comparison mercurial/templates/spartan/filerevision.tmpl @ 18526:9409aeaafdc1 stable

hgweb: urlescape all urls, HTML escape repo/tag/branch/... names Without this, repository paths or names containing e.g. & characters or html tags yielded strange results, possibly allowing cross-site scripting attacks.
author Thomas Arendsen Hein <thomas@intevation.de>
date Fri, 01 Feb 2013 20:43:35 +0100
parents 7bf412b767fe
children 52305554fd6e
comparison
equal deleted inserted replaced
18525:462579cbad45 18526:9409aeaafdc1
2 <title>{repo|escape}:{file|escape}</title> 2 <title>{repo|escape}:{file|escape}</title>
3 </head> 3 </head>
4 <body> 4 <body>
5 5
6 <div class="buttons"> 6 <div class="buttons">
7 <a href="{url}log/{rev}{sessionvars%urlparameter}">changelog</a> 7 <a href="{url|urlescape}log/{rev}{sessionvars%urlparameter}">changelog</a>
8 <a href="{url}shortlog/{rev}{sessionvars%urlparameter}">shortlog</a> 8 <a href="{url|urlescape}shortlog/{rev}{sessionvars%urlparameter}">shortlog</a>
9 <a href="{url}graph{sessionvars%urlparameter}">graph</a> 9 <a href="{url|urlescape}graph{sessionvars%urlparameter}">graph</a>
10 <a href="{url}tags{sessionvars%urlparameter}">tags</a> 10 <a href="{url|urlescape}tags{sessionvars%urlparameter}">tags</a>
11 <a href="{url}branches{sessionvars%urlparameter}">branches</a> 11 <a href="{url|urlescape}branches{sessionvars%urlparameter}">branches</a>
12 <a href="{url}rev/{node|short}{sessionvars%urlparameter}">changeset</a> 12 <a href="{url|urlescape}rev/{node|short}{sessionvars%urlparameter}">changeset</a>
13 <a href="{url}file/{node|short}{path|urlescape}{sessionvars%urlparameter}">files</a> 13 <a href="{url|urlescape}file/{node|short}{path|urlescape}{sessionvars%urlparameter}">files</a>
14 <a href="{url}log/{node|short}/{file|urlescape}{sessionvars%urlparameter}">revisions</a> 14 <a href="{url|urlescape}log/{node|short}/{file|urlescape}{sessionvars%urlparameter}">revisions</a>
15 <a href="{url}annotate/{node|short}/{file|urlescape}{sessionvars%urlparameter}">annotate</a> 15 <a href="{url|urlescape}annotate/{node|short}/{file|urlescape}{sessionvars%urlparameter}">annotate</a>
16 <a href="{url}raw-file/{node|short}/{file|urlescape}">raw</a> 16 <a href="{url|urlescape}raw-file/{node|short}/{file|urlescape}">raw</a>
17 <a href="{url}help{sessionvars%urlparameter}">help</a> 17 <a href="{url|urlescape}help{sessionvars%urlparameter}">help</a>
18 </div> 18 </div>
19 19
20 <h2><a href="/">Mercurial</a> {pathdef%breadcrumb} / {file|escape}</h2> 20 <h2><a href="/">Mercurial</a> {pathdef%breadcrumb} / {file|escape}</h2>
21 21
22 <table> 22 <table>
23 <tr> 23 <tr>
24 <td class="metatag">changeset {rev}:</td> 24 <td class="metatag">changeset {rev}:</td>
25 <td><a href="{url}rev/{node|short}{sessionvars%urlparameter}">{node|short}</a></td></tr> 25 <td><a href="{url|urlescape}rev/{node|short}{sessionvars%urlparameter}">{node|short}</a></td></tr>
26 {parent%filerevparent} 26 {parent%filerevparent}
27 {child%filerevchild} 27 {child%filerevchild}
28 <tr> 28 <tr>
29 <td class="metatag">author:</td> 29 <td class="metatag">author:</td>
30 <td>{author|obfuscate}</td></tr> 30 <td>{author|obfuscate}</td></tr>