Git 1.7.2.5

Signed-off-by: Junio C Hamano <gitster@pobox.com>
This commit is contained in:
Junio C Hamano 2010-12-15 11:45:36 -08:00
commit b91779f17e
9 changed files with 111 additions and 19 deletions

View File

@ -0,0 +1,20 @@
Git v1.6.4.5 Release Notes
==========================
Fixes since v1.6.4.4
--------------------
* Simplified base85 implementation.
* An overlong line after ".gitdir: " in a git file caused out of bounds
access to an array on the stack.
* "git count-objects" did not handle packs larger than 4G.
* "git rev-parse --parseopt --stop-at-non-option" did not stop at non option
when --keep-dashdash was in effect.
* "gitweb" can sometimes be tricked into parrotting a filename argument
given in a request without properly quoting.
Other minor fixes and documentation updates are included.

View File

@ -0,0 +1,18 @@
Git v1.6.5.9 Release Notes
==========================
Fixes since v1.6.5.8
--------------------
* An overlong line after ".gitdir: " in a git file caused out of bounds
access to an array on the stack.
* "git blame -L $start,$end" segfaulted when too large $start was given.
* "git rev-parse --parseopt --stop-at-non-option" did not stop at non option
when --keep-dashdash was in effect.
* "gitweb" can sometimes be tricked into parrotting a filename argument
given in a request without properly quoting.
Other minor fixes and documentation updates are included.

View File

@ -0,0 +1,23 @@
Git v1.6.6.3 Release Notes
==========================
Fixes since v1.6.6.2
--------------------
* An overlong line after ".gitdir: " in a git file caused out of bounds
access to an array on the stack.
* "git bisect $path" did not correctly diagnose an error when given a
non-existent path.
* "git blame -L $start,$end" segfaulted when too large $start was given.
* "git imap-send" did not write draft box with CRLF line endings per RFC.
* "git rev-parse --parseopt --stop-at-non-option" did not stop at non option
when --keep-dashdash was in effect.
* "gitweb" can sometimes be tricked into parrotting a filename argument
given in a request without properly quoting.
Other minor fixes and documentation updates are included.

View File

@ -0,0 +1,8 @@
Git v1.7.0.9 Release Notes
==========================
Fixes since v1.7.0.8
--------------------
* "gitweb" can sometimes be tricked into parrotting a filename argument
given in a request without properly quoting.

View File

@ -0,0 +1,8 @@
Git v1.7.1.4 Release Notes
==========================
Fixes since v1.7.1.3
--------------------
* "gitweb" can sometimes be tricked into parrotting a filename argument
given in a request without properly quoting.

View File

@ -0,0 +1,8 @@
Git v1.7.2.5 Release Notes
==========================
Fixes since v1.7.2.4
--------------------
* "gitweb" can sometimes be tricked into parrotting a filename argument
given in a request without properly quoting.

View File

@ -1,7 +1,7 @@
#!/bin/sh
GVF=GIT-VERSION-FILE
DEF_VER=v1.7.2.4
DEF_VER=v1.7.2.5
LF='
'

View File

@ -1 +1 @@
Documentation/RelNotes/1.7.2.4.txt
Documentation/RelNotes/1.7.2.5.txt

View File

@ -1332,6 +1332,13 @@ sub esc_url {
return $str;
}
# quote unsafe characters in HTML attributes
sub esc_attr {
# for XHTML conformance escaping '"' to '&quot;' is not enough
return esc_html(@_);
}
# replace invalid utf8 character with SUBSTITUTION sequence
sub esc_html {
my $str = shift;
@ -1737,7 +1744,7 @@ sub format_ref_marker {
hash=>$dest
)}, $name);
$markers .= " <span class=\"$class\" title=\"$ref\">" .
$markers .= " <span class=\"".esc_attr($class)."\" title=\"".esc_attr($ref)."\">" .
$link . "</span>";
}
}
@ -1821,7 +1828,7 @@ sub git_get_avatar {
return $pre_white .
"<img width=\"$size\" " .
"class=\"avatar\" " .
"src=\"$url\" " .
"src=\"".esc_url($url)."\" " .
"alt=\"\" " .
"/>" . $post_white;
} else {
@ -2532,7 +2539,7 @@ sub git_show_project_tagcloud {
} else {
my @tags = sort { $cloud->{$a}->{count} <=> $cloud->{$b}->{count} } keys %$cloud;
return '<p align="center">' . join (', ', map {
"<a href=\"$home_link?by_tag=$_\">$cloud->{$_}->{topname}</a>"
$cgi->a({-href=>"$home_link?by_tag=$_"}, $cloud->{$_}->{topname})
} splice(@tags, 0, $count)) . '</p>';
}
}
@ -3429,11 +3436,11 @@ EOF
# print out each stylesheet that exist, providing backwards capability
# for those people who defined $stylesheet in a config file
if (defined $stylesheet) {
print '<link rel="stylesheet" type="text/css" href="'.$stylesheet.'"/>'."\n";
print '<link rel="stylesheet" type="text/css" href="'.esc_url($stylesheet).'"/>'."\n";
} else {
foreach my $stylesheet (@stylesheets) {
next unless $stylesheet;
print '<link rel="stylesheet" type="text/css" href="'.$stylesheet.'"/>'."\n";
print '<link rel="stylesheet" type="text/css" href="'.esc_url($stylesheet).'"/>'."\n";
}
}
if (defined $project) {
@ -3446,7 +3453,7 @@ EOF
my $type = lc($format);
my %link_attr = (
'-rel' => 'alternate',
'-title' => "$project - $href_params{'-title'} - $format feed",
'-title' => esc_attr("$project - $href_params{'-title'} - $format feed"),
'-type' => "application/$type+xml"
);
@ -3473,13 +3480,13 @@ EOF
} else {
printf('<link rel="alternate" title="%s projects list" '.
'href="%s" type="text/plain; charset=utf-8" />'."\n",
$site_name, href(project=>undef, action=>"project_index"));
esc_attr($site_name), href(project=>undef, action=>"project_index"));
printf('<link rel="alternate" title="%s projects feeds" '.
'href="%s" type="text/x-opml" />'."\n",
$site_name, href(project=>undef, action=>"opml"));
esc_attr($site_name), href(project=>undef, action=>"opml"));
}
if (defined $favicon) {
print qq(<link rel="shortcut icon" href="$favicon" type="image/png" />\n);
print qq(<link rel="shortcut icon" href=").esc_url($favicon).qq(" type="image/png" />\n);
}
print "</head>\n" .
@ -3492,7 +3499,7 @@ EOF
print "<div class=\"page_header\">\n" .
$cgi->a({-href => esc_url($logo_url),
-title => $logo_label},
qq(<img src="$logo" width="72" height="27" alt="git" class="logo"/>));
qq(<img src=").esc_url($logo).qq(" width="72" height="27" alt="git" class="logo"/>));
print $cgi->a({-href => esc_url($home_link)}, $home_link_str) . " / ";
if (defined $project) {
print $cgi->a({-href => href(action=>"summary")}, esc_html($project));
@ -3590,7 +3597,7 @@ sub git_footer_html {
insert_file($site_footer);
}
print qq!<script type="text/javascript" src="$javascript"></script>\n!;
print qq!<script type="text/javascript" src="!.esc_url($javascript).qq!"></script>\n!;
if (defined $action &&
$action eq 'blame_incremental') {
print qq!<script type="text/javascript">\n!.
@ -5610,14 +5617,14 @@ sub git_blob {
} else {
print "<div class=\"page_nav\">\n" .
"<br/><br/></div>\n" .
"<div class=\"title\">$hash</div>\n";
"<div class=\"title\">".esc_html($hash)."</div>\n";
}
git_print_page_path($file_name, "blob", $hash_base);
print "<div class=\"page_body\">\n";
if ($mimetype =~ m!^image/!) {
print qq!<img type="$mimetype"!;
print qq!<img type="!.esc_attr($mimetype).qq!"!;
if ($file_name) {
print qq! alt="$file_name" title="$file_name"!;
print qq! alt="!.esc_attr($file_name).qq!" title="!.esc_attr($file_name).qq!"!;
}
print qq! src="! .
href(action=>"blob_plain", hash=>$hash,
@ -5630,7 +5637,7 @@ sub git_blob {
$nr++;
$line = untabify($line);
printf qq!<div class="pre"><a id="l%i" href="%s#l%i" class="linenr">%4i</a> %s</div>\n!,
$nr, href(-replay => 1), $nr, $nr, $syntax ? $line : esc_html($line, -nbsp=>1);
$nr, esc_attr(href(-replay => 1)), $nr, $nr, $syntax ? $line : esc_html($line, -nbsp=>1);
}
}
close $fd
@ -5692,7 +5699,7 @@ sub git_tree {
undef $hash_base;
print "<div class=\"page_nav\">\n";
print "<br/><br/></div>\n";
print "<div class=\"title\">$hash</div>\n";
print "<div class=\"title\">".esc_html($hash)."</div>\n";
}
if (defined $file_name) {
$basedir = $file_name;
@ -6160,7 +6167,7 @@ sub git_blobdiff {
git_print_header_div('commit', esc_html($co{'title'}), $hash_base);
} else {
print "<div class=\"page_nav\"><br/>$formats_nav<br/></div>\n";
print "<div class=\"title\">$hash vs $hash_parent</div>\n";
print "<div class=\"title\">".esc_html("$hash vs $hash_parent")."</div>\n";
}
if (defined $file_name) {
git_print_page_path($file_name, "blob", $hash_base);