mirror of
https://github.com/git/git
synced 2024-08-27 19:49:21 +00:00
gitweb: Don't escape attributes in CGI.pm HTML methods
There is no need to escape HTML tag's attributes in CGI.pm HTML methods (like CGI::a()), because CGI.pm does attribute escaping automatically. $cgi->a({ ... -attribute => atribute_value }, tag_contents) is translated to <a ... attribute="attribute_value">tag_contents</a> The rules for escaping attribute values (which are string contents) are different. For example you have to take care about escaping embedded '"' and "'" characters; CGI::a() does that for us automatically. CGI::a() does not HTML escape tag_contents; we would need to write <a href="URL">some <b>bold</b> text</a> for example. So we use esc_html (or esc_path) to escape tag_contents as needed. Signed-off-by: Jakub Narebski <jnareb@gmail.com> Signed-off-by: Junio C Hamano <junkio@cox.net>
This commit is contained in:
parent
c390ae97be
commit
edc04e90f5
|
@ -1974,17 +1974,17 @@ sub git_print_page_path {
|
||||||
$fullname .= ($fullname ? '/' : '') . $dir;
|
$fullname .= ($fullname ? '/' : '') . $dir;
|
||||||
print $cgi->a({-href => href(action=>"tree", file_name=>$fullname,
|
print $cgi->a({-href => href(action=>"tree", file_name=>$fullname,
|
||||||
hash_base=>$hb),
|
hash_base=>$hb),
|
||||||
-title => esc_html($fullname)}, esc_path($dir));
|
-title => $fullname}, esc_path($dir));
|
||||||
print " / ";
|
print " / ";
|
||||||
}
|
}
|
||||||
if (defined $type && $type eq 'blob') {
|
if (defined $type && $type eq 'blob') {
|
||||||
print $cgi->a({-href => href(action=>"blob_plain", file_name=>$file_name,
|
print $cgi->a({-href => href(action=>"blob_plain", file_name=>$file_name,
|
||||||
hash_base=>$hb),
|
hash_base=>$hb),
|
||||||
-title => esc_html($name)}, esc_path($basename));
|
-title => $name}, esc_path($basename));
|
||||||
} elsif (defined $type && $type eq 'tree') {
|
} elsif (defined $type && $type eq 'tree') {
|
||||||
print $cgi->a({-href => href(action=>"tree", file_name=>$file_name,
|
print $cgi->a({-href => href(action=>"tree", file_name=>$file_name,
|
||||||
hash_base=>$hb),
|
hash_base=>$hb),
|
||||||
-title => esc_html($name)}, esc_path($basename));
|
-title => $name}, esc_path($basename));
|
||||||
print " / ";
|
print " / ";
|
||||||
} else {
|
} else {
|
||||||
print esc_path($basename);
|
print esc_path($basename);
|
||||||
|
|
Loading…
Reference in a new issue