gitweb: fix over-eager application of esc_html().

Contents of %diffinfo hash should be quoted upon output but kept
unquoted internally.  Later users of this hash expect filenames
to be filenames, not HTML gibberish.

Signed-off-by: Petr Baudis <redacted>
Signed-off-by: Junio C Hamano <redacted>

diff --git a/gitweb.perl b/gitweb.perl
index 0f4c1c3ab15f8146058e11e4dfc29c8b019aec6265b2825760ef2f47f755eb9c..9c984dc9361d3c541cfa17a1e57511d31c1b46aba21b84c71dcd7f06b9efc72e 100755 (executable)
--- a/gitweb.perl
+++ b/gitweb.perl
@@ -3062,12 +3062,12 @@ sub git_blobdiff {
                if (defined $file_name) {
                        if (defined $file_parent) {
                                $diffinfo{'status'} = '2';
-                               $diffinfo{'from_file'} = esc_html($file_parent);
-                               $diffinfo{'to_file'}   = esc_html($file_name);
+                               $diffinfo{'from_file'} = $file_parent;
+                               $diffinfo{'to_file'}   = $file_name;
                        } else { # assume not renamed
                                $diffinfo{'status'} = '1';
-                               $diffinfo{'from_file'} = esc_html($file_name);
-                               $diffinfo{'to_file'}   = esc_html($file_name);
+                               $diffinfo{'from_file'} = $file_name;
+                               $diffinfo{'to_file'}   = $file_name;
                        }
                } else { # no filename given
                        $diffinfo{'status'} = '2';
@@ -3136,8 +3136,8 @@ sub git_blobdiff {
 
        } else {
                while (my $line = <$fd>) {
-                       $line =~ s!a/($hash|$hash_parent)!a/$diffinfo{'from_file'}!g;
-                       $line =~ s!b/($hash|$hash_parent)!b/$diffinfo{'to_file'}!g;
+                       $line =~ s!a/($hash|$hash_parent)!'a/'.esc_html($diffinfo{'from_file'})!eg;
+                       $line =~ s!b/($hash|$hash_parent)!'b/'.esc_html($diffinfo{'to_file'})!eg;
 
                        print $line;