Git 1.7.2.5

Signed-off-by: Junio C Hamano <gitster@pobox.com>

diff --cc Documentation/RelNotes/1.7.2.5.txt
index 0000000,0000000..bf976c4
new file mode 100644 (file)
--- /dev/null
--- /dev/null
+++ b/Documentation/RelNotes/1.7.2.5.txt
@@@ -1,0 -1,0 +1,8 @@@
++Git v1.7.2.5 Release Notes
++==========================
++
++Fixes since v1.7.2.4
++--------------------
++
++ * "gitweb" can sometimes be tricked into parrotting a filename argument
++   given in a request without properly quoting.

diff --cc GIT-VERSION-GEN
index 1c0f85c,5e8077e..ec4c49a
--- 1/GIT-VERSION-GEN
--- 2/GIT-VERSION-GEN
+++ b/GIT-VERSION-GEN
@@@ -1,7 -1,7 +1,7 @@@
  #!/bin/sh
  
  GVF=GIT-VERSION-FILE
- DEF_VER=v1.7.2.4
 -DEF_VER=v1.7.1.4
++DEF_VER=v1.7.2.5
  
  LF='
  '

diff --cc RelNotes
index c81a98e,86af99b..17d37af
--- 1/RelNotes
--- 2/RelNotes
+++ b/RelNotes
@@@ -1,1 -1,1 +1,1 @@@
- Documentation/RelNotes/1.7.2.4.txt
 -Documentation/RelNotes/1.7.1.4.txt
++Documentation/RelNotes/1.7.2.5.txt

diff --cc gitweb/gitweb.perl
index 84261bb,b51f5bf..8b8ab29
--- 1/gitweb/gitweb.perl
--- 2/gitweb/gitweb.perl
+++ b/gitweb/gitweb.perl
@@@ -5629,8 -5408,10 +5636,8 @@@ sub git_blob 
                        chomp $line;
                        $nr++;
                        $line = untabify($line);
 -                      printf "<div class=\"pre\"><a id=\"l%i\" href=\""
 -                              . esc_attr(href(-replay => 1))
 -                              . "#l%i\" class=\"linenr\">%4i</a> %s</div>\n",
 -                             $nr, $nr, $nr, esc_html($line, -nbsp=>1);
 +                      printf qq!<div class="pre"><a id="l%i" href="%s#l%i" class="linenr">%4i</a> %s</div>\n!,
-                              $nr, href(-replay => 1), $nr, $nr, $syntax ? $line : esc_html($line, -nbsp=>1);
++                             $nr, esc_attr(href(-replay => 1)), $nr, $nr, $syntax ? $line : esc_html($line, -nbsp=>1);
                }
        }
        close $fd