From 2bb1fb8f44bcd39c1f54b33377212636ae8c9558 Mon Sep 17 00:00:00 2001
From: Vladimir Vissoultchev <wqweto@gmail.com>
Date: Tue, 28 Jul 2015 19:51:40 +0300
Subject: [PATCH] Use EscapePound in link hrefs in diff/file views

---
 templates/repo/diff.tmpl      | 16 ++++++++--------
 templates/repo/home.tmpl      |  3 ++-
 templates/repo/view_file.tmpl |  6 +++---
 3 files changed, 13 insertions(+), 12 deletions(-)

diff --git a/templates/repo/diff.tmpl b/templates/repo/diff.tmpl
index b9dc87de7..268bbc166 100644
--- a/templates/repo/diff.tmpl
+++ b/templates/repo/diff.tmpl
@@ -6,7 +6,7 @@
         {{if .IsDiffCompare }}
         <div class="panel panel-info panel-radius compare-head-box">
             <div class="panel-header">
-                <a class="pull-right btn btn-blue btn-header btn-medium btn-radius" rel="nofollow" href="{{.SourcePath}}">{{.i18n.Tr "repo.diff.browse_source"}}</a>
+                <a class="pull-right btn btn-blue btn-header btn-medium btn-radius" rel="nofollow" href="{{EscapePound .SourcePath}}">{{.i18n.Tr "repo.diff.browse_source"}}</a>
                 <h4><a href="{{$.RepoLink}}/commit/{{.BeforeCommitId}}" class="label label-green">{{ShortSha .BeforeCommitId}}</a> ... <a href="{{$.RepoLink}}/commit/{{.AfterCommitId}}" class="label label-green">{{ShortSha .AfterCommitId}}</a></h4>
             </div>
             <div class="panel-body compare">
@@ -16,7 +16,7 @@
         {{else}}
         <div class="panel panel-info panel-radius diff-head-box">
             <div class="panel-header">
-                <a class="pull-right btn btn-blue btn-header btn-medium btn-radius" rel="nofollow" href="{{.SourcePath}}">{{.i18n.Tr "repo.diff.browse_source"}}</a>
+                <a class="pull-right btn btn-blue btn-header btn-medium btn-radius" rel="nofollow" href="{{EscapePound .SourcePath}}">{{.i18n.Tr "repo.diff.browse_source"}}</a>
                 <h4 class="commit-message">{{RenderCommitMessage .Commit.Message $.RepoLink}}</h4>
             </div>
             <div class="panel-body">
@@ -37,7 +37,7 @@
                     <img class="avatar-30" src="{{AvatarLink .Commit.Author.Email}}" />
                     <strong>{{.Commit.Author.Name}}</strong>
                     {{end}}
-                    <span class="text-grey" id="authored-time">{{TimeSince .Commit.Author.When $.Lang}}</span> 
+                    <span class="text-grey" id="authored-time">{{TimeSince .Commit.Author.When $.Lang}}</span>
                 </p>
             </div>
         </div>
@@ -90,9 +90,9 @@
                     {{end}}
                 </div>
                 {{if $file.IsDeleted}}
-                <a class="btn btn-gray btn-header btn-radius text-black pull-right" rel="nofollow" href="{{$.BeforeSourcePath}}/{{.Name}}">{{$.i18n.Tr "repo.diff.view_file"}}</a>
+                <a class="btn btn-gray btn-header btn-radius text-black pull-right" rel="nofollow" href="{{EscapePound $.BeforeSourcePath}}/{{EscapePound .Name}}">{{$.i18n.Tr "repo.diff.view_file"}}</a>
                 {{else}}
-                <a class="btn btn-gray btn-header btn-radius text-black pull-right" rel="nofollow" href="{{$.SourcePath}}/{{.Name}}">{{$.i18n.Tr "repo.diff.view_file"}}</a>
+                <a class="btn btn-gray btn-header btn-radius text-black pull-right" rel="nofollow" href="{{EscapePound $.SourcePath}}/{{EscapePound .Name}}">{{$.i18n.Tr "repo.diff.view_file"}}</a>
                 {{end}}
                 <span class="file">{{$file.Name}}</span>
             </div>
@@ -100,7 +100,7 @@
             <div class="panel-body file-body file-code code-view code-diff">
                 {{if $isImage}}
                     <div class="text-center">
-                        <img src="{{$.RawPath}}/{{.Name}}">
+                        <img src="{{$.RawPath}}/{{EscapePound .Name}}">
                     </div>
                 {{else}}
                 <table>
@@ -114,7 +114,7 @@
                             <td class="lines-num lines-num-new">
                                 <span rel="{{if $line.RightIdx}}diff-{{Sha1 $file.Name}}R{{$line.RightIdx}}{{end}}">{{if $line.RightIdx}}{{$line.RightIdx}}{{end}}</span>
                             </td>
-                            
+
                             <td class="lines-code">
                                 <pre>{{$line.Content}}</pre>
                             </td>
@@ -126,7 +126,7 @@
                 {{end}}
             </div>
         </div>
-        <br> 
+        <br>
         {{end}}
         {{end}}
     </div>
diff --git a/templates/repo/home.tmpl b/templates/repo/home.tmpl
index 7a18ed985..831a3962d 100644
--- a/templates/repo/home.tmpl
+++ b/templates/repo/home.tmpl
@@ -50,7 +50,8 @@
                         {{if eq $i $l}}
                         <span class="bread">{{$v}}</span>
                         {{else}}
-                        <span class="bread"><a href="{{EscapePound $.BranchLink}}/{{index $.Paths $i}}">{{$v}}</a></span>
+                        {{ $p := index $.Paths $i}}
+                        <span class="bread"><a href="{{EscapePound $.BranchLink}}/{{EscapePound $p}}">{{$v}}</a></span>
                         {{end}}
                     {{end}}
                 </li>
diff --git a/templates/repo/view_file.tmpl b/templates/repo/view_file.tmpl
index 4d11170bd..274c7df22 100644
--- a/templates/repo/view_file.tmpl
+++ b/templates/repo/view_file.tmpl
@@ -13,11 +13,11 @@
 	    {{end}}
         {{if not .ReadmeInList}}
             {{if not .IsCommit}}
-                <a class="right" href="{{.RepoLink}}/src/{{.CommitId}}/{{.TreeName}}">
+                <a class="right" href="{{.RepoLink}}/src/{{.CommitId}}/{{EscapePound .TreeName}}">
                     <button class="btn btn-medium btn-gray btn-right-radius btn-comb">{{.i18n.Tr "repo.file_permalink"}}</button>
                 </a>
             {{end}}
-            <a class="right" href="{{.RepoLink}}/commits/{{EscapePound .BranchName}}/{{.TreeName}}">
+            <a class="right" href="{{.RepoLink}}/commits/{{EscapePound .BranchName}}/{{EscapePound .TreeName}}">
                 <button class="btn btn-medium btn-gray btn-right-radius btn-comb">{{.i18n.Tr "repo.file_history"}}</button>
             </a>
             <a class="right" href="{{EscapePound .FileLink}}">
@@ -47,4 +47,4 @@
         </table>
     	{{end}}
     </div>
-</div>
\ No newline at end of file
+</div>