to_file) = split "\t", $file; @@ -1787,14 +1795,14 @@ sub git_commit { $mode_chng = sprintf(", mode: %04o", (oct $to_mode) & 0777); } print "\n" . + $cgi->a({-href => esc("$my_uri?p=$project;a=blob;h=$to_id;hb=$hash;f=$to_file"), -class => "list"}, escapeHTML($to_file)) . "\n" . "\n" . "\n"; } @@ -1809,17 +1817,17 @@ sub git_blobdiff { git_header_html(); if (defined $hash_base && (my %co = git_read_commit($hash_base))) { print "
\n" . - $cgi->a({-href => "$my_uri?p=$project;a=summary"}, "summary") . - " | " . $cgi->a({-href => "$my_uri?p=$project;a=shortlog"}, "shortlog") . - " | " . $cgi->a({-href => "$my_uri?p=$project;a=log"}, "log") . - " | " . $cgi->a({-href => "$my_uri?p=$project;a=commit;h=$hash_base"}, "commit") . - " | " . $cgi->a({-href => "$my_uri?p=$project;a=commitdiff;h=$hash_base"}, "commitdiff") . - " | " . $cgi->a({-href => "$my_uri?p=$project;a=tree;h=$co{'tree'};hb=$hash_base"}, "tree") . + $cgi->a({-href => esc("$my_uri?p=$project;a=summary")}, "summary") . + " | " . $cgi->a({-href => esc("$my_uri?p=$project;a=shortlog")}, "shortlog") . + " | " . $cgi->a({-href => esc("$my_uri?p=$project;a=log")}, "log") . + " | " . $cgi->a({-href => esc("$my_uri?p=$project;a=commit;h=$hash_base")}, "commit") . + " | " . $cgi->a({-href => esc("$my_uri?p=$project;a=commitdiff;h=$hash_base")}, "commitdiff") . + " | " . $cgi->a({-href => esc("$my_uri?p=$project;a=tree;h=$co{'tree'};hb=$hash_base")}, "tree") . "
\n"; - print $cgi->a({-href => "$my_uri?p=$project;a=blobdiff_plain;h=$hash;hp=$hash_parent"}, "plain") . + print $cgi->a({-href => esc("$my_uri?p=$project;a=blobdiff_plain;h=$hash;hp=$hash_parent")}, "plain") . "
\n"; print "
\n" . - $cgi->a({-href => "$my_uri?p=$project;a=commit;h=$hash_base", -class => "title"}, escapeHTML($co{'title'})) . "\n" . + $cgi->a({-href => esc("$my_uri?p=$project;a=commit;h=$hash_base"), -class => "title"}, escapeHTML($co{'title'})) . "\n" . "
\n"; } else { print "
\n" . @@ -1831,9 +1839,9 @@ sub git_blobdiff { } print "
\n" . "
blob:" . - $cgi->a({-href => "$my_uri?p=$project;a=blob;h=$hash_parent;hb=$hash_base;f=$file_name"}, $hash_parent) . + $cgi->a({-href => esc("$my_uri?p=$project;a=blob;h=$hash_parent;hb=$hash_base;f=$file_name")}, $hash_parent) . " -> blob:" . - $cgi->a({-href => "$my_uri?p=$project;a=blob;h=$hash;hb=$hash_base;f=$file_name"}, $hash) . + $cgi->a({-href => esc("$my_uri?p=$project;a=blob;h=$hash;hb=$hash_base;f=$file_name")}, $hash) . "
\n"; git_diff_print($hash_parent, $file_name || $hash_parent, $hash, $file_name || $hash); print "
"; @@ -1866,16 +1874,16 @@ sub git_commitdiff { } git_header_html(undef, $expires); print "
\n" . - $cgi->a({-href => "$my_uri?p=$project;a=summary"}, "summary") . - " | " . $cgi->a({-href => "$my_uri?p=$project;a=shortlog;h=$hash"}, "shortlog") . - " | " . $cgi->a({-href => "$my_uri?p=$project;a=log;h=$hash"}, "log") . - " | " . $cgi->a({-href => "$my_uri?p=$project;a=commit;h=$hash"}, "commit") . + $cgi->a({-href => esc("$my_uri?p=$project;a=summary")}, "summary") . + " | " . $cgi->a({-href => esc("$my_uri?p=$project;a=shortlog;h=$hash")}, "shortlog") . + " | " . $cgi->a({-href => esc("$my_uri?p=$project;a=log;h=$hash")}, "log") . + " | " . $cgi->a({-href => esc("$my_uri?p=$project;a=commit;h=$hash")}, "commit") . " | commitdiff" . - " | " . $cgi->a({-href => "$my_uri?p=$project;a=tree;h=$co{'tree'};hb=$hash"}, "tree") . "
\n"; - print $cgi->a({-href => "$my_uri?p=$project;a=commitdiff_plain;h=$hash;hp=$hash_parent"}, "plain") . "\n" . + " | " . $cgi->a({-href => esc("$my_uri?p=$project;a=tree;h=$co{'tree'};hb=$hash")}, "tree") . "
\n"; + print $cgi->a({-href => esc("$my_uri?p=$project;a=commitdiff_plain;h=$hash;hp=$hash_parent")}, "plain") . "\n" . "
\n"; print "
\n" . - $cgi->a({-href => "$my_uri?p=$project;a=commit;h=$hash", -class => "title"}, escapeHTML($co{'title'})) . "\n" . + $cgi->a({-href => esc("$my_uri?p=$project;a=commit;h=$hash"), -class => "title"}, escapeHTML($co{'title'})) . "\n" . "
\n"; print "
\n"; my $comment = $co{'comment'}; @@ -1914,20 +1922,20 @@ sub git_commitdiff { my $file = $6; if ($status eq "A") { print "
" . file_type($to_mode) . ":" . - $cgi->a({-href => "$my_uri?p=$project;a=blob;h=$to_id;hb=$hash;f=$file"}, $to_id) . "(new)" . + $cgi->a({-href => esc("$my_uri?p=$project;a=blob;h=$to_id;hb=$hash;f=$file")}, $to_id) . "(new)" . "
\n"; git_diff_print(undef, "/dev/null", $to_id, "b/$file"); } elsif ($status eq "D") { print "
" . file_type($from_mode) . ":" . - $cgi->a({-href => "$my_uri?p=$project;a=blob;h=$from_id;hb=$hash;f=$file"}, $from_id) . "(deleted)" . + $cgi->a({-href => esc("$my_uri?p=$project;a=blob;h=$from_id;hb=$hash;f=$file")}, $from_id) . "(deleted)" . "
\n"; git_diff_print($from_id, "a/$file", undef, "/dev/null"); } elsif ($status eq "M") { if ($from_id ne $to_id) { print "
" . - file_type($from_mode) . ":" . $cgi->a({-href => "$my_uri?p=$project;a=blob;h=$from_id;hb=$hash;f=$file"}, $from_id) . + file_type($from_mode) . ":" . $cgi->a({-href => esc("$my_uri?p=$project;a=blob;h=$from_id;hb=$hash;f=$file")}, $from_id) . " -> " . - file_type($to_mode) . ":" . $cgi->a({-href => "$my_uri?p=$project;a=blob;h=$to_id;hb=$hash;f=$file"}, $to_id); + file_type($to_mode) . ":" . $cgi->a({-href => esc("$my_uri?p=$project;a=blob;h=$to_id;hb=$hash;f=$file")}, $to_id); print "
\n"; git_diff_print($from_id, "a/$file", $to_id, "b/$file"); } @@ -2008,16 +2016,16 @@ sub git_history { } git_header_html(); print "
\n" . - $cgi->a({-href => "$my_uri?p=$project;a=summary"}, "summary") . - " | " . $cgi->a({-href => "$my_uri?p=$project;a=shortlog"}, "shortlog") . - " | " . $cgi->a({-href => "$my_uri?p=$project;a=log"}, "log") . - " | " . $cgi->a({-href => "$my_uri?p=$project;a=commit;h=$hash"}, "commit") . - " | " . $cgi->a({-href => "$my_uri?p=$project;a=commitdiff;h=$hash"}, "commitdiff") . - " | " . $cgi->a({-href => "$my_uri?p=$project;a=tree;h=$co{'tree'};hb=$hash"}, "tree") . + $cgi->a({-href => esc("$my_uri?p=$project;a=summary")}, "summary") . + " | " . $cgi->a({-href => esc("$my_uri?p=$project;a=shortlog")}, "shortlog") . + " | " . $cgi->a({-href => esc("$my_uri?p=$project;a=log")}, "log") . + " | " . $cgi->a({-href => esc("$my_uri?p=$project;a=commit;h=$hash")}, "commit") . + " | " . $cgi->a({-href => esc("$my_uri?p=$project;a=commitdiff;h=$hash")}, "commitdiff") . + " | " . $cgi->a({-href => esc("$my_uri?p=$project;a=tree;h=$co{'tree'};hb=$hash")}, "tree") . "

\n" . "
\n"; print "
\n" . - $cgi->a({-href => "$my_uri?p=$project;a=commit;h=$hash", -class => "title"}, escapeHTML($co{'title'})) . "\n" . + $cgi->a({-href => esc("$my_uri?p=$project;a=commit;h=$hash"), -class => "title"}, escapeHTML($co{'title'})) . "\n" . "
\n"; print "
/$file_name
\n"; @@ -2043,17 +2051,17 @@ sub git_history { $alternate ^= 1; print "
\n" . "\n" . - "\n" . "\n" . @@ -2093,17 +2101,17 @@ sub git_search { } git_header_html(); print "
\n" . - $cgi->a({-href => "$my_uri?p=$project;a=summary;h=$hash"}, "summary") . - " | " . $cgi->a({-href => "$my_uri?p=$project;a=shortlog"}, "shortlog") . - " | " . $cgi->a({-href => "$my_uri?p=$project;a=log;h=$hash"}, "log") . - " | " . $cgi->a({-href => "$my_uri?p=$project;a=commit;h=$hash"}, "commit") . - " | " . $cgi->a({-href => "$my_uri?p=$project;a=commitdiff;h=$hash"}, "commitdiff") . - " | " . $cgi->a({-href => "$my_uri?p=$project;a=tree;h=$co{'tree'};hb=$hash"}, "tree") . + $cgi->a({-href => esc("$my_uri?p=$project;a=summary;h=$hash")}, "summary") . + " | " . $cgi->a({-href => esc("$my_uri?p=$project;a=shortlog")}, "shortlog") . + " | " . $cgi->a({-href => esc("$my_uri?p=$project;a=log;h=$hash")}, "log") . + " | " . $cgi->a({-href => esc("$my_uri?p=$project;a=commit;h=$hash")}, "commit") . + " | " . $cgi->a({-href => esc("$my_uri?p=$project;a=commitdiff;h=$hash")}, "commitdiff") . + " | " . $cgi->a({-href => esc("$my_uri?p=$project;a=tree;h=$co{'tree'};hb=$hash")}, "tree") . "

\n" . "
\n"; print "
\n" . - $cgi->a({-href => "$my_uri?p=$project;a=commit;h=$hash", -class => "title"}, escapeHTML($co{'title'})) . "\n" . + $cgi->a({-href => esc("$my_uri?p=$project;a=commit;h=$hash"), -class => "title"}, escapeHTML($co{'title'})) . "\n" . "
\n"; print "
$tag{'age'}" . - $cgi->a({-href => "$my_uri?p=$project;a=shortlog;h=$tag{'name'}", -class => "list"}, "" . escapeHTML($tag{'name'}) . "") . + $cgi->a({-href => esc("$my_uri?p=$project;a=shortlog;h=$tag{'name'}"), -class => "list"}, "" . escapeHTML($tag{'name'}) . "") . "" . - $cgi->a({-href => "$my_uri?p=$project;a=shortlog;h=$tag{'name'}"}, "shortlog") . - " | " . $cgi->a({-href => "$my_uri?p=$project;a=log;h=$tag{'name'}"}, "log") . + $cgi->a({-href => esc("$my_uri?p=$project;a=shortlog;h=$tag{'name'}")}, "shortlog") . + " | " . $cgi->a({-href => esc("$my_uri?p=$project;a=log;h=$tag{'name'}")}, "log") . "
" . mode_str($t_mode) . "" . - $cgi->a({-href => "$my_uri?p=$project;a=blob;h=$t_hash" . $base_key . $file_key, -class => "list"}, $t_name) . + $cgi->a({-href => esc("$my_uri?p=$project;a=blob;h=$t_hash" . $base_key . $file_key), -class => "list"}, $t_name) . "" . - $cgi->a({-href => "$my_uri?p=$project;a=blob;h=$t_hash" . $base_key . $file_key}, "blob") . - " | " . $cgi->a({-href => "$my_uri?p=$project;a=history;h=$hash_base" . $file_key}, "history") . + $cgi->a({-href => esc("$my_uri?p=$project;a=blob;h=$t_hash" . $base_key . $file_key)}, "blob") . + " | " . $cgi->a({-href => esc("$my_uri?p=$project;a=history;h=$hash_base" . $file_key)}, "history") . "" . - $cgi->a({-href => "$my_uri?p=$project;a=tree;h=$t_hash" . $base_key . $file_key}, $t_name) . + $cgi->a({-href => esc("$my_uri?p=$project;a=tree;h=$t_hash" . $base_key . $file_key)}, $t_name) . "" . - $cgi->a({-href => "$my_uri?p=$project;a=tree;h=$t_hash" . $base_key . $file_key}, "tree") . + $cgi->a({-href => esc("$my_uri?p=$project;a=tree;h=$t_hash" . $base_key . $file_key)}, "tree") . "
tree" . - $cgi->a({-href => "$my_uri?p=$project;a=tree;h=$co{'tree'};hb=$hash", class => "list"}, $co{'tree'}) . + $cgi->a({-href => esc("$my_uri?p=$project;a=tree;h=$co{'tree'};hb=$hash"), class => "list"}, $co{'tree'}) . "" . $cgi->a({-href => "$my_uri?p=$project;a=tree;h=$co{'tree'};hb=$hash"}, "tree") . + "" . $cgi->a({-href => esc("$my_uri?p=$project;a=tree;h=$co{'tree'};hb=$hash")}, "tree") . "
parent" . $cgi->a({-href => "$my_uri?p=$project;a=commit;h=$par", class => "list"}, $par) . "" . $cgi->a({-href => esc("$my_uri?p=$project;a=commit;h=$par"), class => "list"}, $par) . "" . - $cgi->a({-href => "$my_uri?p=$project;a=commit;h=$par"}, "commit") . - " | " . $cgi->a({-href => "$my_uri?p=$project;a=commitdiff;h=$hash;hp=$par"}, "commitdiff") . + $cgi->a({-href => esc("$my_uri?p=$project;a=commit;h=$par")}, "commit") . + " | " . $cgi->a({-href => esc("$my_uri?p=$project;a=commitdiff;h=$hash;hp=$par")}, "commitdiff") . "
" . - $cgi->a({-href => "$my_uri?p=$project;a=blob;h=$to_id;hb=$hash;f=$file", -class => "list"}, escapeHTML($file)) . "[new " . file_type($to_mode) . "$mode_chng]" . $cgi->a({-href => "$my_uri?p=$project;a=blob;h=$to_id;hb=$hash;f=$file"}, "blob") . "" . $cgi->a({-href => esc("$my_uri?p=$project;a=blob;h=$to_id;hb=$hash;f=$file")}, "blob") . "" . - $cgi->a({-href => "$my_uri?p=$project;a=blob;h=$from_id;hb=$hash;f=$file", -class => "list"}, escapeHTML($file)) . "[deleted " . file_type($from_mode). "]" . - $cgi->a({-href => "$my_uri?p=$project;a=blob;h=$from_id;hb=$hash;f=$file"}, "blob") . - " | " . $cgi->a({-href => "$my_uri?p=$project;a=history;h=$hash;f=$file"}, "history") . + $cgi->a({-href => esc("$my_uri?p=$project;a=blob;h=$from_id;hb=$hash;f=$file")}, "blob") . + " | " . $cgi->a({-href => esc("$my_uri?p=$project;a=history;h=$hash;f=$file")}, "history") . ""; if ($to_id ne $from_id) { - print $cgi->a({-href => "$my_uri?p=$project;a=blobdiff;h=$to_id;hp=$from_id;hb=$hash;f=$file", -class => "list"}, escapeHTML($file)); + print $cgi->a({-href => esc("$my_uri?p=$project;a=blobdiff;h=$to_id;hp=$from_id;hb=$hash;f=$file"), -class => "list"}, escapeHTML($file)); } else { - print $cgi->a({-href => "$my_uri?p=$project;a=blob;h=$to_id;hb=$hash;f=$file", -class => "list"}, escapeHTML($file)); + print $cgi->a({-href => esc("$my_uri?p=$project;a=blob;h=$to_id;hb=$hash;f=$file"), -class => "list"}, escapeHTML($file)); } print "$mode_chnge"; - print $cgi->a({-href => "$my_uri?p=$project;a=blob;h=$to_id;hb=$hash;f=$file"}, "blob"); + print $cgi->a({-href => esc("$my_uri?p=$project;a=blob;h=$to_id;hb=$hash;f=$file")}, "blob"); if ($to_id ne $from_id) { - print " | " . $cgi->a({-href => "$my_uri?p=$project;a=blobdiff;h=$to_id;hp=$from_id;hb=$hash;f=$file"}, "diff"); + print " | " . $cgi->a({-href => esc("$my_uri?p=$project;a=blobdiff;h=$to_id;hp=$from_id;hb=$hash;f=$file")}, "diff"); } - print " | " . $cgi->a({-href => "$my_uri?p=$project;a=history;h=$hash;f=$file"}, "history") . "\n"; + print " | " . $cgi->a({-href => esc("$my_uri?p=$project;a=history;h=$hash;f=$file")}, "history") . "\n"; print "" . - $cgi->a({-href => "$my_uri?p=$project;a=blob;h=$to_id;hb=$hash;f=$to_file", -class => "list"}, escapeHTML($to_file)) . "[moved from " . - $cgi->a({-href => "$my_uri?p=$project;a=blob;h=$from_id;hb=$hash;f=$from_file", -class => "list"}, escapeHTML($from_file)) . + $cgi->a({-href => esc("$my_uri?p=$project;a=blob;h=$from_id;hb=$hash;f=$from_file"), -class => "list"}, escapeHTML($from_file)) . " with " . (int $similarity) . "% similarity$mode_chng]" . - $cgi->a({-href => "$my_uri?p=$project;a=blob;h=$to_id;hb=$hash;f=$to_file"}, "blob"); + $cgi->a({-href => esc("$my_uri?p=$project;a=blob;h=$to_id;hb=$hash;f=$to_file")}, "blob"); if ($to_id ne $from_id) { - print " | " . $cgi->a({-href => "$my_uri?p=$project;a=blobdiff;h=$to_id;hp=$from_id;hb=$hash;f=$to_file"}, "diff"); + print " | " . $cgi->a({-href => esc("$my_uri?p=$project;a=blobdiff;h=$to_id;hp=$from_id;hb=$hash;f=$to_file")}, "diff"); } print "$co{'age_string_date'}" . escapeHTML(chop_str($co{'author_name'}, 15, 3)) . "" . $cgi->a({-href => "$my_uri?p=$project;a=commit;h=$commit", -class => "list"}, "" . + "" . $cgi->a({-href => esc("$my_uri?p=$project;a=commit;h=$commit"), -class => "list"}, "" . escapeHTML(chop_str($co{'title'}, 50)) . "") . "" . - $cgi->a({-href => "$my_uri?p=$project;a=commit;h=$commit"}, "commit") . - " | " . $cgi->a({-href => "$my_uri?p=$project;a=commitdiff;h=$commit"}, "commitdiff") . - " | " . $cgi->a({-href => "$my_uri?p=$project;a=blob;hb=$commit;f=$file_name"}, "blob"); + $cgi->a({-href => esc("$my_uri?p=$project;a=commit;h=$commit")}, "commit") . + " | " . $cgi->a({-href => esc("$my_uri?p=$project;a=commitdiff;h=$commit")}, "commitdiff") . + " | " . $cgi->a({-href => esc("$my_uri?p=$project;a=blob;hb=$commit;f=$file_name")}, "blob"); my $blob = git_get_hash_by_path($hash, $file_name); my $blob_parent = git_get_hash_by_path($commit, $file_name); if (defined $blob && defined $blob_parent && $blob ne $blob_parent) { print " | " . - $cgi->a({-href => "$my_uri?p=$project;a=blobdiff;h=$blob;hp=$blob_parent;hb=$commit;f=$file_name"}, + $cgi->a({-href => esc("$my_uri?p=$project;a=blobdiff;h=$blob;hp=$blob_parent;hb=$commit;f=$file_name")}, "diff to current"); } print "
\n"; my $alternate = 0; @@ -2134,7 +2142,7 @@ sub git_search { print "\n" . "\n" . "\n" . "\n" . "\n"; } @@ -2187,18 +2195,18 @@ sub git_search { print "\n" . "\n" . "\n" . "\n" . "\n"; } @@ -2221,12 +2229,12 @@ sub git_shortlog { } git_header_html(); print "
\n" . - $cgi->a({-href => "$my_uri?p=$project;a=summary"}, "summary") . + $cgi->a({-href => esc("$my_uri?p=$project;a=summary")}, "summary") . " | shortlog" . - " | " . $cgi->a({-href => "$my_uri?p=$project;a=log;h=$hash"}, "log") . - " | " . $cgi->a({-href => "$my_uri?p=$project;a=commit;h=$hash"}, "commit") . - " | " . $cgi->a({-href => "$my_uri?p=$project;a=commitdiff;h=$hash"}, "commitdiff") . - " | " . $cgi->a({-href => "$my_uri?p=$project;a=tree;h=$hash;hb=$hash"}, "tree") . "
\n"; + " | " . $cgi->a({-href => esc("$my_uri?p=$project;a=log;h=$hash")}, "log") . + " | " . $cgi->a({-href => esc("$my_uri?p=$project;a=commit;h=$hash")}, "commit") . + " | " . $cgi->a({-href => esc("$my_uri?p=$project;a=commitdiff;h=$hash")}, "commitdiff") . + " | " . $cgi->a({-href => esc("$my_uri?p=$project;a=tree;h=$hash;hb=$hash")}, "tree") . "
\n"; my $limit = sprintf("--max-count=%i", (100 * ($page+1))); open my $fd, "-|", "$gitbin/git-rev-list $limit $hash" or die_error(undef, "Open failed."); @@ -2234,26 +2242,26 @@ sub git_shortlog { close $fd; if ($hash ne $head || $page) { - print $cgi->a({-href => "$my_uri?p=$project;a=shortlog"}, "HEAD"); + print $cgi->a({-href => esc("$my_uri?p=$project;a=shortlog")}, "HEAD"); } else { print "HEAD"; } if ($page > 0) { print " ⋅ " . - $cgi->a({-href => "$my_uri?p=$project;a=shortlog;h=$hash;pg=" . ($page-1), -accesskey => "p", -title => "Alt-p"}, "prev"); + $cgi->a({-href => esc("$my_uri?p=$project;a=shortlog;h=$hash;pg=" . ($page-1)), -accesskey => "p", -title => "Alt-p"}, "prev"); } else { print " ⋅ prev"; } if ($#revlist >= (100 * ($page+1)-1)) { print " ⋅ " . - $cgi->a({-href => "$my_uri?p=$project;a=shortlog;h=$hash;pg=" . ($page+1), -accesskey => "n", -title => "Alt-n"}, "next"); + $cgi->a({-href => esc("$my_uri?p=$project;a=shortlog;h=$hash;pg=" . ($page+1)), -accesskey => "n", -title => "Alt-n"}, "next"); } else { print " ⋅ next"; } print "
\n" . "
\n"; print "
\n" . - $cgi->a({-href => "$my_uri?p=$project;a=summary", -class => "title"}, " ") . + $cgi->a({-href => esc("$my_uri?p=$project;a=summary"), -class => "title"}, " ") . "
\n"; print "
$co{'age_string_date'}" . escapeHTML(chop_str($co{'author_name'}, 15, 5)) . "" . - $cgi->a({-href => "$my_uri?p=$project;a=commit;h=$co{'id'}", -class => "list"}, "" . escapeHTML(chop_str($co{'title'}, 50)) . "
"); + $cgi->a({-href => esc("$my_uri?p=$project;a=commit;h=$co{'id'}"), -class => "list"}, "" . escapeHTML(chop_str($co{'title'}, 50)) . "
"); my $comment = $co{'comment'}; foreach my $line (@$comment) { if ($line =~ m/^(.*)($searchtext)(.*)$/i) { @@ -2149,8 +2157,8 @@ sub git_search { } print "		" . - $cgi->a({-href => "$my_uri?p=$project;a=commit;h=$co{'id'}"}, "commit") . - " | " . $cgi->a({-href => "$my_uri?p=$project;a=tree;h=$co{'tree'};hb=$co{'id'}"}, "tree"); + $cgi->a({-href => esc("$my_uri?p=$project;a=commit;h=$co{'id'}")}, "commit") . + " | " . $cgi->a({-href => esc("$my_uri?p=$project;a=tree;h=$co{'tree'};hb=$co{'id'}")}, "tree"); print "
$co{'age_string_date'}" . escapeHTML(chop_str($co{'author_name'}, 15, 5)) . "" . - $cgi->a({-href => "$my_uri?p=$project;a=commit;h=$co{'id'}", -class => "list"}, "" . + $cgi->a({-href => esc("$my_uri?p=$project;a=commit;h=$co{'id'}"), -class => "list"}, "" . escapeHTML(chop_str($co{'title'}, 50)) . "
"); while (my $setref = shift @files) { my %set = %$setref; - print $cgi->a({-href => "$my_uri?p=$project;a=blob;h=$set{'id'};hb=$co{'id'};f=$set{'file'}", class => "list"}, + print $cgi->a({-href => esc("$my_uri?p=$project;a=blob;h=$set{'id'};hb=$co{'id'};f=$set{'file'}"), class => "list"}, "" . escapeHTML($set{'file'}) . "") . "
\n"; } print "		" . - $cgi->a({-href => "$my_uri?p=$project;a=commit;h=$co{'id'}"}, "commit") . - " | " . $cgi->a({-href => "$my_uri?p=$project;a=tree;h=$co{'tree'};hb=$co{'id'}"}, "tree"); + $cgi->a({-href => esc("$my_uri?p=$project;a=commit;h=$co{'id'}")}, "commit") . + " | " . $cgi->a({-href => esc("$my_uri?p=$project;a=tree;h=$co{'tree'};hb=$co{'id'}")}, "tree"); print "
\n"; my $alternate = 0; @@ -2271,23 +2279,23 @@ sub git_shortlog { "\n" . "\n" . "\n" . ""; } if ($#revlist >= (100 * ($page+1)-1)) { print "\n" . "\n" . "\n"; } -- 2.30.2
" . escapeHTML(chop_str($co{'author_name'}, 10)) . ""; if (length($co{'title_short'}) < length($co{'title'})) { - print $cgi->a({-href => "$my_uri?p=$project;a=commit;h=$commit", -class => "list", -title => "$co{'title'}"}, + print $cgi->a({-href => esc("$my_uri?p=$project;a=commit;h=$commit"), -class => "list", -title => "$co{'title'}"}, "" . escapeHTML($co{'title_short'}) . ""); } else { - print $cgi->a({-href => "$my_uri?p=$project;a=commit;h=$commit", -class => "list"}, + print $cgi->a({-href => esc("$my_uri?p=$project;a=commit;h=$commit"), -class => "list"}, "" . escapeHTML($co{'title_short'}) . ""); } print "" . - $cgi->a({-href => "$my_uri?p=$project;a=commit;h=$commit"}, "commit") . - " | " . $cgi->a({-href => "$my_uri?p=$project;a=commitdiff;h=$commit"}, "commitdiff") . + $cgi->a({-href => esc("$my_uri?p=$project;a=commit;h=$commit")}, "commit") . + " | " . $cgi->a({-href => esc("$my_uri?p=$project;a=commitdiff;h=$commit")}, "commitdiff") . "
" . - $cgi->a({-href => "$my_uri?p=$project;a=shortlog;h=$hash;pg=" . ($page+1), -title => "Alt-n"}, "next") . + $cgi->a({-href => esc("$my_uri?p=$project;a=shortlog;h=$hash;pg=" . ($page+1)), -title => "Alt-n"}, "next") . "