From owner-freebsd-cvsweb@FreeBSD.ORG  Thu May  6 14:55:58 2004
Return-Path: <owner-freebsd-cvsweb@FreeBSD.ORG>
Delivered-To: freebsd-cvsweb@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id 01FA016A4CE
	for <freebsd-cvsweb@FreeBSD.org>;
	Thu,  6 May 2004 14:55:58 -0700 (PDT)
Received: from smtp2.pp.htv.fi (smtp2.pp.htv.fi [213.243.153.14])
	by mx1.FreeBSD.org (Postfix) with ESMTP id 7B3B843D41
	for <freebsd-cvsweb@FreeBSD.org>;
	Thu,  6 May 2004 14:55:57 -0700 (PDT)
	(envelope-from scop@FreeBSD.org)
Received: from posti.pp.htv.fi (posti.pp.htv.fi [212.90.64.50])
	by smtp2.pp.htv.fi (Postfix) with ESMTP
	id 52B4E297A63; Fri,  7 May 2004 00:55:56 +0300 (EEST)
Received: from [62.78.130.181] (cs78130181.pp.htv.fi [62.78.130.181])
	/8.11.1) with ESMTP id i46Ltth08980;
	Fri, 7 May 2004 00:55:56 +0300 (EETDST)
From: Ville =?ISO-8859-1?Q?Skytt=E4?= <scop@FreeBSD.org>
To: Brad Tofel <brad@archive.org>
In-Reply-To: <03c901c432f4$e6bd9650$3af0edd1@WORKSTATION17>
References: <03c901c432f4$e6bd9650$3af0edd1@WORKSTATION17>
Content-Type: text/plain
Organization: FreeBSD
Message-Id: <1083880555.5261.879.camel@bobcat.mine.nu>
Mime-Version: 1.0
X-Mailer: Ximian Evolution 1.4.5 (1.4.5-7) 
Date: Fri, 07 May 2004 00:55:55 +0300
Content-Transfer-Encoding: 7bit
cc: freebsd-cvsweb@FreeBSD.org
Subject: Re: cvsweb bug in 3.0.0
X-BeenThere: freebsd-cvsweb@freebsd.org
X-Mailman-Version: 2.1.1
Precedence: list
List-Id: CVS Web maintenance mailing list <freebsd-cvsweb.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-cvsweb>,
	<mailto:freebsd-cvsweb-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-cvsweb>
List-Post: <mailto:freebsd-cvsweb@freebsd.org>
List-Help: <mailto:freebsd-cvsweb-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-cvsweb>,
	<mailto:freebsd-cvsweb-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Thu, 06 May 2004 21:55:58 -0000

On Thu, 2004-05-06 at 02:01, Brad Tofel wrote:
> need an &htmlquote() in a few places to protect HTML chars in the actual
> diff:
> 
> Note that I've only tested 1 of these changed branches needed for my
> purposes, and probably missed another one or two needed, but it's easy to
> see the problem and the fix..
> 
> Brad
> 
> 3361c3361
> <       printf(<<EOF, scalar(@$leftColRef[$j]));
> ---
> >       printf(<<EOF, &htmlquote(scalar(@$leftColRef[$j])));

Right, this was a bug, the fix was already submitted by Mark A. Mankins
a couple of weeks ago and is now in CVS (using a bit different, and
AFAICS a more "correct" approach):
http://www.freebsd.org/cgi/cvsweb.cgi/projects/cvsweb/cvsweb.cgi.diff?r1=1.255&r2=1.256

> 3711c3711
> <           printf(<<EOF, $_);
> ---
> >           printf(<<EOF, &htmlquote($_));
> 3727c3727
> <         printf(<<EOF, $_, $_);
> ---
> >         printf(<<EOF, &htmlquote($_), &htmlquote($_));

These seem incorrect to me.  If you had included a bit of context in the
patch (hint, hint :), both of the above printf()'s have this as their
preceding line:

  $_ = spacedHtmlText($rest, $d{tabstop});

spacedHtmlText() expands tabs, fiddles with whitespace and htmlifies
stuff by calling htmlify().  And as the very first thing, htmlify() does
a htmlquote()... it also does htmlunquote() and a bunch of other hairy
things under certain circumstances though.

So, if there's a bug, I'd suspect htmlify().  Wrong or right, a test
case would be nice :)  Your approach above would seem to break the
htmlification (ie. creating HTML links to various things) feature.