ui-shared.c: use html_url_path() in repolink()

This makes sure that reponames and paths are properly escaped when used
as urls.

Signed-off-by: Lars Hjemli <hjemli@gmail.com>

1 files changed, 4 insertions, 4 deletions

diff --git a/ui-shared.c b/ui-shared.c
index a2f636c..2eddd2d 100644
--- a/ui-shared.c
+++ b/ui-shared.c
@@ -81,267 +81,267 @@ char *cgit_fileurl(const char *reponame, const char *pagename,
                 tmp = fmt("%s/%s/%s/%s", ctx.cfg.virtual_root, reponame,
                           pagename, (filename ? filename:""));
                 delim = "?";
         } else {
                 tmp = fmt("?url=%s/%s/%s", reponame, pagename,
                           (filename ? filename : ""));
                 delim = "&";
         }
         if (query)
                 tmp = fmt("%s%s%s", tmp, delim, query);
         return tmp;
 }
 
 char *cgit_pageurl(const char *reponame, const char *pagename,
                    const char *query)
 {
         return cgit_fileurl(reponame,pagename,0,query);
 }
 
 const char *cgit_repobasename(const char *reponame)
 {
         /* I assume we don't need to store more than one repo basename */
         static char rvbuf[1024];
         int p;
         const char *rv;
         strncpy(rvbuf,reponame,sizeof(rvbuf));
         if(rvbuf[sizeof(rvbuf)-1])
                 die("cgit_repobasename: truncated repository name '%s'", reponame);
         p = strlen(rvbuf)-1;
         /* strip trailing slashes */
         while(p && rvbuf[p]=='/') rvbuf[p--]=0;
         /* strip trailing .git */
         if(p>=3 && !strncmp(&rvbuf[p-3],".git",4)) {
                 p -= 3; rvbuf[p--] = 0;
         }
         /* strip more trailing slashes if any */
         while( p && rvbuf[p]=='/') rvbuf[p--]=0;
         /* find last slash in the remaining string */
         rv = strrchr(rvbuf,'/');
         if(rv)
                 return ++rv;
         return rvbuf;
 }
 
 char *cgit_currurl()
 {
         if (!ctx.cfg.virtual_root)
                 return ctx.cfg.script_name;
         else if (ctx.qry.page)
                 return fmt("%s/%s/%s/", ctx.cfg.virtual_root, ctx.qry.repo, ctx.qry.page);
         else if (ctx.qry.repo)
                 return fmt("%s/%s/", ctx.cfg.virtual_root, ctx.qry.repo);
         else
                 return fmt("%s/", ctx.cfg.virtual_root);
 }
 
 static void site_url(char *page, char *search, int ofs)
 {
         char *delim = "?";
 
         if (ctx.cfg.virtual_root) {
                 html_attr(ctx.cfg.virtual_root);
                 if (ctx.cfg.virtual_root[strlen(ctx.cfg.virtual_root) - 1] != '/')
                         html("/");
         } else
                 html(ctx.cfg.script_name);
 
         if (page) {
                 htmlf("?p=%s", page);
                 delim = "&";
         }
         if (search) {
                 html(delim);
                 html("q=");
                 html_attr(search);
                 delim = "&";
         }
         if (ofs) {
                 html(delim);
                 htmlf("ofs=%d", ofs);
         }
 }
 
 static void site_link(char *page, char *name, char *title, char *class,
                       char *search, int ofs)
 {
         html("<a");
         if (title) {
                 html(" title='");
                 html_attr(title);
                 html("'");
         }
         if (class) {
                 html(" class='");
                 html_attr(class);
                 html("'");
         }
         html(" href='");
         site_url(page, search, ofs);
         html("'>");
         html_txt(name);
         html("</a>");
 }
 
 void cgit_index_link(char *name, char *title, char *class, char *pattern,
                      int ofs)
 {
         site_link(NULL, name, title, class, pattern, ofs);
 }
 
 static char *repolink(char *title, char *class, char *page, char *head,
                       char *path)
 {
         char *delim = "?";
 
         html("<a");
         if (title) {
                 html(" title='");
                 html_attr(title);
                 html("'");
         }
         if (class) {
                 html(" class='");
                 html_attr(class);
                 html("'");
         }
         html(" href='");
         if (ctx.cfg.virtual_root) {
-                html_attr(ctx.cfg.virtual_root);
+                html_url_path(ctx.cfg.virtual_root);
                 if (ctx.cfg.virtual_root[strlen(ctx.cfg.virtual_root) - 1] != '/')
                         html("/");
-                html_attr(ctx.repo->url);
+                html_url_path(ctx.repo->url);
                 if (ctx.repo->url[strlen(ctx.repo->url) - 1] != '/')
                         html("/");
                 if (page) {
-                        html(page);
+                        html_url_path(page);
                         html("/");
                         if (path)
-                                html_attr(path);
+                                html_url_path(path);
                 }
         } else {
                 html(ctx.cfg.script_name);
                 html("?url=");
                 html_url_arg(ctx.repo->url);
                 if (ctx.repo->url[strlen(ctx.repo->url) - 1] != '/')
                         html("/");
                 if (page) {
                         html_url_arg(page);
                         html("/");
                         if (path)
                                 html_url_arg(path);
                 }
                 delim = "&amp;";
         }
         if (head && strcmp(head, ctx.repo->defbranch)) {
                 html(delim);
                 html("h=");
                 html_url_arg(head);
                 delim = "&amp;";
         }
         return fmt("%s", delim);
 }
 
 static void reporevlink(char *page, char *name, char *title, char *class,
                         char *head, char *rev, char *path)
 {
         char *delim;
 
         delim = repolink(title, class, page, head, path);
         if (rev && strcmp(rev, ctx.qry.head)) {
                 html(delim);
                 html("id=");
                 html_url_arg(rev);
         }
         html("'>");
         html_txt(name);
         html("</a>");
 }
 
 void cgit_tree_link(char *name, char *title, char *class, char *head,
                     char *rev, char *path)
 {
         reporevlink("tree", name, title, class, head, rev, path);
 }
 
 void cgit_plain_link(char *name, char *title, char *class, char *head,
                      char *rev, char *path)
 {
         reporevlink("plain", name, title, class, head, rev, path);
 }
 
 void cgit_log_link(char *name, char *title, char *class, char *head,
                    char *rev, char *path, int ofs, char *grep, char *pattern)
 {
         char *delim;
 
         delim = repolink(title, class, "log", head, path);
         if (rev && strcmp(rev, ctx.qry.head)) {
                 html(delim);
                 html("id=");
                 html_url_arg(rev);
                 delim = "&";
         }
         if (grep && pattern) {
                 html(delim);
                 html("qt=");
                 html_url_arg(grep);
                 delim = "&";
                 html(delim);
                 html("q=");
                 html_url_arg(pattern);
         }
         if (ofs > 0) {
                 html(delim);
                 html("ofs=");
                 htmlf("%d", ofs);
         }
         html("'>");
         html_txt(name);
         html("</a>");
 }
 
 void cgit_commit_link(char *name, char *title, char *class, char *head,
                       char *rev)
 {
         if (strlen(name) > ctx.cfg.max_msg_len && ctx.cfg.max_msg_len >= 15) {
                 name[ctx.cfg.max_msg_len] = '\0';
                 name[ctx.cfg.max_msg_len - 1] = '.';
                 name[ctx.cfg.max_msg_len - 2] = '.';
                 name[ctx.cfg.max_msg_len - 3] = '.';
         }
         reporevlink("commit", name, title, class, head, rev, NULL);
 }
 
 void cgit_refs_link(char *name, char *title, char *class, char *head,
                     char *rev, char *path)
 {
         reporevlink("refs", name, title, class, head, rev, path);
 }
 
 void cgit_snapshot_link(char *name, char *title, char *class, char *head,
                         char *rev, char *archivename)
 {
         reporevlink("snapshot", name, title, class, head, rev, archivename);
 }
 
 void cgit_diff_link(char *name, char *title, char *class, char *head,
                     char *new_rev, char *old_rev, char *path)
 {
         char *delim;
 
         delim = repolink(title, class, "diff", head, path);
         if (new_rev && strcmp(new_rev, ctx.qry.head)) {
                 html(delim);
                 html("id=");
                 html_url_arg(new_rev);
                 delim = "&amp;";
         }
         if (old_rev) {
                 html(delim);
                 html("id2=");
                 html_url_arg(old_rev);
         }
         html("'>");
         html_txt(name);
         html("</a>");
 }