Mercurial > hg
diff mercurial/templates/paper/map @ 18526:9409aeaafdc1 stable
hgweb: urlescape all urls, HTML escape repo/tag/branch/... names
Without this, repository paths or names containing e.g. & characters or html
tags yielded strange results, possibly allowing cross-site scripting attacks.
author | Thomas Arendsen Hein <thomas@intevation.de> |
---|---|
date | Fri, 01 Feb 2013 20:43:35 +0100 |
parents | 41eabb5b8761 |
children | 3c7c25fa58e0 |
line wrap: on
line diff
--- a/mercurial/templates/paper/map Fri Feb 01 15:14:05 2013 -0600 +++ b/mercurial/templates/paper/map Fri Feb 01 20:43:35 2013 +0100 @@ -12,14 +12,14 @@ help = help.tmpl helptopics = helptopics.tmpl -helpentry = '<tr><td><a href="{url}help/{topic|escape}{sessionvars%urlparameter}">{topic|escape}</a></td><td>{summary|escape}</td></tr>' +helpentry = '<tr><td><a href="{url|urlescape}help/{topic|escape}{sessionvars%urlparameter}">{topic|escape}</a></td><td>{summary|escape}</td></tr>' -naventry = '<a href="{url}log/{node|short}{sessionvars%urlparameter}">{label|escape}</a> ' -navshortentry = '<a href="{url}shortlog/{node|short}{sessionvars%urlparameter}">{label|escape}</a> ' -navgraphentry = '<a href="{url}graph/{node|short}{sessionvars%urlparameter}">{label|escape}</a> ' -filenaventry = '<a href="{url}log/{node|short}/{file|urlescape}{sessionvars%urlparameter}">{label|escape}</a> ' -filedifflink = '<a href="{url}diff/{node|short}/{file|urlescape}{sessionvars%urlparameter}">{file|escape}</a> ' -filenodelink = '<a href="{url}file/{node|short}/{file|urlescape}{sessionvars%urlparameter}">{file|escape}</a> ' +naventry = '<a href="{url|urlescape}log/{node|short}{sessionvars%urlparameter}">{label|escape}</a> ' +navshortentry = '<a href="{url|urlescape}shortlog/{node|short}{sessionvars%urlparameter}">{label|escape}</a> ' +navgraphentry = '<a href="{url|urlescape}graph/{node|short}{sessionvars%urlparameter}">{label|escape}</a> ' +filenaventry = '<a href="{url|urlescape}log/{node|short}/{file|urlescape}{sessionvars%urlparameter}">{label|escape}</a> ' +filedifflink = '<a href="{url|urlescape}diff/{node|short}/{file|urlescape}{sessionvars%urlparameter}">{file|escape}</a> ' +filenodelink = '<a href="{url|urlescape}file/{node|short}/{file|urlescape}{sessionvars%urlparameter}">{file|escape}</a> ' filenolink = '{file|escape} ' fileellipses = '...' diffstatlink = diffstat.tmpl @@ -37,10 +37,10 @@ direntry = ' <tr class="fileline parity{parity}"> <td class="name"> - <a href="{url}file/{node|short}{path|urlescape}{sessionvars%urlparameter}"> - <img src="{staticurl}coal-folder.png" alt="dir."/> {basename|escape}/ + <a href="{url|urlescape}file/{node|short}{path|urlescape}{sessionvars%urlparameter}"> + <img src="{staticurl|urlescape}coal-folder.png" alt="dir."/> {basename|escape}/ </a> - <a href="{url}file/{node|short}{path|urlescape}/{emptydirs|urlescape}{sessionvars%urlparameter}"> + <a href="{url|urlescape}file/{node|short}{path|urlescape}/{emptydirs|urlescape}{sessionvars%urlparameter}"> {emptydirs|escape} </a> </td> @@ -51,8 +51,8 @@ fileentry = ' <tr class="fileline parity{parity}"> <td class="filename"> - <a href="{url}file/{node|short}/{file|urlescape}{sessionvars%urlparameter}"> - <img src="{staticurl}coal-file.png" alt="file"/> {basename|escape} + <a href="{url|urlescape}file/{node|short}/{file|urlescape}{sessionvars%urlparameter}"> + <img src="{staticurl|urlescape}coal-file.png" alt="file"/> {basename|escape} </a> </td> <td class="size">{size}</td> @@ -71,7 +71,7 @@ annotateline = ' <tr class="parity{parity}"> <td class="annotate"> - <a href="{url}annotate/{node|short}/{file|urlescape}{sessionvars%urlparameter}#l{targetline}" + <a href="{url|urlescape}annotate/{node|short}/{file|urlescape}{sessionvars%urlparameter}#l{targetline}" title="{node|short}: {desc|escape|firstline}">{author|user}@{rev}</a> </td> <td class="source"><a href="#{lineid}" id="{lineid}">{linenumber}</a> {line|escape}</td> @@ -96,21 +96,21 @@ changelogparent = ' <tr> <th class="parent">parent {rev}:</th> - <td class="parent"><a href="{url}rev/{node|short}{sessionvars%urlparameter}">{node|short}</a></td> + <td class="parent"><a href="{url|urlescape}rev/{node|short}{sessionvars%urlparameter}">{node|short}</a></td> </tr>' -changesetparent = '<a href="{url}rev/{node|short}{sessionvars%urlparameter}">{node|short}</a> ' +changesetparent = '<a href="{url|urlescape}rev/{node|short}{sessionvars%urlparameter}">{node|short}</a> ' -difffrom = '<a href="{url}rev/{node|short}:{originalnode|short}{sessionvars%urlparameter}">{node|short}</a> ' +difffrom = '<a href="{url|urlescape}rev/{node|short}:{originalnode|short}{sessionvars%urlparameter}">{node|short}</a> ' -filerevparent = '<a href="{url}file/{node|short}/{file|urlescape}{sessionvars%urlparameter}">{rename%filerename}{node|short}</a> ' -filerevchild = '<a href="{url}file/{node|short}/{file|urlescape}{sessionvars%urlparameter}">{node|short}</a> ' +filerevparent = '<a href="{url|urlescape}file/{node|short}/{file|urlescape}{sessionvars%urlparameter}">{rename%filerename}{node|short}</a> ' +filerevchild = '<a href="{url|urlescape}file/{node|short}/{file|urlescape}{sessionvars%urlparameter}">{node|short}</a> ' filerename = '{file|escape}@' filelogrename = ' <span class="base"> base - <a href="{url}file/{node|short}/{file|urlescape}{sessionvars%urlparameter}"> + <a href="{url|urlescape}file/{node|short}/{file|urlescape}{sessionvars%urlparameter}"> {file|escape}@{node|short} </a> </span>' @@ -118,17 +118,17 @@ <tr> <td class="metatag">parent:</td> <td> - <a href="{url}annotate/{node|short}/{file|urlescape}{sessionvars%urlparameter}"> + <a href="{url|urlescape}annotate/{node|short}/{file|urlescape}{sessionvars%urlparameter}"> {rename%filerename}{node|short} </a> </td> </tr>' -changesetchild = ' <a href="{url}rev/{node|short}{sessionvars%urlparameter}">{node|short}</a>' +changesetchild = ' <a href="{url|urlescape}rev/{node|short}{sessionvars%urlparameter}">{node|short}</a>' changelogchild = ' <tr> <th class="child">child</th> <td class="child"> - <a href="{url}rev/{node|short}{sessionvars%urlparameter}"> + <a href="{url|urlescape}rev/{node|short}{sessionvars%urlparameter}"> {node|short} </a> </td> @@ -137,7 +137,7 @@ <tr> <td class="metatag">child:</td> <td> - <a href="{url}annotate/{node|short}/{file|urlescape}{sessionvars%urlparameter}"> + <a href="{url|urlescape}annotate/{node|short}/{file|urlescape}{sessionvars%urlparameter}"> {node|short} </a> </td> @@ -146,7 +146,7 @@ tagentry = ' <tr class="tagEntry parity{parity}"> <td> - <a href="{url}rev/{node|short}{sessionvars%urlparameter}"> + <a href="{url|urlescape}rev/{node|short}{sessionvars%urlparameter}"> {tag|escape} </a> </td> @@ -158,7 +158,7 @@ bookmarkentry = ' <tr class="tagEntry parity{parity}"> <td> - <a href="{url}rev/{node|short}{sessionvars%urlparameter}"> + <a href="{url|urlescape}rev/{node|short}{sessionvars%urlparameter}"> {bookmark|escape} </a> </td> @@ -170,7 +170,7 @@ branchentry = ' <tr class="tagEntry parity{parity}"> <td> - <a href="{url}shortlog/{node|short}{sessionvars%urlparameter}" class="{status}"> + <a href="{url|urlescape}shortlog/{node|short}{sessionvars%urlparameter}" class="{status}"> {branch|escape} </a> </td> @@ -187,48 +187,48 @@ filediffparent = ' <tr> <th class="parent">parent {rev}:</th> - <td class="parent"><a href="{url}rev/{node|short}{sessionvars%urlparameter}">{node|short}</a></td> + <td class="parent"><a href="{url|urlescape}rev/{node|short}{sessionvars%urlparameter}">{node|short}</a></td> </tr>' filelogparent = ' <tr> <th>parent {rev}:</th> - <td><a href="{url}file/{node|short}/{file|urlescape}{sessionvars%urlparameter}">{node|short}</a></td> + <td><a href="{url|urlescape}file/{node|short}/{file|urlescape}{sessionvars%urlparameter}">{node|short}</a></td> </tr>' filediffchild = ' <tr> <th class="child">child {rev}:</th> - <td class="child"><a href="{url}rev/{node|short}{sessionvars%urlparameter}">{node|short}</a> + <td class="child"><a href="{url|urlescape}rev/{node|short}{sessionvars%urlparameter}">{node|short}</a> </td> </tr>' filelogchild = ' <tr> <th>child {rev}:</th> - <td><a href="{url}file/{node|short}/{file|urlescape}{sessionvars%urlparameter}">{node|short}</a></td> + <td><a href="{url|urlescape}file/{node|short}/{file|urlescape}{sessionvars%urlparameter}">{node|short}</a></td> </tr>' indexentry = ' <tr class="parity{parity}"> - <td><a href="{url}{sessionvars%urlparameter}">{name|escape}</a></td> + <td><a href="{url|urlescape}{sessionvars%urlparameter}">{name|escape}</a></td> <td>{description}</td> <td>{contact|obfuscate}</td> <td class="age">{lastchange|rfc822date}</td> <td class="indexlinks">{archives%indexarchiveentry}</td> <td> {if(isdirectory, '', - '<a href="{url}atom-log" title="subscribe to repository atom feed"> - <img class="atom-logo" src="{staticurl}feed-icon-14x14.png" alt="subscribe to repository atom feed"> + '<a href="{url|urlescape}atom-log" title="subscribe to repository atom feed"> + <img class="atom-logo" src="{staticurl|urlescape}feed-icon-14x14.png" alt="subscribe to repository atom feed"> </a>' )} </td> </tr>\n' -indexarchiveentry = '<a href="{url}archive/{node|short}{extension|urlescape}"> ↓{type|escape}</a>' +indexarchiveentry = '<a href="{url|urlescape}archive/{node|short}{extension|urlescape}"> ↓{type|escape}</a>' index = index.tmpl archiveentry = ' <li> - <a href="{url}archive/{node|short}{extension|urlescape}">{type|escape}</a> + <a href="{url|urlescape}archive/{node|short}{extension|urlescape}">{type|escape}</a> </li>' notfound = notfound.tmpl error = error.tmpl urlparameter = '{separator}{name}={value|urlescape}' hiddenformentry = '<input type="hidden" name="{name}" value="{value|escape}" />' -breadcrumb = '> <a href="{url}">{name}</a> ' +breadcrumb = '> <a href="{url|urlescape}">{name|escape}</a> '