From: David Symonds <dsymonds@gmail.com>
Date: Sun, 21 Oct 2007 04:29:16 GMT
Subject: Re: [PATCH] gitweb: Provide title attributes for abbreviated author names.
Message-ID: <ee77f5c20710202129t7f60aebbib24d91ba360f64a2@mail.gmail.com>
In-Reply-To: <20071021032533.GA30717@spearce.org>

On 21/10/2007, Shawn O. Pearce <spearce@spearce.org> wrote:
> Nice, but...
>
> David Symonds <dsymonds@gmail.com> wrote:
> > +++ b/gitweb/gitweb.perl
> > @@ -3461,9 +3461,15 @@ sub git_shortlog_body {
> >                       print "<tr class=\"light\">\n";
> >               }
> >               $alternate ^= 1;
> > +             my $author = chop_str($co{'author_name'}, 10);
> > +             if ($author ne $co{'author_name'}) {
> > +                     $author = "<span title=\"$co{'author_name'}\">" . esc_html($author) . "</span>";
>
> Doesn't this produce invalid HTML if $co{'author_name'} has a special
> HTML character in it such as & or "?  Note that " is much more likely
> as it is often used for nicknames.  The old code properly escaped
> the author name, and indeed you are doing it for the abbreviated
> version but not the full version.

Sure, I'll fix it up and resend. I might even refactor some code at
the same time.


Dave.