Escape project names before creating pathinfo URLs

diff --git a/gitweb/gitweb.perl b/gitweb/gitweb.perl
index 4abd7ac1adae1bb166d239e5efe75bebaf8110d7..12843a4846563842aef8f0311096794ad70011c3 100755 (executable)
--- a/gitweb/gitweb.perl
+++ b/gitweb/gitweb.perl
@@ -628,7 +628,7 @@ (%)
        my ($use_pathinfo) = gitweb_check_feature('pathinfo');
        if ($use_pathinfo) {
                # use PATH_INFO for project name
-               $href .= "/$params{'project'}" if defined $params{'project'};
+               $href .= "/".esc_url($params{'project'}) if defined $params{'project'};
                delete $params{'project'};
 
                # Summary just uses the project path URL
@@ -2570,7 +2570,7 @@ sub git_header_html {
                my $action = $my_uri;
                my ($use_pathinfo) = gitweb_check_feature('pathinfo');
                if ($use_pathinfo) {
-                       $action .= "/$project";
+                       $action .= "/".esc_url($project);
                } else {
                        $cgi->param("p", $project);
                }