[PATCH] gitweb: escape searchtext and parameters for replay

From: Michael J Gruber <git@drmicha.warpmail.net>
Date: Apr 29, 2009, 11:44 UTC
Message-ID: <1241005459-17311-1-git-send-email-git@drmicha.warpmail.net>
In-Reply-To: <337ECD47-D343-40F2-9E41-9E7D8531C5DF@aepfle.de>

Search texts may very likely include characters like '@' when grepping for author names. Currently, gitweb produces first/prev/next links with incorrectly escaped characters.

Make gitweb escape searchtext and parameters which are reused in href() when replay is set. (cgi params are de-escaped when put into the parameter dictionary and need to be re-escaped when reused.)

Signed-off-by: Michael J Gruber <git@drmicha.warpmail.net>
---
Maybe something like this? Highly untested!

Cheers, Michael

 gitweb/gitweb.perl |    4 ++--
 1 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/gitweb/gitweb.perl b/gitweb/gitweb.perl
index 3f99361..e1b09f8 100755
--- a/gitweb/gitweb.perl
+++ b/gitweb/gitweb.perl
@@ -848,7 +848,7 @@ sub href (%) {
 	if ($params{-replay}) {
 		while (my ($name, $symbol) = each %cgi_param_mapping) {
 			if (!exists $params{$name}) {
-				$params{$name} = $input_params{$name};
+				$params{$name} = esc_url($input_params{$name});
 			}
 		}
 	}
@@ -5775,7 +5775,7 @@ sub git_search {
 		if ($page > 0) {
 			$paging_nav .=
 				$cgi->a({-href => href(action=>"search", hash=>$hash,
-				                       searchtext=>$searchtext,
+				                       searchtext=>esc_url($searchtext),
 				                       searchtype=>$searchtype)},
 				        "first");
 			$paging_nav .= " &sdot; " .

-- 
1.6.3.rc3