Thread (7 messages) flat view 7 messages, 2 authors, 2016-06-15
DORMANTno replies

[PATCH] gitweb: Escape long title for link tooltips

From: Yasushi SHOJI <hidden>
Date: 2016-06-15 22:42:42
Subsystem: the rest · Maintainer: Linus Torvalds

This is a simple one liner to fix the bug not escaping title string
for link tooltips.

This is not crucial if the commit message is all in ASCII, however, if
you decide to use other encoding, such as UTF-8, tooltips ain't
readable any more.

Signed-off-by: Yasushi SHOJI <redacted>
---
 gitweb/gitweb.perl |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)
diff --git a/gitweb/gitweb.perl b/gitweb/gitweb.perl
index 66be619..67f49df 100755
--- a/gitweb/gitweb.perl
+++ b/gitweb/gitweb.perl
@@ -617,7 +617,7 @@ sub format_subject_html {
 
 	if (length($short) < length($long)) {
 		return $cgi->a({-href => $href, -class => "list subject",
-		                -title => $long},
+		                -title => esc_html($long)},
 		       esc_html($short) . $extra);
 	} else {
 		return $cgi->a({-href => $href, -class => "list subject"},
-- 
1.4.2.1.g83915
Keyboard shortcuts
hback out one level
jnext message in thread
kprevious message in thread
ldrill in
Escclose help / fold thread tree
?toggle this help