Escape project names before creating pathinfo URLs

[Gitweb] / gitweb.perl

diff --git a/gitweb.perl b/gitweb.perl
index 2cb6bc5a16dbd39cd2d02c8575f9841986bc18ec12e60ea51a2eeae500386517..fea92daf6420dd92849b0f11c566210b912259800e885a465209c1dc2cc0fa53 100755 (executable)
--- a/gitweb.perl
+++ b/gitweb.perl
@@ -634,7 +634,7 @@ sub href(%) {
        my ($use_pathinfo) = gitweb_check_feature('pathinfo');
        if ($use_pathinfo) {
                # use PATH_INFO for project name
-               $href .= "/$params{'project'}" if defined $params{'project'};
+               $href .= "/".esc_url($params{'project'}) if defined $params{'project'};
                delete $params{'project'};
 
                # Summary just uses the project path URL
@@ -2576,7 +2576,7 @@ EOF
                my $action = $my_uri;
                my ($use_pathinfo) = gitweb_check_feature('pathinfo');
                if ($use_pathinfo) {
-                       $action .= "/$project";
+                       $action .= "/".esc_url($project);
                } else {
                        $cgi->param("p", $project);
                }