view mercurial/templates/monoblue/filerevision.tmpl @ 18526:9409aeaafdc1 stable

hgweb: urlescape all urls, HTML escape repo/tag/branch/... names Without this, repository paths or names containing e.g. & characters or html tags yielded strange results, possibly allowing cross-site scripting attacks.
author Thomas Arendsen Hein <thomas@intevation.de>
date Fri, 01 Feb 2013 20:43:35 +0100
parents bebb05a7e249
children 52305554fd6e
line wrap: on
line source

{header}
<title>{repo|escape}: {file|escape}@{node|short}</title>
    <link rel="alternate" type="application/atom+xml" href="{url|urlescape}atom-log" title="Atom feed for {repo|escape}"/>
    <link rel="alternate" type="application/rss+xml" href="{url|urlescape}rss-log" title="RSS feed for {repo|escape}"/>
</head>

<body>
<div id="container">
    <div class="page-header">
        <h1 class="breadcrumb"><a href="/">Mercurial</a> {pathdef%breadcrumb} / file revision</h1>

        <form action="{url|urlescape}log">
            {sessionvars%hiddenformentry}
            <dl class="search">
                <dt><label>Search: </label></dt>
                <dd><input type="text" name="rev" /></dd>
            </dl>
        </form>

        <ul class="page-nav">
            <li><a href="{url|urlescape}summary{sessionvars%urlparameter}">summary</a></li>
            <li><a href="{url|urlescape}shortlog{sessionvars%urlparameter}">shortlog</a></li>
            <li><a href="{url|urlescape}changelog{sessionvars%urlparameter}">changelog</a></li>
            <li><a href="{url|urlescape}graph/{node|short}{sessionvars%urlparameter}">graph</a></li>
            <li><a href="{url|urlescape}tags{sessionvars%urlparameter}">tags</a></li>
            <li><a href="{url|urlescape}bookmarks{sessionvars%urlparameter}">bookmarks</a></li>
            <li><a href="{url|urlescape}branches{sessionvars%urlparameter}">branches</a></li>
            <li><a href="{url|urlescape}file/{node|short}{path|urlescape}{sessionvars%urlparameter}">files</a></li>
            <li><a href="{url|urlescape}help{sessionvars%urlparameter}">help</a></li>
        </ul>
    </div>

    <ul class="submenu">
        <li class="current">file</li>
        <li><a href="{url|urlescape}log/{node|short}/{file|urlescape}{sessionvars%urlparameter}">revisions</a></li>
        <li><a href="{url|urlescape}annotate/{node|short}/{file|urlescape}{sessionvars%urlparameter}">annotate</a></li>
        <li><a href="{url|urlescape}diff/{node|short}/{file|urlescape}{sessionvars%urlparameter}">diff</a></li>
        <li><a href="{url|urlescape}comparison/{node|short}/{file|urlescape}{sessionvars%urlparameter}">comparison</a></li>
        <li><a href="{url|urlescape}raw-file/{node|short}/{file|urlescape}">raw</a></li>
    </ul>

    <h2 class="no-link no-border">{file|escape}@{node|short}</h2>
    <h3 class="changeset">{file|escape}</h3>
    <p class="changeset-age age">{date|rfc822date}</p>

    <dl class="overview">
        <dt>author</dt>
        <dd>{author|obfuscate}</dd>
        <dt>date</dt>
        <dd>{date|rfc822date}</dd>
        {branch%filerevbranch}
        <dt>changeset {rev}</dt>
        <dd><a class="list" href="{url|urlescape}rev/{node|short}{sessionvars%urlparameter}">{node|short}</a></dd>
        {parent%filerevparent}
        {child%filerevchild}
        <dt>permissions</dt>
        <dd>{permissions|permissions}</dd>
    </dl>

    <p class="description">{desc|strip|escape|addbreaks|nonempty}</p>

    <div class="source">
    {text%fileline}
    </div>

{footer}