diff options
| author | Jakub Narebski <jnareb@gmail.com> | 2007-03-07 02:21:25 +0100 |
|---|---|---|
| committer | Junio C Hamano <junkio@cox.net> | 2007-03-06 19:04:07 -0800 |
| commit | edc04e90f5a79b7805f1188ca94f06ef7eed81f5 (patch) | |
| tree | 144fc67e98628e97eb2adad5436ddf0ea4329af3 | |
| parent | c390ae97beb9e8cdab159b593ea9659e8096c4db (diff) | |
| download | git-edc04e90f5a79b7805f1188ca94f06ef7eed81f5.tar.gz git-edc04e90f5a79b7805f1188ca94f06ef7eed81f5.tar.xz | |
gitweb: Don't escape attributes in CGI.pm HTML methods
There is no need to escape HTML tag's attributes in CGI.pm
HTML methods (like CGI::a()), because CGI.pm does attribute
escaping automatically.
$cgi->a({ ... -attribute => atribute_value }, tag_contents)
is translated to
<a ... attribute="attribute_value">tag_contents</a>
The rules for escaping attribute values (which are string contents) are
different. For example you have to take care about escaping embedded '"'
and "'" characters; CGI::a() does that for us automatically.
CGI::a() does not HTML escape tag_contents; we would need to write
<a href="URL">some <b>bold</b> text</a>
for example. So we use esc_html (or esc_path) to escape tag_contents
as needed.
Signed-off-by: Jakub Narebski <jnareb@gmail.com>
Signed-off-by: Junio C Hamano <junkio@cox.net>
| -rwxr-xr-x | gitweb/gitweb.perl | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/gitweb/gitweb.perl b/gitweb/gitweb.perl index 3a564d1c4..27b5970bc 100755 --- a/gitweb/gitweb.perl +++ b/gitweb/gitweb.perl @@ -1974,17 +1974,17 @@ sub git_print_page_path { $fullname .= ($fullname ? '/' : '') . $dir; print $cgi->a({-href => href(action=>"tree", file_name=>$fullname, hash_base=>$hb), - -title => esc_html($fullname)}, esc_path($dir)); + -title => $fullname}, esc_path($dir)); print " / "; } if (defined $type && $type eq 'blob') { print $cgi->a({-href => href(action=>"blob_plain", file_name=>$file_name, hash_base=>$hb), - -title => esc_html($name)}, esc_path($basename)); + -title => $name}, esc_path($basename)); } elsif (defined $type && $type eq 'tree') { print $cgi->a({-href => href(action=>"tree", file_name=>$file_name, hash_base=>$hb), - -title => esc_html($name)}, esc_path($basename)); + -title => $name}, esc_path($basename)); print " / "; } else { print esc_path($basename); |