Drew Northup <n1xim.em...@gmail.com> writes: > Something like this may be useful to defuse the "file" parameter, but > I presume a more definitive fix is in order...
A proper fix will have to add esc_html to the feed generation, something like this (untested): diff --git a/gitweb/gitweb.perl b/gitweb/gitweb.perl index 10ed9e5..a51a8ba 100755 --- a/gitweb/gitweb.perl +++ b/gitweb/gitweb.perl @@ -8055,6 +8055,7 @@ sub git_feed { $feed_type = 'history'; } $title .= " $feed_type"; + $title = esc_html($title); my $descr = git_get_project_description($project); if (defined $descr) { $descr = esc_html($descr); Andreas. -- Andreas Schwab, sch...@linux-m68k.org GPG Key fingerprint = 58CA 54C7 6D53 942B 1756 01D3 44D5 214B 8276 4ED5 "And now for something completely different." -- To unsubscribe from this list: send the line "unsubscribe git" in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html