ui-shared: use html_url_path() to get properly escaped url in form action

[ps-cgit] / ui-shared.c

diff --git a/ui-shared.c b/ui-shared.c
index 4818e70983064ac5e1d8d944e530365f240ed63e..1e12529411133d15b0949c01f310a4318048a522 100644 (file)
--- a/ui-shared.c
+++ b/ui-shared.c
@@ -38,14 +38,19 @@ char *cgit_hosturl()
 {
        char *host, *port;
 
-       host = getenv("SERVER_NAME");
-       if (!host)
-               return NULL;
-       port = getenv("SERVER_PORT");
-       if (port && atoi(port) != 80)
-               host = xstrdup(fmt("%s:%d", host, atoi(port)));
-       else
+       host = getenv("HTTP_HOST");
+       if (host) {
                host = xstrdup(host);
+       } else {
+               host = getenv("SERVER_NAME");
+               if (!host)
+                       return NULL;
+               port = getenv("SERVER_PORT");
+               if (port && atoi(port) != 80)
+                       host = xstrdup(fmt("%s:%d", host, atoi(port)));
+               else
+                       host = xstrdup(host);
+       }
        return host;
 }
 
@@ -201,36 +206,36 @@ static char *repolink(char *title, char *class, char *page, char *head,
        }
        html(" href='");
        if (ctx.cfg.virtual_root) {
-               html_attr(ctx.cfg.virtual_root);
+               html_url_path(ctx.cfg.virtual_root);
                if (ctx.cfg.virtual_root[strlen(ctx.cfg.virtual_root) - 1] != '/')
                        html("/");
-               html_attr(ctx.repo->url);
+               html_url_path(ctx.repo->url);
                if (ctx.repo->url[strlen(ctx.repo->url) - 1] != '/')
                        html("/");
                if (page) {
-                       html(page);
+                       html_url_path(page);
                        html("/");
                        if (path)
-                               html_attr(path);
+                               html_url_path(path);
                }
        } else {
                html(ctx.cfg.script_name);
                html("?url=");
-               html_attr(ctx.repo->url);
+               html_url_arg(ctx.repo->url);
                if (ctx.repo->url[strlen(ctx.repo->url) - 1] != '/')
                        html("/");
                if (page) {
-                       html(page);
+                       html_url_arg(page);
                        html("/");
                        if (path)
-                               html_attr(path);
+                               html_url_arg(path);
                }
                delim = "&";
        }
        if (head && strcmp(head, ctx.repo->defbranch)) {
                html(delim);
                html("h=");
-               html_attr(head);
+               html_url_arg(head);
                delim = "&";
        }
        return fmt("%s", delim);
@@ -245,13 +250,18 @@ static void reporevlink(char *page, char *name, char *title, char *class,
        if (rev && strcmp(rev, ctx.qry.head)) {
                html(delim);
                html("id=");
-               html_attr(rev);
+               html_url_arg(rev);
        }
        html("'>");
        html_txt(name);
        html("</a>");
 }
 
+void cgit_summary_link(char *name, char *title, char *class, char *head)
+{
+       reporevlink(NULL, name, title, class, head, NULL, NULL);
+}
+
 void cgit_tree_link(char *name, char *title, char *class, char *head,
                    char *rev, char *path)
 {
@@ -273,17 +283,17 @@ void cgit_log_link(char *name, char *title, char *class, char *head,
        if (rev && strcmp(rev, ctx.qry.head)) {
                html(delim);
                html("id=");
-               html_attr(rev);
+               html_url_arg(rev);
                delim = "&";
        }
        if (grep && pattern) {
                html(delim);
                html("qt=");
-               html_attr(grep);
+               html_url_arg(grep);
                delim = "&";
                html(delim);
                html("q=");
-               html_attr(pattern);
+               html_url_arg(pattern);
        }
        if (ofs > 0) {
                html(delim);
@@ -328,13 +338,13 @@ void cgit_diff_link(char *name, char *title, char *class, char *head,
        if (new_rev && strcmp(new_rev, ctx.qry.head)) {
                html(delim);
                html("id=");
-               html_attr(new_rev);
+               html_url_arg(new_rev);
                delim = "&amp;";
        }
        if (old_rev) {
                html(delim);
                html("id2=");
-               html_attr(old_rev);
+               html_url_arg(old_rev);
        }
        html("'>");
        html_txt(name);
@@ -486,9 +496,9 @@ void cgit_print_docend()
        if (ctx.cfg.footer)
                html_include(ctx.cfg.footer);
        else {
-               html("<div class='footer'>generated ");
+               htmlf("<div class='footer'>generated  by cgit %s at ",
+                       cgit_version);
                cgit_print_date(time(NULL), FMT_LONGDATE, ctx.cfg.local_time);
-               htmlf(" by cgit %s", cgit_version);
                html("</div>\n");
        }
        html("</body>\n</html>\n");
@@ -593,8 +603,7 @@ void cgit_print_pageheader(struct cgit_context *ctx)
        if (ctx->repo) {
                cgit_index_link("index", NULL, NULL, NULL, 0);
                html(" : ");
-               reporevlink(NULL, ctx->repo->name, NULL, hc(cmd, "summary"),
-                           ctx->qry.head, NULL, NULL);
+               cgit_summary_link(ctx->repo->name, ctx->repo->name, NULL, NULL);
                html("</td><td class='form'>");
                html("<form method='get' action=''>\n");
                add_hidden_formfields(0, 1, ctx->qry.page);
@@ -622,8 +631,7 @@ void cgit_print_pageheader(struct cgit_context *ctx)
 
        html("<table class='tabs'><tr><td>\n");
        if (ctx->repo) {
-               reporevlink(NULL, "summary", NULL, hc(cmd, "summary"),
-                           ctx->qry.head, NULL, NULL);
+               cgit_summary_link("summary", NULL, NULL, ctx->qry.head);
                cgit_refs_link("refs", NULL, hc(cmd, "refs"), ctx->qry.head,
                               ctx->qry.sha1, NULL);
                cgit_log_link("log", NULL, hc(cmd, "log"), ctx->qry.head,
@@ -641,8 +649,8 @@ void cgit_print_pageheader(struct cgit_context *ctx)
                html("</td><td class='form'>");
                html("<form class='right' method='get' action='");
                if (ctx->cfg.virtual_root)
-                       html_attr(cgit_fileurl(ctx->qry.repo, "log",
-                                              ctx->qry.path, NULL));
+                       html_url_path(cgit_fileurl(ctx->qry.repo, "log",
+                                                  ctx->qry.path, NULL));
                html("'>\n");
                add_hidden_formfields(1, 0, "log");
                html("<select name='qt'>\n");