gitweb: Fix escaping HTML of project owner in 'projects_list' and 'summary' views

This for example allows to put email address in the project owner
field in the projects index file (when $projects_list points to
a file, and not to a directory), in the form of:

path/to/repo.git Random+J+Developer+<redacted>

Noticed-by: Jon Smirl <redacted>
Signed-off-by: Jakub Narebski <redacted>
Signed-off-by: Petr Baudis <redacted>
Signed-off-by: Junio C Hamano <redacted>

diff --git a/gitweb.perl b/gitweb.perl
index 0f26ede27e4ac094bd20002c74c67528b143c20161fcd278a09f11d19373dcf5..a9e018073dd4eb897f86fa8a17741864ae443e5c68bb51cb63fb2621695d8a1e 100755 (executable)
--- a/gitweb.perl
+++ b/gitweb.perl
@@ -3420,7 +3420,7 @@ sub git_project_list_body {
                      "<td>" . $cgi->a({-href => href(project=>$pr->{'path'}, action=>"summary"),
                                        -class => "list", -title => $pr->{'descr_long'}},
                                        esc_html($pr->{'descr'})) . "</td>\n" .
                      "<td>" . $cgi->a({-href => href(project=>$pr->{'path'}, action=>"summary"),
                                        -class => "list", -title => $pr->{'descr_long'}},
                                        esc_html($pr->{'descr'})) . "</td>\n" .

-                     "<td><i>" . chop_str($pr->{'owner'}, 15) . "</i></td>\n";
+                     "<td><i>" . esc_html(chop_str($pr->{'owner'}, 15)) . "</i></td>\n";

                print "<td class=\"". age_class($pr->{'age'}) . "\">" .
                      (defined $pr->{'age_string'} ? $pr->{'age_string'} : "No commits") . "</td>\n" .
                      "<td class=\"link\">" .
                print "<td class=\"". age_class($pr->{'age'}) . "\">" .
                      (defined $pr->{'age_string'} ? $pr->{'age_string'} : "No commits") . "</td>\n" .
                      "<td class=\"link\">" .


@@ -3796,7 +3796,7 @@ sub git_summary {
        print "<div class=\"title\">&nbsp;</div>\n";
        print "<table cellspacing=\"0\">\n" .
              "<tr><td>description</td><td>" . esc_html($descr) . "</td></tr>\n" .
        print "<div class=\"title\">&nbsp;</div>\n";
        print "<table cellspacing=\"0\">\n" .
              "<tr><td>description</td><td>" . esc_html($descr) . "</td></tr>\n" .

-             "<tr><td>owner</td><td>$owner</td></tr>\n";
+             "<tr><td>owner</td><td>" . esc_html($owner) . "</td></tr>\n";

        if (defined $cd{'rfc2822'}) {
                print "<tr><td>last change</td><td>$cd{'rfc2822'}</td></tr>\n";
        }
        if (defined $cd{'rfc2822'}) {
                print "<tr><td>last change</td><td>$cd{'rfc2822'}</td></tr>\n";
        }