Merge branch 'js/alias-p' into next

* js/alias-p:
  git wrapper: add --git-dir=<path> and --bare options
  Allow an alias to start with "-p"
  cvsserver: avoid warning about active db handles
  cvsserver: suppress warnings
  Substitute xmalloc()+memset(0) with xcalloc().
  gitweb: escape tag comments

gitweb/gitweb.cgi

@@ -1138,7 +1138,7 @@ sub git_summary {
 				      "</td>\n" .
 				      "<td>";
 				if (defined($comment)) {
-				      print $cgi->a({-class => "list", -href => "$my_uri?" . esc_param("p=$project;a=tag;h=$tag{'id'}")}, $comment);
+				      print $cgi->a({-class => "list", -href => "$my_uri?" . esc_param("p=$project;a=tag;h=$tag{'id'}")}, esc_html($comment));
 				}
 				print "</td>\n" .
 				      "<td class=\"link\">";