summary refs log tree commit
diff options
context:
space:
mode:
authorJunio C Hamano <gitster@pobox.com>2010-12-15 11:32:57 -0800
committerJunio C Hamano <gitster@pobox.com>2010-12-15 11:32:57 -0800
commitabf411e28d9df669b0e690578a1eb95c0bd29847 (patch)
tree765c8424399d79902351f3fefc68b4dcfc57b53b
parentad336054068074ed614d0bb54bb169e5263499d7 (diff)
parentec82874ad47627a44b6b22a6645551a214293711 (diff)
Signed-off-by: Junio C Hamano <gitster@pobox.com>
-rw-r--r--Documentation/RelNotes/1.6.4.5.txt20
-rw-r--r--Documentation/RelNotes/1.6.5.9.txt18
-rw-r--r--Documentation/RelNotes/1.6.6.3.txt23
-rwxr-xr-xGIT-VERSION-GEN2
l---------RelNotes2
-rwxr-xr-xgitweb/gitweb.perl42
6 files changed, 88 insertions, 19 deletions
diff --git a/Documentation/RelNotes/1.6.4.5.txt b/Documentation/RelNotes/1.6.4.5.txt
new file mode 100644
index 0000000000..eb6307dcbb
--- /dev/null
+++ b/Documentation/RelNotes/1.6.4.5.txt
@@ -0,0 +1,20 @@
+Git v1.6.4.5 Release Notes
+==========================
+
+Fixes since v1.6.4.4
+--------------------
+
+ * Simplified base85 implementation.
+
+ * An overlong line after ".gitdir: " in a git file caused out of bounds
+   access to an array on the stack.
+
+ * "git count-objects" did not handle packs larger than 4G.
+
+ * "git rev-parse --parseopt --stop-at-non-option" did not stop at non option
+   when --keep-dashdash was in effect.
+
+ * "gitweb" can sometimes be tricked into parrotting a filename argument
+   given in a request without properly quoting.
+
+Other minor fixes and documentation updates are included.
diff --git a/Documentation/RelNotes/1.6.5.9.txt b/Documentation/RelNotes/1.6.5.9.txt
new file mode 100644
index 0000000000..bb469dd71e
--- /dev/null
+++ b/Documentation/RelNotes/1.6.5.9.txt
@@ -0,0 +1,18 @@
+Git v1.6.5.9 Release Notes
+==========================
+
+Fixes since v1.6.5.8
+--------------------
+
+ * An overlong line after ".gitdir: " in a git file caused out of bounds
+   access to an array on the stack.
+
+ * "git blame -L $start,$end" segfaulted when too large $start was given.
+
+ * "git rev-parse --parseopt --stop-at-non-option" did not stop at non option
+   when --keep-dashdash was in effect.
+
+ * "gitweb" can sometimes be tricked into parrotting a filename argument
+   given in a request without properly quoting.
+
+Other minor fixes and documentation updates are included.
diff --git a/Documentation/RelNotes/1.6.6.3.txt b/Documentation/RelNotes/1.6.6.3.txt
new file mode 100644
index 0000000000..11483acaec
--- /dev/null
+++ b/Documentation/RelNotes/1.6.6.3.txt
@@ -0,0 +1,23 @@
+Git v1.6.6.3 Release Notes
+==========================
+
+Fixes since v1.6.6.2
+--------------------
+
+ * An overlong line after ".gitdir: " in a git file caused out of bounds
+   access to an array on the stack.
+
+ * "git bisect $path" did not correctly diagnose an error when given a
+   non-existent path.
+
+ * "git blame -L $start,$end" segfaulted when too large $start was given.
+
+ * "git imap-send" did not write draft box with CRLF line endings per RFC.
+
+ * "git rev-parse --parseopt --stop-at-non-option" did not stop at non option
+   when --keep-dashdash was in effect.
+
+ * "gitweb" can sometimes be tricked into parrotting a filename argument
+   given in a request without properly quoting.
+
+Other minor fixes and documentation updates are included.
diff --git a/GIT-VERSION-GEN b/GIT-VERSION-GEN
index 081be51a9e..7d16b01382 100755
--- a/GIT-VERSION-GEN
+++ b/GIT-VERSION-GEN
@@ -1,7 +1,7 @@
 #!/bin/sh
 
 GVF=GIT-VERSION-FILE
-DEF_VER=v1.6.6.2
+DEF_VER=v1.6.6.3
 
 LF='
 '
diff --git a/RelNotes b/RelNotes
index 692968f170..3dad2389f6 120000
--- a/RelNotes
+++ b/RelNotes
@@ -1 +1 @@
-Documentation/RelNotes-1.6.6.2.txt \ No newline at end of file
+Documentation/RelNotes/1.6.6.3.txt \ No newline at end of file
diff --git a/gitweb/gitweb.perl b/gitweb/gitweb.perl
index 7e477af956..0fe8539321 100755
--- a/gitweb/gitweb.perl
+++ b/gitweb/gitweb.perl
@@ -1137,6 +1137,13 @@ sub esc_url {
         return $str;
 }
 
+# quote unsafe characters in HTML attributes
+sub esc_attr {
+
+        # for XHTML conformance escaping '"' to '&quot;' is not enough
+        return esc_html(@_);
+}
+
 # replace invalid utf8 character with SUBSTITUTION sequence
 sub esc_html {
         my $str = shift;
@@ -1542,7 +1549,7 @@ sub format_ref_marker {
                                         hash=>$dest
                                 )}, $name);
 
-                        $markers .= " <span class=\"$class\" title=\"$ref\">" .
+                        $markers .= " <span class=\"".esc_attr($class)."\" title=\"".esc_attr($ref)."\">" .
                                 $link . "</span>";
                 }
         }
@@ -1626,7 +1633,7 @@ sub git_get_avatar {
                 return $pre_white .
                        "<img width=\"$size\" " .
                             "class=\"avatar\" " .
-                            "src=\"$url\" " .
+                            "src=\"".esc_url($url)."\" " .
                             "alt=\"\" " .
                        "/>" . $post_white;
         } else {
@@ -2335,7 +2342,7 @@ sub git_show_project_tagcloud {
         } else {
                 my @tags = sort { $cloud->{$a}->{count} <=> $cloud->{$b}->{count} } keys %$cloud;
                 return '<p align="center">' . join (', ', map {
-                        "<a href=\"$home_link?by_tag=$_\">$cloud->{$_}->{topname}</a>"
+                        $cgi->a({-href=>"$home_link?by_tag=$_"}, $cloud->{$_}->{topname})
                 } splice(@tags, 0, $count)) . '</p>';
         }
 }
@@ -3166,11 +3173,11 @@ EOF
         # print out each stylesheet that exist, providing backwards capability
         # for those people who defined $stylesheet in a config file
         if (defined $stylesheet) {
-                print '<link rel="stylesheet" type="text/css" href="'.$stylesheet.'"/>'."\n";
+                print '<link rel="stylesheet" type="text/css" href="'.esc_url($stylesheet).'"/>'."\n";
         } else {
                 foreach my $stylesheet (@stylesheets) {
                         next unless $stylesheet;
-                        print '<link rel="stylesheet" type="text/css" href="'.$stylesheet.'"/>'."\n";
+                        print '<link rel="stylesheet" type="text/css" href="'.esc_url($stylesheet).'"/>'."\n";
                 }
         }
         if (defined $project) {
@@ -3183,7 +3190,7 @@ EOF
                         my $type = lc($format);
                         my %link_attr = (
                                 '-rel' => 'alternate',
-                                '-title' => "$project - $href_params{'-title'} - $format feed",
+                                '-title' => esc_attr("$project - $href_params{'-title'} - $format feed"),
                                 '-type' => "application/$type+xml"
                         );
 
@@ -3210,13 +3217,13 @@ EOF
         } else {
                 printf('<link rel="alternate" title="%s projects list" '.
                        'href="%s" type="text/plain; charset=utf-8" />'."\n",
-                       $site_name, href(project=>undef, action=>"project_index"));
+                       esc_attr($site_name), href(project=>undef, action=>"project_index"));
                 printf('<link rel="alternate" title="%s projects feeds" '.
                        'href="%s" type="text/x-opml" />'."\n",
-                       $site_name, href(project=>undef, action=>"opml"));
+                       esc_attr($site_name), href(project=>undef, action=>"opml"));
         }
         if (defined $favicon) {
-                print qq(<link rel="shortcut icon" href="$favicon" type="image/png" />\n);
+                print qq(<link rel="shortcut icon" href=").esc_url($favicon).qq(" type="image/png" />\n);
         }
 
         print "</head>\n" .
@@ -3229,7 +3236,7 @@ EOF
         print "<div class=\"page_header\">\n" .
               $cgi->a({-href => esc_url($logo_url),
                        -title => $logo_label},
-                      qq(<img src="$logo" width="72" height="27" alt="git" class="logo"/>));
+                      qq(<img src=").esc_url($logo).qq(" width="72" height="27" alt="git" class="logo"/>));
         print $cgi->a({-href => esc_url($home_link)}, $home_link_str) . " / ";
         if (defined $project) {
                 print $cgi->a({-href => href(action=>"summary")}, esc_html($project));
@@ -3327,7 +3334,7 @@ sub git_footer_html {
                 insert_file($site_footer);
         }
 
-        print qq!<script type="text/javascript" src="$javascript"></script>\n!;
+        print qq!<script type="text/javascript" src="!.esc_url($javascript).qq!"></script>\n!;
         if ($action eq 'blame_incremental') {
                 print qq!<script type="text/javascript">\n!.
                       qq!startBlame("!. href(action=>"blame_data", -replay=>1) .qq!",\n!.
@@ -5313,14 +5320,14 @@ sub git_blob {
         } else {
                 print "<div class=\"page_nav\">\n" .
                       "<br/><br/></div>\n" .
-                      "<div class=\"title\">$hash</div>\n";
+                      "<div class=\"title\">".esc_html($hash)."</div>\n";
         }
         git_print_page_path($file_name, "blob", $hash_base);
         print "<div class=\"page_body\">\n";
         if ($mimetype =~ m!^image/!) {
-                print qq!<img type="$mimetype"!;
+                print qq!<img type="!.esc_attr($mimetype).qq!"!;
                 if ($file_name) {
-                        print qq! alt="$file_name" title="$file_name"!;
+                        print qq! alt="!.esc_attr($file_name).qq!" title="!.esc_attr($file_name).qq!"!;
                 }
                 print qq! src="! .
                       href(action=>"blob_plain", hash=>$hash,
@@ -5332,7 +5339,8 @@ sub git_blob {
                         chomp $line;
                         $nr++;
                         $line = untabify($line);
-                        printf "<div class=\"pre\"><a id=\"l%i\" href=\"" . href(-replay => 1)
+                        printf "<div class=\"pre\"><a id=\"l%i\" href=\""
+                                . esc_attr(href(-replay => 1))
                                 . "#l%i\" class=\"linenr\">%4i</a> %s</div>\n",
                                $nr, $nr, $nr, esc_html($line, -nbsp=>1);
                 }
@@ -5396,7 +5404,7 @@ sub git_tree {
                 undef $hash_base;
                 print "<div class=\"page_nav\">\n";
                 print "<br/><br/></div>\n";
-                print "<div class=\"title\">$hash</div>\n";
+                print "<div class=\"title\">".esc_html($hash)."</div>\n";
         }
         if (defined $file_name) {
                 $basedir = $file_name;
@@ -5864,7 +5872,7 @@ sub git_blobdiff {
                         git_print_header_div('commit', esc_html($co{'title'}), $hash_base);
                 } else {
                         print "<div class=\"page_nav\"><br/>$formats_nav<br/></div>\n";
-                        print "<div class=\"title\">$hash vs $hash_parent</div>\n";
+                        print "<div class=\"title\">".esc_html("$hash vs $hash_parent")."</div>\n";
                 }
                 if (defined $file_name) {
                         git_print_page_path($file_name, "blob", $hash_base);