Escape project names before creating pathinfo URLs

If a project name contains special URL characters like +, gitweb's links
break in subtle ways. The solution is to pass the project name through
esc_url() and using the return value.

Signed-off-by: martin f. krafft <madduck@madduck.net>
Signed-off-by: Junio C Hamano <gitster@pobox.com>

diff --git a/gitweb/gitweb.perl b/gitweb/gitweb.perl
index 4abd7ac1adae1bb166d239e5efe75bebaf8110d7..12843a4846563842aef8f0311096794ad70011c3 100755 (executable)
--- a/gitweb/gitweb.perl
+++ b/gitweb/gitweb.perl
@@ -628,7 +628,7 @@ (%)
        my ($use_pathinfo) = gitweb_check_feature('pathinfo');
        if ($use_pathinfo) {
                # use PATH_INFO for project name
        my ($use_pathinfo) = gitweb_check_feature('pathinfo');
        if ($use_pathinfo) {
                # use PATH_INFO for project name

-               $href .= "/$params{'project'}" if defined $params{'project'};
+               $href .= "/".esc_url($params{'project'}) if defined $params{'project'};

                delete $params{'project'};
 
                # Summary just uses the project path URL
                delete $params{'project'};
 
                # Summary just uses the project path URL


@@ -2570,7 +2570,7 @@ sub git_header_html {
                my $action = $my_uri;
                my ($use_pathinfo) = gitweb_check_feature('pathinfo');
                if ($use_pathinfo) {
                my $action = $my_uri;
                my ($use_pathinfo) = gitweb_check_feature('pathinfo');
                if ($use_pathinfo) {

-                       $action .= "/$project";
+                       $action .= "/".esc_url($project);

                } else {
                        $cgi->param("p", $project);
                }
                } else {
                        $cgi->param("p", $project);
                }