From mboxrd@z Thu Jan 1 00:00:00 1970 From: john at keeping.me.uk (John Keeping) Date: Sun, 12 Jan 2014 19:45:15 +0000 Subject: [PATCH 1/3] ui-refs: escape HTML chars in author and tagger names Message-ID: <432e1f40c0d887db602ec9411ae16c45896a54f5.1389555852.git.john@keeping.me.uk> Everywhere else we use html_txt to escape any special characters in these variables. Do so here as well. Signed-off-by: John Keeping --- I spotted this while looking at Jason's jd/gravatar series. The following two patches cover other similar issues I spotted while auditing all uses of "html()". I think everything else is OK. ui-refs.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/ui-refs.c b/ui-refs.c index 20c91e3..c97b0c6 100644 --- a/ui-refs.c +++ b/ui-refs.c @@ -155,9 +155,9 @@ static int print_tag(struct refinfo *ref) html(""); if (info) { if (info->tagger) - html(info->tagger); + html_txt(info->tagger); } else if (ref->object->type == OBJ_COMMIT) { - html(ref->commit->author); + html_txt(ref->commit->author); } html(""); if (info) { -- 1.8.5.226.g0d60d77