git.99rst.org / git.git / commit
? search:
summary | shortlog | log | commit | commitdiff | tree
(merge: 3288d99 a376e37)
Merge branch 'jk/gitweb-anti-xss'
authorJunio C Hamano <redacted>
Sun, 1 Dec 2019 17:04:41 +0000 (09:04 -0800)
committerJunio C Hamano <redacted>
Sun, 1 Dec 2019 17:04:41 +0000 (09:04 -0800)
commit6c630f237e72d3adef8a089bdf984ec1e47b2708
tree876c2e2699c813cc93a9a967b154887bf21402e7tree | snapshot
parent3288d99c92b03e9488289ddf1f687d5758e15a50commit | diff
parenta376e37b2c418b8f630741552d76a5b18c87c133commit | diff
Merge branch 'jk/gitweb-anti-xss'

Some codepaths in "gitweb" that forgot to escape URLs generated
based on end-user input have been corrected.

* jk/gitweb-anti-xss:
  gitweb: escape URLs generated by href()
  t/gitweb-lib.sh: set $REQUEST_URI
  t/gitweb-lib.sh: drop confusing quotes
  t9502: pass along all arguments in xss helper
gitweb/gitweb.perl diff1 | diff2 | blob | history
git clone https://git.99rst.org/PROJECT