From f0286f91a9ec65c30a27f070a179ca9f6de53dbd Mon Sep 17 00:00:00 2001
From: Kirill Miazine <km@krot.org>
Date: Wed, 28 Jun 2017 23:00:31 +0200
Subject: [PATCH] URI escape branch names in URLs. Don't strip + from branch
 name.

---
 cgi-bin/show_history.pl | 2 +-
 templates/fstatus.tt    | 2 +-
 templates/log.tt        | 2 +-
 templates/status.tt     | 2 +-
 4 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/cgi-bin/show_history.pl b/cgi-bin/show_history.pl
index 7d5219c..50b1bf3 100755
--- a/cgi-bin/show_history.pl
+++ b/cgi-bin/show_history.pl
@@ -31,7 +31,7 @@ die $DBI::errstr unless $db;
 
 my $query = new CGI;
 my $member = $query->param('nm'); $member =~ s/[^a-zA-Z0-9_ -]//g;
-my $branch = $query->param('br'); $branch =~ s/[^a-zA-Z0-9_ .-]//g;
+my $branch = $query->param('br'); $branch =~ s/[^a-zA-Z0-9+_ .-]//g;
 my $hm = $query->param('hm');  $hm =~ s/[^a-zA-Z0-9_ -]//g;
 $hm = '240' unless $hm =~ /^\d+$/;
 
diff --git a/templates/fstatus.tt b/templates/fstatus.tt
index 1e2c8e9..429a448 100644
--- a/templates/fstatus.tt
+++ b/templates/fstatus.tt
@@ -111,7 +111,7 @@ See accompanying License file for license details
 [% END %]
 <tr [% PROCESS cl bgfor=row.stage %]>
     <td [% PROCESS cl bgfor=row.current_stage %]><a 
-    href="show_history.pl?nm=[% row.sysname %]&amp;br=[% row.branch %]"
+    href="show_history.pl?nm=[% row.sysname %]&amp;br=[% row.branch | uri %]"
     title="History"
   >[% row.sysname %]</a></td>
     <td>[% PROCESS sysnotes %]</td>
diff --git a/templates/log.tt b/templates/log.tt
index 8a76945..0e9b8b2 100644
--- a/templates/log.tt
+++ b/templates/log.tt
@@ -46,7 +46,7 @@ See accompanying License file for license details
     </tr>
     <tr>
         <td>[% system %]</td>
-        <td><a href="/cgi-bin/show_history.pl?nm=[% system %]&amp;br=[% branch %]">[% branch %]</a></td>
+        <td><a href="/cgi-bin/show_history.pl?nm=[% system %]&amp;br=[% branch | uri %]">[% branch %]</a></td>
         <td>[% info_row.operating_system %] [% info_row.os_version %]</td>
         <td>[% info_row.compiler %] [% info_row.compiler_version %]</td>
         <td>[% info_row.architecture %]</td>
diff --git a/templates/status.tt b/templates/status.tt
index 573dfb0..2e1f2e8 100644
--- a/templates/status.tt
+++ b/templates/status.tt
@@ -82,7 +82,7 @@ See accompanying License file for license details
 [% END %]
 <tr [% PROCESS cl bgfor=row.stage %]>
     <td><a 
-    href="show_history.pl?nm=[% row.sysname %]&amp;br=[% row.branch %]"
+    href="show_history.pl?nm=[% row.sysname %]&amp;br=[% row.branch | uri %]"
     title="History"
     >[% row.sysname %]</a></td>
     <td>[% PROCESS sysnotes %]</td>
-- 
2.30.2