Escape project names before creating pathinfo URLs
If a project name contains special URL characters like +, gitweb's links break in subtle ways. The solution is to pass the project name through esc_url() and using the return value. Signed-off-by: martin f. krafft <madduck@madduck.net> Signed-off-by: Junio C Hamano <gitster@pobox.com>
martin f. krafft committed
Apr 20, 2008 at 23:23 UTC
85d17a123ba59b90744e311e40f80fd8838fbdc5
1 file changed
+2
-2
gitweb/gitweb.perl
+2
-2
@@ -628,7 +628,7 @@ sub href(%) {
628
my ($use_pathinfo) = gitweb_check_feature('pathinfo');
629
if ($use_pathinfo) {
630
# use PATH_INFO for project name
631
- $href .= "/$params{'project'}" if defined $params{'project'};
631
+ $href .= "/".esc_url($params{'project'}) if defined $params{'project'};
632
delete $params{'project'};
633
634
# Summary just uses the project path URL
@@ -2570,7 +2570,7 @@ EOF
2570
my $action = $my_uri;
2571
my ($use_pathinfo) = gitweb_check_feature('pathinfo');
2572
if ($use_pathinfo) {
2573
- $action .= "/$project";
2573
+ $action .= "/".esc_url($project);
2574
} else {
2575
$cgi->param("p", $project);
2576
}