[PATCH] gitweb: Escape attribute in chop_and_escape_str()
- From
Jürgen Kreileder <jk@blackdown.de>
- Date
- Nov 28, 2011, 23:27 UTC
- Message-ID
- <CAKD0UuyOMRFHE6DvuDj0ancfwFfg8ADKab6emv99+FN5RfZ=mQ@mail.gmail.com>
Fixes the title attribute in <span title="Jürgen Kreileder">Jürgen Kreileder</span> for example because to_utf8() is called implicitly now.
(Not sure why the attribute is there at all in the example. From my point of view nothing got chopped.)
Signed-off-by: Juergen Kreileder <jk@blackdown.de> --- gitweb/gitweb.perl | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-)
diff --git a/gitweb/gitweb.perl b/gitweb/gitweb.perl index 4f0c3bd..fd76407 100755 --- a/gitweb/gitweb.perl +++ b/gitweb/gitweb.perl @@ -1699,7 +1699,7 @@ sub chop_and_escape_str { return esc_html($chopped); } else { $str =~ s/[[:cntrl:]]/?/g; - return $cgi->span({-title=>$str}, esc_html($chopped)); + return $cgi->span({-title => esc_attr($str)}, esc_html($chopped)); } }
-- 1.7.5.4