ui-tag: escape tagnames properly

Signed-off-by: Lars Hjemli <hjemli@gmail.com>

1 files changed, 3 insertions, 2 deletions

diff --git a/ui-tag.c b/ui-tag.c
index 3aea87d..54b9f4c 100644
--- a/ui-tag.c
+++ b/ui-tag.c
@@ -32,48 +32,49 @@ static void print_tag_content(char *buf)
 
 void cgit_print_tag(char *revname)
 {
 	unsigned char sha1[20];
 	struct object *obj;
 	struct tag *tag;
 	struct taginfo *info;
 
 	if (get_sha1(revname, sha1)) {
 		cgit_print_error(fmt("Bad tag reference: %s", revname));
 		return;
 	}
 	obj = parse_object(sha1);
 	if (!obj) {
 		cgit_print_error(fmt("Bad object id: %s", sha1_to_hex(sha1)));
 		return;
 	}
 	if (obj->type == OBJ_TAG) {
 		tag = lookup_tag(sha1);
 		if (!tag || parse_tag(tag) || !(info = cgit_parse_tag(tag))) {
 			cgit_print_error(fmt("Bad tag object: %s", revname));
 			return;
 		}
 		html("<table class='commit-info'>\n");
-		htmlf("<tr><td>Tag name</td><td>%s (%s)</td></tr>\n",
-		      revname, sha1_to_hex(sha1));
+		htmlf("<tr><td>Tag name</td><td>");
+		html_txt(revname);
+		htmlf(" (%s)</td></tr>\n", sha1_to_hex(sha1));
 		if (info->tagger_date > 0) {
 			html("<tr><td>Tag date</td><td>");
 			cgit_print_date(info->tagger_date, FMT_LONGDATE, ctx.cfg.local_time);
 			html("</td></tr>\n");
 		}
 		if (info->tagger) {
 			html("<tr><td>Tagged by</td><td>");
 			html_txt(info->tagger);
 			if (info->tagger_email) {
 				html(" ");
 				html_txt(info->tagger_email);
 			}
 			html("</td></tr>\n");
 		}
 		html("<tr><td>Tagged object</td><td>");
 		cgit_object_link(tag->tagged);
 		html("</td></tr>\n");
 		html("</table>\n");
 		print_tag_content(info->msg);
 	}
 	return;
 }