ui-shared: use html_url_path() to get properly escaped url in form action

When a repo uses an url with e.g. '#' or '?' characters this needs to be
properly escaped when used as action in a form tag.

Signed-off-by: Lars Hjemli <hjemli@gmail.com>

1 files changed, 2 insertions, 2 deletions

diff --git a/ui-shared.c b/ui-shared.c
index f858ab6..1e12529 100644
--- a/ui-shared.c
+++ b/ui-shared.c
@@ -640,26 +640,26 @@ void cgit_print_pageheader(struct cgit_context *ctx)
                                ctx->qry.sha1, NULL);
                 cgit_commit_link("commit", NULL, hc(cmd, "commit"),
                                  ctx->qry.head, ctx->qry.sha1);
                 cgit_diff_link("diff", NULL, hc(cmd, "diff"), ctx->qry.head,
                                ctx->qry.sha1, ctx->qry.sha2, NULL);
                 if (ctx->repo->readme)
                         reporevlink("about", "about", NULL,
                                     hc(cmd, "about"), ctx->qry.head, NULL,
                                     NULL);
                 html("</td><td class='form'>");
                 html("<form class='right' method='get' action='");
                 if (ctx->cfg.virtual_root)
-                        html_attr(cgit_fileurl(ctx->qry.repo, "log",
-                                               ctx->qry.path, NULL));
+                        html_url_path(cgit_fileurl(ctx->qry.repo, "log",
+                                                   ctx->qry.path, NULL));
                 html("'>\n");
                 add_hidden_formfields(1, 0, "log");
                 html("<select name='qt'>\n");
                 html_option("grep", "log msg", ctx->qry.grep);
                 html_option("author", "author", ctx->qry.grep);
                 html_option("committer", "committer", ctx->qry.grep);
                 html("</select>\n");
                 html("<input class='txt' type='text' size='10' name='q' value='");
                 html_attr(ctx->qry.search);
                 html("'/>\n");
                 html("<input type='submit' value='search'/>\n");
                 html("</form>\n");