Mercurial > public > mercurial-scm > hg
diff mercurial/templates/paper/changeset.tmpl @ 18526:9409aeaafdc1 stable
hgweb: urlescape all urls, HTML escape repo/tag/branch/... names
Without this, repository paths or names containing e.g. & characters or html
tags yielded strange results, possibly allowing cross-site scripting attacks.
| author | Thomas Arendsen Hein <thomas@intevation.de> |
|---|---|
| date | Fri, 01 Feb 2013 20:43:35 +0100 |
| parents | 0c51532ec233 |
| children | 52305554fd6e |
line wrap: on
line diff
--- a/mercurial/templates/paper/changeset.tmpl Fri Feb 01 15:14:05 2013 -0600 +++ b/mercurial/templates/paper/changeset.tmpl Fri Feb 01 20:43:35 2013 +0100 @@ -6,25 +6,25 @@ <div class="menu"> <div class="logo"> <a href="{logourl}"> -<img src="{staticurl}{logoimg}" alt="mercurial" /></a> +<img src="{staticurl|urlescape}{logoimg}" alt="mercurial" /></a> </div> <ul> - <li><a href="{url}shortlog/{node|short}{sessionvars%urlparameter}">log</a></li> - <li><a href="{url}graph/{node|short}{sessionvars%urlparameter}">graph</a></li> - <li><a href="{url}tags{sessionvars%urlparameter}">tags</a></li> - <li><a href="{url}bookmarks{sessionvars%urlparameter}">bookmarks</a></li> - <li><a href="{url}branches{sessionvars%urlparameter}">branches</a></li> + <li><a href="{url|urlescape}shortlog/{node|short}{sessionvars%urlparameter}">log</a></li> + <li><a href="{url|urlescape}graph/{node|short}{sessionvars%urlparameter}">graph</a></li> + <li><a href="{url|urlescape}tags{sessionvars%urlparameter}">tags</a></li> + <li><a href="{url|urlescape}bookmarks{sessionvars%urlparameter}">bookmarks</a></li> + <li><a href="{url|urlescape}branches{sessionvars%urlparameter}">branches</a></li> </ul> <ul> <li class="active">changeset</li> - <li><a href="{url}raw-rev/{node|short}{sessionvars%urlparameter}">raw</a></li> - <li><a href="{url}file/{node|short}{sessionvars%urlparameter}">browse</a></li> + <li><a href="{url|urlescape}raw-rev/{node|short}{sessionvars%urlparameter}">raw</a></li> + <li><a href="{url|urlescape}file/{node|short}{sessionvars%urlparameter}">browse</a></li> </ul> <ul> {archives%archiveentry} </ul> <ul> - <li><a href="{url}help{sessionvars%urlparameter}">help</a></li> + <li><a href="{url|urlescape}help{sessionvars%urlparameter}">help</a></li> </ul> </div> @@ -33,7 +33,7 @@ <h2 class="breadcrumb"><a href="/">Mercurial</a> {pathdef%breadcrumb}</h2> <h3>changeset {rev}:{node|short} {changesetbranch%changelogbranchname} {changesettag} {changesetbookmark}</h3> -<form class="search" action="{url}log"> +<form class="search" action="{url|urlescape}log"> {sessionvars%hiddenformentry} <p><input name="rev" id="search1" type="text" size="30" /></p> <div id="hint">find changesets by author, revision,