gitweb: esc_html (short) error message in die_error
The error message (second argument to die_error) is meant to be short, one-line text description of given error. A few callers call die_error with error message containing unescaped user supplied data ($hash, $file_name). Instead of forcing callers to escape data, simply call esc_html on the parameter. Note that optional third parameter, which contains detailed error description, is meant to be HTML formatted, and therefore should be not escaped. While at it update esc_html synopsis/usage, and bring default error description to read 'Internal Server Error' (titlecased). Signed-off-by: Jakub Narebski <jnareb@gmail.com> Signed-off-by: Junio C Hamano <gitster@pobox.com>
Jakub Narebski committed
Feb 7, 2010 at 21:51 UTC
453541fcfcbc54aa3b0035667e5d5885d407d0a5
1 file changed
+2
-2
gitweb/gitweb.perl
+2
-2
@@ -3372,7 +3372,7 @@ sub git_footer_html {
3372
"</html>";
3373
}
3374
3375
-# die_error(<http_status_code>, <error_message>)
3375
+# die_error(<http_status_code>, <error_message>[, <detailed_html_description>])
3376
# Example: die_error(404, 'Hash not found')
3377
# By convention, use the following status codes (as defined in RFC 2616):
3378
# 400: Invalid or missing CGI parameters, or
@@ -3387,7 +3387,7 @@ sub git_footer_html {
3387
# or down for maintenance). Generally, this is a temporary state.
3388
sub die_error {
3389
my $status = shift || 500;
3390
- my $error = shift || "Internal server error";
3390
+ my $error = esc_html(shift || "Internal Server Error");
3391
my $extra = shift;
3392
3393
my %http_responses = (