mirrors/git
0
0
Fork 0
mirror of https://github.com/git/git.git synced 2024-11-24 02:17:02 +08:00
Code Issues Packages Projects Releases Wiki Activity

gitweb: Fix displaying unchopped argument in chop_and_escape_str

Browse Source 
Do not use esc_html to escape [title] _attribute_ of a HTML element,
and quote unprintable characters.  Replace unprintable characters by
'?' and use CGI method to generate HTML element and do the escaping.

This caused bug noticed by Martin Koegler,
  Message-ID: <20080216130037.GA14571@auto.tuwien.ac.at>
that for bad commit encoding in author name, the title attribute (here
to show full, not shortened name) had embedded HTML code in it, result
of quoting unprintable characters the gitweb/HTML way. This of course
broke the HTML, causing page being not displayed in XML validating web
browsers.

Signed-off-by: Jakub Narebski <jnareb@gmail.com>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
This commit is contained in:
Jakub Narebski 2008-02-16 23:07:46 +01:00 committed by Junio C Hamano
parent 508e84a790
commit 850b90a51d
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
gitweb/gitweb.perl
View File

@ -866,8 +866,8 @@ sub chop_and_escape_str {
if ($chopped eq $str) {
return esc_html($chopped);
} else {
return qq{<span title="} . esc_html($str) . qq{">} .
esc_html($chopped) . qq{</span>};
$str =~ s/([[:cntrl:]])/?/g;
return $cgi->span({-title=>$str}, esc_html($chopped));
}
}