hgweb: urlescape all urls, HTML escape repo/tag/branch/... names
Without this, repository paths or names containing e.g. & characters or html
tags yielded strange results, possibly allowing cross-site scripting attacks.
{header}
<title>{repo|escape}: changeset {rev}:{node|short}</title>
<link rel="alternate" type="application/atom+xml"
href="{url|urlescape}atom-log" title="Atom feed for {repo|escape}"/>
<link rel="alternate" type="application/rss+xml"
href="{url|urlescape}rss-log" title="RSS feed for {repo|escape}"/>
</head>
<body>
<div class="page_header">
<a href="{logourl}" title="Mercurial" style="float: right;">Mercurial</a>
<a href="/">Mercurial</a> {pathdef%breadcrumb} / changeset
</div>
<div class="page_nav">
<a href="{url|urlescape}summary{sessionvars%urlparameter}">summary</a> |
<a href="{url|urlescape}shortlog/{rev}{sessionvars%urlparameter}">shortlog</a> |
<a href="{url|urlescape}log/{rev}{sessionvars%urlparameter}">changelog</a> |
<a href="{url|urlescape}graph{sessionvars%urlparameter}">graph</a> |
<a href="{url|urlescape}tags{sessionvars%urlparameter}">tags</a> |
<a href="{url|urlescape}bookmarks{sessionvars%urlparameter}">bookmarks</a> |
<a href="{url|urlescape}branches{sessionvars%urlparameter}">branches</a> |
<a href="{url|urlescape}file/{node|short}{sessionvars%urlparameter}">files</a> |
changeset |
<a href="{url|urlescape}raw-rev/{node|short}">raw</a> {archives%archiveentry} |
<a href="{url|urlescape}help{sessionvars%urlparameter}">help</a>
<br/>
</div>
<div>
<a class="title" href="{url|urlescape}raw-rev/{node|short}">{desc|strip|escape|firstline|nonempty} <span class="logtags">{inbranch%inbranchtag}{branches%branchtag}{tags%tagtag}{bookmarks%bookmarktag}</span></a>
</div>
<div class="title_text">
<table cellspacing="0">
<tr><td>author</td><td>{author|obfuscate}</td></tr>
<tr><td></td><td class="date age">{date|rfc822date}</td></tr>
{branch%changesetbranch}
<tr><td>changeset {rev}</td><td style="font-family:monospace">{node|short}</td></tr>
{parent%changesetparent}
{child%changesetchild}
</table></div>
<div class="page_body">
{desc|strip|escape|addbreaks|nonempty}
</div>
<div class="list_head"></div>
<div class="title_text">
<table cellspacing="0">
{files}
</table></div>
<div class="page_body">{diff}</div>
{footer}