The code to sanitize control characters before passing it to
"highlight" filter lost known-to-be-safe control characters by
mistake.

* os/gitweb-highlight-uncaptured:
  gitweb: fix error in sanitize when highlight is enabled

"gitweb", when sorting by age to show repositories with new
activities first, used to sort repositories with absolutely nothing
in it early, which was not very useful.

* md/gitweb-sort-by-age:
  gitweb: Sort projects with undefined ages last

$1 becomes undef by internal regex, since it has no capture groups.

Match against accpetable control characters using index() instead of a regex.

Signed-off-by: Orgad Shaneh <orgads@gmail.com>
Signed-off-by: Junio C Hamano <gitster@pobox.com>

Sorting gitweb's project list by age ('Last Change') currently shows
projects with undefined ages at the head of the list. This gives a less
useful result when there are a number of projects that are missing or
otherwise faulty and one is trying to see what projects have been
updated recently.

Fix by sorting these projects with undefined ages at the bottom of the
list when sorting by age.

Signed-off-by: Matthew Daley <mattjd@gmail.com>
Signed-off-by: Junio C Hamano <gitster@pobox.com>

The key "gitweb.remote_heads" is not legal git config; this maps it to
"gitweb.remoteheads".

* pp/gitweb-config-underscore:
  gitweb: make remote_heads config setting work

Syntax highlighting in "gitweb" was not quite working.

* rh/maint-gitweb-highlight-ext:
  gitweb.perl: fix %highlight_ext mappings

Git configuration items can not contain underscores in their section
and bottom-level variable name; the 'remote_heads' feature can not
be enabled on a per-repository basis with that name.

This changes the git-config option to be `gitweb.remoteheads` but does
not change the gitweb.conf option, to avoid backwards compatibility
issues.  We strip underscores from keys before looking through
git-config output for them.

An existing check on keynames was overly eager to reject non-word
letters, but if we ever start using three-level names, the middle
level string can contain almost anything, so fix that as well while
we are in the vicinity.

Signed-off-by: Phil Pennock <phil@apcera.com>
Signed-off-by: Jeff King <peff@peff.net>
Signed-off-by: Junio C Hamano <gitster@pobox.com>

Fixes an XSS vulnerability in gitweb.

* jk/maint-gitweb-xss:
  gitweb: escape html in rss title

The title of an RSS feed is generated from many components,
including the filename provided as a query parameter, but we
failed to quote it.  Besides showing the wrong output, this
is a vector for XSS attacks.

Signed-off-by: Jeff King <peff@peff.net>

When commit 592ea41 refactored the list of extensions for
syntax highlighting, it failed to take into account perl's
operator precedence within lists. As a result, we end up
creating a dictionary of one-to-one elements when the intent
was to map mutliple related types to one main type (e.g.,
bash, ksh, zsh, and sh should all map to sh since they share
similar syntax, but we ended up just mapping "bash" to
"bash" and so forth).

This patch adds parentheses to make the mapping as the
original change intended. It also reorganizes the list to
keep mapped extensions together.

Signed-off-by: Richard Hubbell <richard_hubbe11@lavabit.com>
Signed-off-by: Jeff King <peff@peff.net>