gitweb: Decode long title for link tooltips

[Gitweb] / gitweb.perl

diff --git a/gitweb.perl b/gitweb.perl
index 63ffdd3e7773917aa5298886fcb7a20a8875f79890341c6e39af2047c441d2d7..a4f13bbfd52a3440b125758b3c32040c117d5fdb3650ca4bb659da07d799a370 100755 (executable)
--- a/gitweb.perl
+++ b/gitweb.perl
@@ -212,19 +212,9 @@ if (defined $project) {
        }
 }
 
+# We have to handle those containing any characters:
 our $file_name = $cgi->param('f');
-if (defined $file_name) {
-       if (!validate_input($file_name)) {
-               die_error(undef, "Invalid file parameter");
-       }
-}
-
 our $file_parent = $cgi->param('fp');
-if (defined $file_parent) {
-       if (!validate_input($file_parent)) {
-               die_error(undef, "Invalid file parent parameter");
-       }
-}
 
 our $hash = $cgi->param('h');
 if (defined $hash) {
@@ -305,7 +295,7 @@ sub evaluate_path_info {
                        $action  ||= "blob_plain";
                }
                $hash_base ||= validate_input($refname);
-               $file_name ||= validate_input($pathname);
+               $file_name ||= $pathname;
        } elsif (defined $refname) {
                # we got "project.git/branch"
                $action ||= "shortlog";
@@ -416,7 +406,7 @@ sub validate_input {
 # correct, but quoted slashes look too horrible in bookmarks
 sub esc_param {
        my $str = shift;
-       $str =~ s/([^A-Za-z0-9\-_.~();\/;?:@&=])/sprintf("%%%02X", ord($1))/eg;
+       $str =~ s/([^A-Za-z0-9\-_.~()\/:@])/sprintf("%%%02X", ord($1))/eg;
        $str =~ s/\+/%2B/g;
        $str =~ s/ /\+/g;
        return $str;
@@ -627,7 +617,7 @@ sub format_subject_html {
 
        if (length($short) < length($long)) {
                return $cgi->a({-href => $href, -class => "list subject",
-                               -title => $long},
+                               -title => decode("utf8", $long, Encode::FB_DEFAULT)},
                       esc_html($short) . $extra);
        } else {
                return $cgi->a({-href => $href, -class => "list subject"},
@@ -1282,7 +1272,7 @@ sub git_header_html {
                if (defined $action) {
                        $title .= "/$action";
                        if (defined $file_name) {
-                               $title .= " - $file_name";
+                               $title .= " - " . esc_html($file_name);
                                if ($action eq "tree" && $file_name !~ m|/$|) {
                                        $title .= "/";
                                }
@@ -1610,48 +1600,45 @@ sub git_print_tree_entry {
        my %base_key = ();
        $base_key{hash_base} = $hash_base if defined $hash_base;
 
+       # The format of a table row is: mode list link.  Where mode is
+       # the mode of the entry, list is the name of the entry, an href,
+       # and link is the action links of the entry.
+
        print "<td class=\"mode\">" . mode_str($t->{'mode'}) . "</td>\n";
        if ($t->{'type'} eq "blob") {
                print "<td class=\"list\">" .
-                     $cgi->a({-href => href(action=>"blob", hash=>$t->{'hash'},
-                                            file_name=>"$basedir$t->{'name'}", %base_key),
-                             -class => "list"}, esc_html($t->{'name'})) .
-                     "</td>\n" .
-                     "<td class=\"link\">" .
-                     $cgi->a({-href => href(action=>"blob", hash=>$t->{'hash'},
-                                            file_name=>"$basedir$t->{'name'}", %base_key)},
-                             "blob");
+                       $cgi->a({-href => href(action=>"blob", hash=>$t->{'hash'},
+                                              file_name=>"$basedir$t->{'name'}", %base_key),
+                                -class => "list"}, esc_html($t->{'name'})) . "</td>\n";
+               print "<td class=\"link\">";
                if ($have_blame) {
-                       print " | " .
-                               $cgi->a({-href => href(action=>"blame", hash=>$t->{'hash'},
-                                                      file_name=>"$basedir$t->{'name'}", %base_key)},
-                                       "blame");
+                       print $cgi->a({-href => href(action=>"blame", hash=>$t->{'hash'},
+                                                    file_name=>"$basedir$t->{'name'}", %base_key)},
+                                     "blame");
                }
                if (defined $hash_base) {
-                       print " | " .
-                             $cgi->a({-href => href(action=>"history", hash_base=>$hash_base,
+                       if ($have_blame) {
+                               print " | ";
+                       }
+                       print $cgi->a({-href => href(action=>"history", hash_base=>$hash_base,
                                                     hash=>$t->{'hash'}, file_name=>"$basedir$t->{'name'}")},
                                      "history");
                }
                print " | " .
                      $cgi->a({-href => href(action=>"blob_plain",
                                             hash=>$t->{'hash'}, file_name=>"$basedir$t->{'name'}")},
-                             "raw") .
-                     "</td>\n";
+                             "raw");
+               print "</td>\n";
 
        } elsif ($t->{'type'} eq "tree") {
-               print "<td class=\"list\">" .
-                     $cgi->a({-href => href(action=>"tree", hash=>$t->{'hash'},
+               print "<td class=\"list\">";
+               print $cgi->a({-href => href(action=>"tree", hash=>$t->{'hash'},
                                             file_name=>"$basedir$t->{'name'}", %base_key)},
-                             esc_html($t->{'name'})) .
-                     "</td>\n" .
-                     "<td class=\"link\">" .
-                     $cgi->a({-href => href(action=>"tree", hash=>$t->{'hash'},
-                                            file_name=>"$basedir$t->{'name'}", %base_key)},
-                             "tree");
+                             esc_html($t->{'name'}));
+               print "</td>\n";
+               print "<td class=\"link\">";
                if (defined $hash_base) {
-                       print " | " .
-                             $cgi->a({-href => href(action=>"history", hash_base=>$hash_base,
+                       print $cgi->a({-href => href(action=>"history", hash_base=>$hash_base,
                                                     file_name=>"$basedir$t->{'name'}")},
                                      "history");
                }
@@ -2430,7 +2417,7 @@ sub git_blame2 {
        if ($ftype !~ "blob") {
                die_error("400 Bad Request", "Object is not a blob");
        }
-       open ($fd, "-|", git_cmd(), "blame", '-l', $file_name, $hash_base)
+       open ($fd, "-|", git_cmd(), "blame", '-l', '--', $file_name, $hash_base)
                or die_error(undef, "Open git-blame failed");
        git_header_html();
        my $formats_nav =
@@ -3126,7 +3113,7 @@ sub git_blobdiff {
                        -type => 'text/plain',
                        -charset => 'utf-8',
                        -expires => $expires,
-                       -content_disposition => qq(inline; filename="${file_name}.patch"));
+                       -content_disposition => qq(inline; filename=") . quotemeta($file_name) . qq(.patch"));
 
                print "X-Git-Url: " . $cgi->self_url() . "\n\n";
 
@@ -3146,8 +3133,8 @@ sub git_blobdiff {
 
        } else {
                while (my $line = <$fd>) {
-                       $line =~ s!a/($hash|$hash_parent)!a/$diffinfo{'from_file'}!g;
-                       $line =~ s!b/($hash|$hash_parent)!b/$diffinfo{'to_file'}!g;
+                       $line =~ s!a/($hash|$hash_parent)!'a/'.esc_html($diffinfo{'from_file'})!eg;
+                       $line =~ s!b/($hash|$hash_parent)!'b/'.esc_html($diffinfo{'to_file'})!eg;
 
                        print $line;
 
@@ -3576,7 +3563,7 @@ XML
                        if (!($line =~ m/^:([0-7]{6}) ([0-7]{6}) ([0-9a-fA-F]{40}) ([0-9a-fA-F]{40}) (.)([0-9]{0,3})\t(.*)$/)) {
                                next;
                        }
-                       my $file = validate_input(unquote($7));
+                       my $file = esc_html(unquote($7));
                        $file = decode("utf8", $file, Encode::FB_DEFAULT);
                        print "$file<br/>\n";
                }