From: martin f. krafft <madduck@madduck.net>
Date: Sun, 20 Apr 2008 21:23:38 +0000 (+0200)
Subject: Escape project names before creating pathinfo URLs
X-Git-Tag: v1.5.5.2~28
X-Git-Url: https://git.lorimer.id.au/gitweb.git/diff_plain/85d17a123ba59b90744e311e40f80fd8838fbdc5?hp=--cc

Escape project names before creating pathinfo URLs

If a project name contains special URL characters like +, gitweb's links
break in subtle ways. The solution is to pass the project name through
esc_url() and using the return value.

Signed-off-by: martin f. krafft <madduck@madduck.net>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
---

85d17a123ba59b90744e311e40f80fd8838fbdc5
diff --git a/gitweb/gitweb.perl b/gitweb/gitweb.perl
index 4abd7ac1ad..12843a4846 100755
--- a/gitweb/gitweb.perl
+++ b/gitweb/gitweb.perl
@@ -628,7 +628,7 @@ (%)
 	my ($use_pathinfo) = gitweb_check_feature('pathinfo');
 	if ($use_pathinfo) {
 		# use PATH_INFO for project name
-		$href .= "/$params{'project'}" if defined $params{'project'};
+		$href .= "/".esc_url($params{'project'}) if defined $params{'project'};
 		delete $params{'project'};
 
 		# Summary just uses the project path URL
@@ -2570,7 +2570,7 @@ sub git_header_html {
 		my $action = $my_uri;
 		my ($use_pathinfo) = gitweb_check_feature('pathinfo');
 		if ($use_pathinfo) {
-			$action .= "/$project";
+			$action .= "/".esc_url($project);
 		} else {
 			$cgi->param("p", $project);
 		}