Re: gitweb-projects

From: Jakub Narebski <jnareb@gmail.com>
Date: Aug 24, 2007, 07:35 UTC
Message-ID: <200708240935.59089.jnareb@gmail.com>
In-Reply-To: <9e4733910708231711o71aa3953i349bce96c5eee8f0@mail.gmail.com>

On Fri, 24 August 2007, Jon Smirl wrote:

Show 10 quoted lines

> On 8/23/07, Jakub Narebski <jnareb@gmail.com> wrote:
>> [Cc: Jon Smirl <jonsmirl@gmail.com>, git@vger.kernel.org]
>>
>> Jon Smirl wrote:
>>
>>> What is the magic incantation for encoding an email address along with
>>> the project owner name? From the source I see these strings need to be
>>> URL encoded (it doesn't seem to be in the doc)
>>
>> It is mentioned in gitweb/INSTALL, in the "Gitweb repositories" section

...and in the same file it is mentioned how to generate this file from directory structure of repositories using gitweb, BTW.

>>> but now I'm getting XML errors.
>>>
>>> I tried this:
>>> mpc5200b.git Jon+Smirl+%3Cjonsmirl%2664%3Bgmail.com%3E

I think you don't need to escape '<', '>' and '@' here. The problem was not with URL-escaping (or unescaping) the source, i.e. projects list (projects index) file, but with proper HTML escaping when writing it out: see patch below.

It would be enough to use

mpc5200b.git Jon+Smirl+<jonsmirl@gmail.com>

Show 5 quoted lines

>> I guess that this might have nothing to do with URL-encoding of projects
>> index file, but with proper escaping in the gitweb, i.e. the string is
>> not wrapped in esc_html.
>>
>> In other words, it is a bug in the gitweb.

Please check if the patch below fixes your problem.

Show 9 quoted lines

>>> Does this string really need to be URL encoded? Couldn't you split on
>>> the first space and then url encode it in the perl code? That would
>>> let me write the string in English instead of geek.
>>>
>>> mpc5200b.git Jon Smirl <jonsmirl@gmail.com>
>>
>> Not possible, as path to repository can contain spaces.
> 
> How about using a comma to separate them? Or let me quote the string?

The problem is that path to repository part can contain _any_ characters except '\0'. The quoting would work, but splitting into path part (which might need quoting) and owner part (which might also need quoting) is non-trivial.

BTW. the URL-escaping is from original gitweb...

-- >8 --
From: Jakub Narebski <jnareb@gmail.com>
Date: Fri, 24 Aug 2007 09:12:16 +0200
Subject: [PATCH] gitweb: Fix escaping HTML of project owner in 'projects_list' and 'summary' views

This for example allows to put email address in the project owner field in the projects index file (when $projects_list points to file, and not directory), in the form of:

path/to/repo.git Random+J+Developer+<random@developer.example.org>

Signed-off-by: Jakub Narebski <jnareb@gmail.com>
---
 gitweb/gitweb.perl |    4 ++--
 1 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/gitweb/gitweb.perl b/gitweb/gitweb.perl
index f282a67..9bee68e 100755
--- a/gitweb/gitweb.perl
+++ b/gitweb/gitweb.perl
@@ -3422,7 +3422,7 @@ sub git_project_list_body {
 		      "<td>" . $cgi->a({-href => href(project=>$pr->{'path'}, action=>"summary"),
 		                        -class => "list", -title => $pr->{'descr_long'}},
 		                        esc_html($pr->{'descr'})) . "</td>\n" .
-		      "<td><i>" . chop_str($pr->{'owner'}, 15) . "</i></td>\n";
+		      "<td><i>" . esc_html(chop_str($pr->{'owner'}, 15)) . "</i></td>\n";
 		print "<td class=\"". age_class($pr->{'age'}) . "\">" .
 		      (defined $pr->{'age_string'} ? $pr->{'age_string'} : "No commits") . "</td>\n" .
 		      "<td class=\"link\">" .
@@ -3798,7 +3798,7 @@ sub git_summary {
 	print "<div class=\"title\">&nbsp;</div>\n";
 	print "<table cellspacing=\"0\">\n" .
 	      "<tr><td>description</td><td>" . esc_html($descr) . "</td></tr>\n" .
-	      "<tr><td>owner</td><td>$owner</td></tr>\n";
+	      "<tr><td>owner</td><td>" . esc_html($owner) . "</td></tr>\n";
 	if (defined $cd{'rfc2822'}) {
 		print "<tr><td>last change</td><td>$cd{'rfc2822'}</td></tr>\n";
 	}

-- 
1.5.2.5