fix typo in link parameter of git_commit

diff --git a/gitweb.cgi b/gitweb.cgi
index 0d22d328fc62170eed35d1a26a6d5941e3de95fb..acf1b1ab96eeae9444dd4476e5543c73d5f3397b 100755 (executable)
--- a/gitweb.cgi
+++ b/gitweb.cgi
@@ -15,7 +15,7 @@ use CGI::Carp qw(fatalsToBrowser);
 use Fcntl ':mode';
 
 my $cgi = new CGI;
-my $version =          "242";
+my $version =          "243";
 my $my_url =           $cgi->url();
 my $my_uri =           $cgi->url(-absolute => 1);
 my $rss_link = "";
@@ -43,7 +43,7 @@ my $projects_list = "index/index.aux";
 # input validation and dispatch
 my $action = $cgi->param('a');
 if (defined $action) {
-       if ($action =~ m/[^0-9a-zA-Z\.\-_]+/) {
+       if ($action =~ m/[^0-9a-zA-Z\.\-_]/) {
                undef $action;
                die_error(undef, "Invalid action parameter.");
        }
@@ -58,7 +58,7 @@ if (defined $action) {
 
 my $order = $cgi->param('o');
 if (defined $order) {
-       if ($order =~ m/[^a-zA-Z0-9_]/) {
+       if ($order =~ m/[^0-9a-zA-Z_]/) {
                undef $order;
                die_error(undef, "Invalid order parameter.");
        }
@@ -66,13 +66,9 @@ if (defined $order) {
 
 my $project = $cgi->param('p');
 if (defined $project) {
-       if ($project =~ m/(^|\/)(|\.|\.\.)($|\/)/) {
-               undef $project;
-               die_error(undef, "Non-canonical project parameter.");
-       }
-       if ($project =~ m/[^a-zA-Z0-9_\.\/\-\+\#\~]/) {
-               undef $project;
-               die_error(undef, "Invalid character in project parameter.");
+       $project = validate_input($project);
+       if (!defined($project)) {
+               die_error(undef, "Invalid project parameter.");
        }
        if (!(-d "$projectroot/$project")) {
                undef $project;
@@ -91,54 +87,39 @@ if (defined $project) {
 
 my $file_name = $cgi->param('f');
 if (defined $file_name) {
-       if ($file_name =~ m/(^|\/)(|\.|\.\.)($|\/)/) {
-               undef $file_name;
-               die_error(undef, "Non-canonical file parameter.");
-       }
-       if ($file_name =~ m/[^a-zA-Z0-9_\.\/\-\+\#\~\:\!]/) {
-               undef $file_name;
-               die_error(undef, "Invalid character in file parameter.");
+       $file_name = validate_input($file_name);
+       if (!defined($file_name)) {
+               die_error(undef, "Invalid file parameter.");
        }
 }
 
 my $hash = $cgi->param('h');
 if (defined $hash) {
-       if (!($hash =~ m/^[0-9a-fA-F]{40}$/)) {
-               if ($hash =~ m/(^|\/)(|\.|\.\.)($|\/)/) {
-                       undef $hash;
-                       die_error(undef, "Non-canonical hash parameter.");
-               }
-               if ($hash =~ m/[^a-zA-Z0-9_\.\/\-\+\#\~\:\!]/) {
-                       undef $hash;
-                       die_error(undef, "Invalid character in hash parameter.");
-               }
-               # replace branch-name with hash
-               my $branchlist = git_read_refs("refs/heads");
-               foreach my $entry (@$branchlist) {
-                       my %branch = %$entry;
-                       if ($branch{'name'} eq $hash) {
-                               $hash = $branch{'id'};
-                               last;
-                       }
-               }
+       $hash = validate_input($hash);
+       if (!defined($hash)) {
+               die_error(undef, "Invalid hash parameter.");
        }
 }
 
 my $hash_parent = $cgi->param('hp');
-if (defined $hash_parent && !($hash_parent =~ m/^[0-9a-fA-F]{40}$/)) {
-       undef $hash_parent;
-       die_error(undef, "Invalid hash_parent parameter.");
+if (defined $hash_parent) {
+       $hash_parent = validate_input($hash_parent);
+       if (!defined($hash_parent)) {
+               die_error(undef, "Invalid hash parent parameter.");
+       }
 }
 
 my $hash_base = $cgi->param('hb');
-if (defined $hash_base && !($hash_base =~ m/^[0-9a-fA-F]{40}$/)) {
-       undef $hash_base;
-       die_error(undef, "Invalid parent hash parameter.");
+if (defined $hash_base) {
+       $hash_base = validate_input($hash_base);
+       if (!defined($hash_base)) {
+               die_error(undef, "Invalid hash base parameter.");
+       }
 }
 
 my $page = $cgi->param('pg');
 if (defined $page) {
-       if ($page =~ m/^[^0-9]+$/) {
+       if ($page =~ m/[^0-9]$/) {
                undef $page;
                die_error(undef, "Invalid page parameter.");
        }
@@ -153,6 +134,21 @@ if (defined $searchtext) {
        $searchtext = quotemeta $searchtext;
 }
 
+sub validate_input {
+       my $input = shift;
+
+       if ($input =~ m/^[0-9a-fA-F]{40}$/) {
+               return $input;
+       }
+       if ($input =~ m/(^|\/)(|\.|\.\.)($|\/)/) {
+               return undef;
+       }
+       if ($input =~ m/[^a-zA-Z0-9_\.\/\-\+\#\~]/) {
+               return undef;
+       }
+       return $input;
+}
+
 if (!defined $action || $action eq "summary") {
        git_summary();
        exit;
@@ -482,7 +478,16 @@ sub git_read_commit {
        if (!defined $co{'tree'}) {
                return undef
        };
-       $co{'id'} = $commit_id;
+       if (!($commit_id =~ m/^[0-9a-fA-F]{40}$/)) {
+               # lookup hash by textual id
+               open my $fd, "-|", "$gitbin/git-rev-parse --verify $commit_id" or return;
+               my $hash_id = <$fd>;
+               close $fd or return;
+               chomp $hash_id;
+               $co{'id'} = $hash_id
+       } else {
+               $co{'id'} = $commit_id;
+       }
        $co{'parents'} = \@parents;
        $co{'parent'} = $parents[0];
        $co{'comment'} = \@commit_lines;
@@ -1634,7 +1639,7 @@ sub git_commit {
              "</tr>\n";
        print "<tr><td>committer</td><td>" . escapeHTML($co{'committer'}) . "</td></tr>\n";
        print "<tr><td></td><td> $cd{'rfc2822'}" . sprintf(" (%02d:%02d %s)", $cd{'hour_local'}, $cd{'minute_local'}, $cd{'tz_local'}) . "</td></tr>\n";
-       print "<tr><td>commit</td><td style=\"font-family:monospace\">$hash</td></tr>\n";
+       print "<tr><td>commit</td><td style=\"font-family:monospace\">$co{'id'}</td></tr>\n";
        print "<tr>" .
              "<td>tree</td>" .
              "<td style=\"font-family:monospace\">" .
@@ -1711,7 +1716,7 @@ sub git_commit {
                                $mode_chng = sprintf(" with mode: %04o", (oct $to_mode) & 0777);
                        }
                        print "<td>" .
-                             $cgi->a({-href => "$my_uri?p=$project;a=blob;h=$to_id;hp=$hash;f=$file", -class => "list"}, escapeHTML($file)) . "</td>\n" .
+                             $cgi->a({-href => "$my_uri?p=$project;a=blob;h=$to_id;hb=$hash;f=$file", -class => "list"}, escapeHTML($file)) . "</td>\n" .
                              "<td><span style=\"color: #008000;\">[new " . file_type($to_mode) . "$mode_chng]</span></td>\n" .
                              "<td class=\"link\">" . $cgi->a({-href => "$my_uri?p=$project;a=blob;h=$to_id;hb=$hash;f=$file"}, "blob") . "</td>\n";
                } elsif ($status eq "D") {