gitweb: Fix escaping HTML of project owner in 'projects_list' and 'summary' views

[Gitweb] / gitweb.perl

diff --git a/gitweb.perl b/gitweb.perl
index 4a8d5e66c9da09efc342d18a20b8fdadd907ce61b45fdb243def0ff15ec5f3b5..a9e018073dd4eb897f86fa8a17741864ae443e5c68bb51cb63fb2621695d8a1e 100755 (executable)
--- a/gitweb.perl
+++ b/gitweb.perl
@@ -472,9 +472,6 @@ if (defined $searchtype) {
 our $searchtext = $cgi->param('s');
 our $search_regexp;
 if (defined $searchtext) {
-       if ($searchtype ne 'grep' and $searchtype ne 'pickaxe' and $searchtext =~ m/[^a-zA-Z0-9_\.\/\-\+\:\@ ]/) {
-               die_error(undef, "Invalid search parameter");
-       }
        if (length($searchtext) < 2) {
                die_error(undef, "At least two characters are required for search parameter");
        }
@@ -630,7 +627,13 @@ sub href(%) {
        for (my $i = 0; $i < @mapping; $i += 2) {
                my ($name, $symbol) = ($mapping[$i], $mapping[$i+1]);
                if (defined $params{$name}) {
-                       push @result, $symbol . "=" . esc_param($params{$name});
+                       if (ref($params{$name}) eq "ARRAY") {
+                               foreach my $par (@{$params{$name}}) {
+                                       push @result, $symbol . "=" . esc_param($par);
+                               }
+                       } else {
+                               push @result, $symbol . "=" . esc_param($params{$name});
+                       }
                }
        }
        $href .= "?" . join(';', @result) if scalar @result;
@@ -1510,6 +1513,7 @@ sub git_get_projects_list {
 
                File::Find::find({
                        follow_fast => 1, # follow symbolic links
+                       follow_skip => 2, # ignore duplicates
                        dangling_symlinks => 0, # ignore dangling symlinks, silently
                        wanted => sub {
                                # skip project-list toplevel, if we get it.
@@ -3416,7 +3420,7 @@ sub git_project_list_body {
                      "<td>" . $cgi->a({-href => href(project=>$pr->{'path'}, action=>"summary"),
                                        -class => "list", -title => $pr->{'descr_long'}},
                                        esc_html($pr->{'descr'})) . "</td>\n" .
-                     "<td><i>" . chop_str($pr->{'owner'}, 15) . "</i></td>\n";
+                     "<td><i>" . esc_html(chop_str($pr->{'owner'}, 15)) . "</i></td>\n";
                print "<td class=\"". age_class($pr->{'age'}) . "\">" .
                      (defined $pr->{'age_string'} ? $pr->{'age_string'} : "No commits") . "</td>\n" .
                      "<td class=\"link\">" .
@@ -3792,7 +3796,7 @@ sub git_summary {
        print "<div class=\"title\">&nbsp;</div>\n";
        print "<table cellspacing=\"0\">\n" .
              "<tr><td>description</td><td>" . esc_html($descr) . "</td></tr>\n" .
-             "<tr><td>owner</td><td>$owner</td></tr>\n";
+             "<tr><td>owner</td><td>" . esc_html($owner) . "</td></tr>\n";
        if (defined $cd{'rfc2822'}) {
                print "<tr><td>last change</td><td>$cd{'rfc2822'}</td></tr>\n";
        }
@@ -5360,7 +5364,7 @@ sub git_feed {
 
        # log/feed of current (HEAD) branch, log of given branch, history of file/directory
        my $head = $hash || 'HEAD';
-       my @commitlist = parse_commits($head, 150);
+       my @commitlist = parse_commits($head, 150, 0, undef, $file_name);
 
        my %latest_commit;
        my %latest_date;