author | Lukas Fleischer <cgit@cryptocrack.de> | 2011-05-24 18:38:40 (UTC) |
---|---|---|
committer | Lars Hjemli <hjemli@gmail.com> | 2011-05-30 21:55:19 (UTC) |
commit | 69382320d96232ee8c73e664797da61e733c2427 (patch) (unidiff) | |
tree | 7f1d53505859cc6e15b261249a22d1604b3cd037 | |
parent | ec79265f2053e6dc20e0ec486719f5954d2be83d (diff) | |
download | cgit-69382320d96232ee8c73e664797da61e733c2427.zip cgit-69382320d96232ee8c73e664797da61e733c2427.tar.gz cgit-69382320d96232ee8c73e664797da61e733c2427.tar.bz2 |
Properly escape ampersands inside HTML attributes
Ampersands ("&") appearing inside HTML attributes need to be translated
to "&". Otherwise, invalid XHTML will be generated at various
places, such as at tree views containing links to submodules.
Signed-off-by: Lukas Fleischer <cgit@cryptocrack.de>
Signed-off-by: Lars Hjemli <hjemli@gmail.com>
-rw-r--r-- | html.c | 4 |
1 files changed, 3 insertions, 1 deletions
@@ -133,26 +133,28 @@ void html_ntxt(int len, const char *txt) | |||
133 | html("..."); | 133 | html("..."); |
134 | } | 134 | } |
135 | 135 | ||
136 | void html_attr(const char *txt) | 136 | void html_attr(const char *txt) |
137 | { | 137 | { |
138 | const char *t = txt; | 138 | const char *t = txt; |
139 | while(t && *t){ | 139 | while(t && *t){ |
140 | int c = *t; | 140 | int c = *t; |
141 | if (c=='<' || c=='>' || c=='\'' || c=='\"') { | 141 | if (c=='<' || c=='>' || c=='\'' || c=='\"' || c=='&') { |
142 | html_raw(txt, t - txt); | 142 | html_raw(txt, t - txt); |
143 | if (c=='>') | 143 | if (c=='>') |
144 | html(">"); | 144 | html(">"); |
145 | else if (c=='<') | 145 | else if (c=='<') |
146 | html("<"); | 146 | html("<"); |
147 | else if (c=='\'') | 147 | else if (c=='\'') |
148 | html("'"); | 148 | html("'"); |
149 | else if (c=='"') | 149 | else if (c=='"') |
150 | html("""); | 150 | html("""); |
151 | else if (c=='&') | ||
152 | html("&"); | ||
151 | txt = t+1; | 153 | txt = t+1; |
152 | } | 154 | } |
153 | t++; | 155 | t++; |
154 | } | 156 | } |
155 | if (t!=txt) | 157 | if (t!=txt) |
156 | html(txt); | 158 | html(txt); |
157 | } | 159 | } |
158 | 160 | ||