Everywhere else we use html_txt to escape any special characters in
these variables. Do so here as well.
Signed-off-by: John Keeping <john@keeping.me.uk>
html("</td><td>");
if (info) {
if (info->tagger)
html("</td><td>");
if (info) {
if (info->tagger)
+ html_txt(info->tagger);
} else if (ref->object->type == OBJ_COMMIT) {
} else if (ref->object->type == OBJ_COMMIT) {
- html(ref->commit->author);
+ html_txt(ref->commit->author);
}
html("</td><td colspan='2'>");
if (info) {
}
html("</td><td colspan='2'>");
if (info) {