summaryrefslogtreecommitdiff
path: root/gitweb
diff options
context:
space:
mode:
authorJakub Narebski <jnareb@gmail.com>2008-02-16 23:07:46 +0100
committerJunio C Hamano <gitster@pobox.com>2008-02-17 19:29:16 -0800
commit850b90a51d5ed122cee5c2f3ad4c3e513a05259a (patch)
tree5a15a6480b05e5d03616b90c77a93f772e639424 /gitweb
parent508e84a790bef46881459891748727c490d9a673 (diff)
downloadgit-850b90a51d5ed122cee5c2f3ad4c3e513a05259a.tar.gz
gitweb: Fix displaying unchopped argument in chop_and_escape_str
Do not use esc_html to escape [title] _attribute_ of a HTML element, and quote unprintable characters. Replace unprintable characters by '?' and use CGI method to generate HTML element and do the escaping. This caused bug noticed by Martin Koegler, Message-ID: <20080216130037.GA14571@auto.tuwien.ac.at> that for bad commit encoding in author name, the title attribute (here to show full, not shortened name) had embedded HTML code in it, result of quoting unprintable characters the gitweb/HTML way. This of course broke the HTML, causing page being not displayed in XML validating web browsers. Signed-off-by: Jakub Narebski <jnareb@gmail.com> Signed-off-by: Junio C Hamano <gitster@pobox.com>
Diffstat (limited to 'gitweb')
-rwxr-xr-xgitweb/gitweb.perl4
1 files changed, 2 insertions, 2 deletions
diff --git a/gitweb/gitweb.perl b/gitweb/gitweb.perl
index 5e88637b5e..47e3a41346 100755
--- a/gitweb/gitweb.perl
+++ b/gitweb/gitweb.perl
@@ -866,8 +866,8 @@ sub chop_and_escape_str {
if ($chopped eq $str) {
return esc_html($chopped);
} else {
- return qq{<span title="} . esc_html($str) . qq{">} .
- esc_html($chopped) . qq{</span>};
+ $str =~ s/([[:cntrl:]])/?/g;
+ return $cgi->span({-title=>$str}, esc_html($chopped));
}
}