annotate mercurial/templates/spartan/map @ 18526:9409aeaafdc1 stable

hgweb: urlescape all urls, HTML escape repo/tag/branch/... names

Without this, repository paths or names containing e.g. & characters or html
tags yielded strange results, possibly allowing cross-site scripting attacks.

default = 'shortlog'
mimetype = 'text/html; charset={encoding}'
header = header.tmpl
footer = footer.tmpl
search = search.tmpl
changelog = changelog.tmpl
shortlog = shortlog.tmpl
shortlogentry = shortlogentry.tmpl
graph = graph.tmpl
naventry = '<a href="{url|urlescape}log/{node|short}{sessionvars%urlparameter}">{label|escape}</a> '
navshortentry = '<a href="{url|urlescape}shortlog/{node|short}{sessionvars%urlparameter}">{label|escape}</a> '
navgraphentry = '<a href="{url|urlescape}graph/{node|short}{sessionvars%urlparameter}">{label|escape}</a> '
filenaventry = '<a href="{url|urlescape}log/{node|short}/{file|urlescape}{sessionvars%urlparameter}">{label|escape}</a> '
filedifflink = '<a href="{url|urlescape}diff/{node|short}/{file|urlescape}{sessionvars%urlparameter}">{file|escape}</a> '
filenodelink = '<a href="{url|urlescape}file/{node|short}/{file|urlescape}{sessionvars%urlparameter}">{file|escape}</a> '
filenolink = '{file|escape} '
fileellipses = '...'
changelogentry = changelogentry.tmpl
searchentry = changelogentry.tmpl
changeset = changeset.tmpl
manifest = manifest.tmpl

nav = '{before%naventry} {after%naventry}'
navshort = '{before%navshortentry}{after%navshortentry}'
navgraph = '{before%navgraphentry}{after%navgraphentry}'
filenav = '{before%filenaventry}{after%filenaventry}'

direntry = '
  <tr class="parity{parity}">
    <td><tt>drwxr-xr-x</tt>&nbsp;
    <td>&nbsp;
    <td>&nbsp;
    <td>
      <a href="{url|urlescape}file/{node|short}{path|urlescape}{sessionvars%urlparameter}">{basename|escape}/</a>
      <a href="{url|urlescape}file/{node|short}{path|urlescape}/{emptydirs|urlescape}{sessionvars%urlparameter}">
        {emptydirs|urlescape}
      </a>'

fileentry = '
  <tr class="parity{parity}">
    <td><tt>{permissions|permissions}</tt>&nbsp;
    <td align=right><tt class="date">{date|isodate}</tt>&nbsp;
    <td align=right><tt>{size}</tt>&nbsp;
    <td><a href="{url|urlescape}file/{node|short}/{file|urlescape}{sessionvars%urlparameter}">{basename|escape}</a>'

filerevision = filerevision.tmpl
fileannotate = fileannotate.tmpl
filediff = filediff.tmpl
filelog = filelog.tmpl
fileline = '<div class="parity{parity}"><a class="lineno" href="#{lineid}" id="{lineid}">{linenumber}</a>&nbsp;{line|escape}</div>'
filelogentry = filelogentry.tmpl

# The &nbsp; ensures that all table cells have content (even if there
# is an empty line in the annotated file), which in turn ensures that
# all table rows have equal height.
annotateline = '
  <tr class="parity{parity}">
    <td class="annotate">
      <a href="{url|urlescape}annotate/{node|short}/{file|urlescape}{sessionvars%urlparameter}#l{targetline}"
         title="{node|short}: {desc|escape|firstline}">{author|user}@{rev}</a>
    </td>
    <td>
      <a class="lineno" href="#{lineid}" id="{lineid}">{linenumber}</a>
    </td>
    <td><pre>&nbsp;{line|escape}</pre></td>
  </tr>'
difflineplus = '<span class="plusline"><a class="lineno" href="#{lineid}" id="{lineid}">{linenumber}</a>{line|escape}</span>'
difflineminus = '<span class="minusline"><a class="lineno" href="#{lineid}" id="{lineid}">{linenumber}</a>{line|escape}</span>'
difflineat = '<span class="atline"><a class="lineno" href="#{lineid}" id="{lineid}">{linenumber}</a>{line|escape}</span>'
diffline = '<a class="lineno" href="#{lineid}" id="{lineid}">{linenumber}</a>{line|escape}'
changelogparent = '
  <tr>
    <th class="parent">parent {rev}:</th>
    <td class="parent">
      <a href="{url|urlescape}rev/{node|short}{sessionvars%urlparameter}">{node|short}</a>
    </td>
  </tr>'
changesetparent = '
  <tr>
    <th class="parent">parent {rev}:</th>
    <td class="parent"><a href="{url|urlescape}rev/{node|short}{sessionvars%urlparameter}">{node|short}</a></td>
  </tr>'
filerevparent = '
  <tr>
    <td class="metatag">parent:</td>
    <td>
      <a href="{url|urlescape}file/{node|short}/{file|urlescape}{sessionvars%urlparameter}">
        {rename%filerename}{node|short}
      </a>
    </td>
  </tr>'
filerename = '{file|escape}@'
filelogrename = '
  <tr>
    <th>base:</th>
    <td>
      <a href="{url|urlescape}file/{node|short}/{file|urlescape}{sessionvars%urlparameter}">
        {file|escape}@{node|short}
      </a>
    </td>
  </tr>'
fileannotateparent = '
  <tr>
    <td class="metatag">parent:</td>
    <td>
      <a href="{url|urlescape}annotate/{node|short}/{file|urlescape}{sessionvars%urlparameter}">
        {rename%filerename}{node|short}
      </a>
    </td>
  </tr>'
changesetchild = '
  <tr>
    <th class="child">child {rev}:</th>
    <td class="child"><a href="{url|urlescape}rev/{node|short}{sessionvars%urlparameter}">{node|short}</a></td>
  </tr>'
changelogchild = '
  <tr>
    <th class="child">child {rev}:</th>
    <td class="child"><a href="{url|urlescape}rev/{node|short}{sessionvars%urlparameter}">{node|short}</a></td>
  </tr>'
filerevchild = '
  <tr>
    <td class="metatag">child:</td>
    <td><a href="{url|urlescape}file/{node|short}/{file|urlescape}{sessionvars%urlparameter}">{node|short}</a></td>
  </tr>'
fileannotatechild = '
  <tr>
    <td class="metatag">child:</td>
    <td><a href="{url|urlescape}annotate/{node|short}/{file|urlescape}{sessionvars%urlparameter}">{node|short}</a></td>
  </tr>'
tags = tags.tmpl
tagentry = '
  <li class="tagEntry parity{parity}">
    <tt class="node">{node}</tt>
    <a href="{url|urlescape}rev/{node|short}{sessionvars%urlparameter}">{tag|escape}</a>
  </li>'
branches = branches.tmpl
branchentry = '
  <li class="tagEntry parity{parity}">
    <tt class="node">{node}</tt>
    <a href="{url|urlescape}shortlog/{node|short}{sessionvars%urlparameter}" class="{status}">{branch|escape}</a>
  </li>'
diffblock = '<pre class="parity{parity}">{lines}</pre>'
changelogtag = '<tr><th class="tag">tag:</th><td class="tag">{tag|escape}</td></tr>'
changesettag = '<tr><th class="tag">tag:</th><td class="tag">{tag|escape}</td></tr>'
filediffparent = '
  <tr>
    <th class="parent">parent {rev}:</th>
    <td class="parent"><a href="{url|urlescape}rev/{node|short}{sessionvars%urlparameter}">{node|short}</a></td>
  </tr>'
filelogparent = '
  <tr>
    <th>parent {rev}:</th>
    <td><a href="{url|urlescape}file/{node|short}/{file|urlescape}{sessionvars%urlparameter}">{node|short}</a></td>
  </tr>'
filediffchild = '
  <tr>
    <th class="child">child {rev}:</th>
    <td class="child"><a href="{url|urlescape}rev/{node|short}{sessionvars%urlparameter}">{node|short}</a></td>
  </tr>'
filelogchild = '
  <tr>
    <th>child {rev}:</th>
    <td><a href="{url|urlescape}file/{node|short}/{file|urlescape}{sessionvars%urlparameter}">{node|short}</a></td>
  </tr>'
indexentry = '
  <tr class="parity{parity}">
    <td><a href="{url|urlescape}{sessionvars%urlparameter}">{name|escape}</a></td>
    <td>{description}</td>
    <td>{contact|obfuscate}</td>
    <td class="age">{lastchange|rfc822date}</td>
    <td class="indexlinks">
      <a href="{url|urlescape}rss-log">RSS</a>
      <a href="{url|urlescape}atom-log">Atom</a>
      {archives%archiveentry}
    </td>
  </tr>'
index = index.tmpl
archiveentry = '<a href="{url|urlescape}archive/{node|short}{extension|urlescape}">{type|escape}</a> '
notfound = notfound.tmpl
error = error.tmpl
urlparameter = '{separator}{name}={value|urlescape}'
hiddenformentry = '<input type="hidden" name="{name}" value="{value|escape}" />'
breadcrumb = '&gt; <a href="{url|urlescape}">{name|escape}</a> '