From: Junio C Hamano <gitster@pobox.com>
Date: Wed, 10 Aug 2016 18:55:30 +0000 (-0700)
Subject: Merge branch 'ab/gitweb-link-html-escape' into maint
X-Git-Tag: v2.9.3~11
X-Git-Url: https://git.lorimer.id.au/gitweb.git/diff_plain/1dc4aa67d615afa1f3fc0b19a873a68ba6ab3da8?hp=85b2ea29e83bc66a25cd44ddb1305ff2e6b985a8

Merge branch 'ab/gitweb-link-html-escape' into maint

The characters in the label shown for tags/refs for commits in
"gitweb" output are now properly escaped for proper HTML output.

* ab/gitweb-link-html-escape:
gitweb: escape link body in format_ref_marker
---

diff --git a/gitweb/gitweb.perl b/gitweb/gitweb.perl
index 2fddf750fa..33d701d852 100755
--- a/gitweb/gitweb.perl
+++ b/gitweb/gitweb.perl
@@ -2090,7 +2090,7 @@ sub format_ref_marker {
 				-href => href(
 					action=>$dest_action,
 					hash=>$dest
-				)}, $name);
+				)}, esc_html($name));
 
 			$markers .= " <span class=\"".esc_attr($class)."\" title=\"".esc_attr($ref)."\">" .
 				$link . "</span>";