global/git
1
0
Fork 0
mirror of https://github.com/git/git.git synced 2026-03-15 03:00:07 +01:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'master' into next

Browse Source 
* master:
  gitweb: Protect escaping functions against calling on undef
  gitweb: esc_html (short) error message in die_error
This commit is contained in:
Junio C Hamano
2010-02-17 11:22:15 -08:00
parent be03aadc3b 1df4876613
commit 491ad7cbd8
1 changed files with 9 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
gitweb/gitweb.perl
View File

@@ -1143,6 +1143,7 @@ sub validate_refname {
# in utf-8 thanks to "binmode STDOUT, ':utf8'" at beginning
sub to_utf8 {
my $str = shift;
return undef unless defined $str;
if (utf8::valid($str)) {
utf8::decode($str);
return $str;
@@ -1155,6 +1156,7 @@ sub to_utf8 {
# correct, but quoted slashes look too horrible in bookmarks
sub esc_param {
my $str = shift;
return undef unless defined $str;
$str =~ s/([^A-Za-z0-9\-_.~()\/:@ ]+)/CGI::escape($1)/eg;
$str =~ s/ /\+/g;
return $str;
@@ -1163,6 +1165,7 @@ sub esc_param {
# quote unsafe chars in whole URL, so some charactrs cannot be quoted
sub esc_url {
my $str = shift;
return undef unless defined $str;
$str =~ s/([^A-Za-z0-9\-_.~();\/;?:@&=])/sprintf("%%%02X", ord($1))/eg;
$str =~ s/\+/%2B/g;
$str =~ s/ /\+/g;
@@ -1174,6 +1177,8 @@ sub esc_html {
my $str = shift;
my %opts = @_;
return undef unless defined $str;
$str = to_utf8($str);
$str = $cgi->escapeHTML($str);
if ($opts{'-nbsp'}) {
@@ -1188,6 +1193,8 @@ sub esc_path {
my $str = shift;
my %opts = @_;
return undef unless defined $str;
$str = to_utf8($str);
$str = $cgi->escapeHTML($str);
if ($opts{'-nbsp'}) {
@@ -3372,7 +3379,7 @@ sub git_footer_html {
"</html>";
}
# die_error(<http_status_code>, <error_message>)
# die_error(<http_status_code>, <error_message>[, <detailed_html_description>])
# Example: die_error(404, 'Hash not found')
# By convention, use the following status codes (as defined in RFC 2616):
# 400: Invalid or missing CGI parameters, or
@@ -3387,7 +3394,7 @@ sub git_footer_html {
# or down for maintenance). Generally, this is a temporary state.
sub die_error {
my $status = shift || 500;
my $error = shift || "Internal server error";
my $error = esc_html(shift) || "Internal Server Error";
my $extra = shift;
my %http_responses = (