Escape project names before creating pathinfo URLs
authormartin f. krafft <madduck@madduck.net>
Sun, 20 Apr 2008 21:23:38 +0000 (23:23 +0200)
committerJunio C Hamano <gitster@pobox.com>
Tue, 22 Apr 2008 06:30:55 +0000 (23:30 -0700)
If a project name contains special URL characters like +, gitweb's links
break in subtle ways. The solution is to pass the project name through
esc_url() and using the return value.

Signed-off-by: martin f. krafft <madduck@madduck.net>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
gitweb/gitweb.perl

index 4abd7ac..12843a4 100755 (executable)
@@ -628,7 +628,7 @@ sub href(%) {
        my ($use_pathinfo) = gitweb_check_feature('pathinfo');
        if ($use_pathinfo) {
                # use PATH_INFO for project name
-               $href .= "/$params{'project'}" if defined $params{'project'};
+               $href .= "/".esc_url($params{'project'}) if defined $params{'project'};
                delete $params{'project'};
 
                # Summary just uses the project path URL
@@ -2570,7 +2570,7 @@ EOF
                my $action = $my_uri;
                my ($use_pathinfo) = gitweb_check_feature('pathinfo');
                if ($use_pathinfo) {
-                       $action .= "/$project";
+                       $action .= "/".esc_url($project);
                } else {
                        $cgi->param("p", $project);
                }