djcev.com

diff --git a/_controllers/gitview.py b/_controllers/gitview.py
index 94289fc..13829c6 100644
--- a/_controllers/gitview.py
+++ b/_controllers/gitview.py
@@ -79,7 +79,7 @@ def init():
     if config.template_path:
         #Add the user's custom template path first
         tools.add_template_dir(config.template_path, append=False)
-    tools.add_template_dir(bf.util.path_join('_templates', config.name))
+    tools.add_template_dir(util.path_join('_templates', config.name))
 
 
 def write_log(repo, repoinfo):
@@ -106,8 +106,8 @@ def write_log(repo, repoinfo):
             # dsdelete += diff.stats.deletions
             for patch in diff:
                 pd = {
-                    "newpath": patch.delta.new_file.path,
-                    "oldpath": patch.delta.old_file.path,
+                    "newpath": util.html_escape(patch.delta.new_file.path),
+                    "oldpath": util.html_escape(patch.delta.old_file.path),
                     "status": patch.delta.status_char()
                 }
                 deltas.append(pd)
@@ -121,11 +121,11 @@ def write_log(repo, repoinfo):
                     pygments_differ)
                 patches.append(patchhtml)
         ci = {
-            "author": commit.author.name,
-            "author_email": commit.author.email,
+            "author": util.html_escape(commit.author.name),
+            "author_email": util.html_escape(commit.author.email),
             "author_time": datetime.datetime.fromtimestamp(commit.author.time),
-            "committer": commit.committer.name,
-            "committer_email": commit.committer.email,
+            "committer": util.html_escape(commit.committer.name),
+            "committer_email": util.html_escape(commit.committer.email),
             "committer_time": datetime.datetime.fromtimestamp(
                 commit.committer.time),
             "date": datetime.datetime.fromtimestamp(commit.commit_time),
@@ -134,10 +134,10 @@ def write_log(repo, repoinfo):
             # "ds_insert": dsinsert,
             # "ds_delete": dsdelete,
             "id": str(commit.id),
-            "msg": commit.message.strip(),
+            "msg": util.html_escape(commit.message.strip()),
             "parentids": parentids,
             "patches": patches,
-            "summary": commit.message.split('\n')[0]
+            "summary": util.html_escape(commit.message.split('\n')[0])
         }
         prev_id = None
         for pid in ci['parentids']:
@@ -149,7 +149,7 @@ def write_log(repo, repoinfo):
         if i == config.commitlimit: prev_id = None
         # write the single-commit view
         tools.materialize_template("git_commit.mako",
-            bf.util.path_join(config.path, repoinfo['name'],
+            util.path_join(config.path, repoinfo['name'],
             str(commit.id) + ".html"), {"commitinfo": ci, "repo": repoinfo,
             "next_id": next_id, "prev_id": prev_id} )
         next_id = str(commit.id)
@@ -157,12 +157,12 @@ def write_log(repo, repoinfo):
     # write the commit log list
     # NOTE: commented out in favor of git_repos.mako
     # tools.materialize_template('git_log.mako',
-    #     bf.util.path_join(config.path, repoinfo['name'], "log.html"),
+    #     util.path_join(config.path, repoinfo['name'], "log.html"),
     #     {"commits": cl, "repo": repoinfo })
     return cl
 
 
-def write_obj_binary(repoinfo, obj, path):
+def format_obj_binary(repoinfo, obj, path):
     # if this is a gif, jpeg, or png then display it inline
     extl = os.path.splitext(obj.name)
     if len(extl) > 0 and extl[1] != "":
@@ -171,16 +171,16 @@ def write_obj_binary(repoinfo, obj, path):
         if ext in "png jpeg jpg gif".split():
             # this looks a mess. It writes obj.data to 
             # its appropriate place in the site output tree.
-            with open(bf.util.path_join(bf.writer.output_dir, config.path,
+            with open(util.path_join(bf.writer.output_dir, config.path,
                 repoinfo['name'], config.objdir, path, obj.name), "wb") as imgf:
                 imgf.write(obj.data)
-            return True, "<img src=\"/{}\" />".format(bf.util.path_join(
+            return True, "<img src=\"/{}\" />".format(util.path_join(
                 config.path, repoinfo['name'], config.objdir, path, obj.name))
         else: return False, None
     else: return False, None
 
 
-def write_obj_text(repoinfo, obj, path):
+def format_obj_text(repoinfo, obj, path):
     # run obj.data thru pygments
     data = str(obj.data, sys.stdout.encoding)
     try:
@@ -196,31 +196,31 @@ def write_obj(fl, repo, repoinfo, tree, path):
         if obj.type_str == "tree":
             # NOTE: this recurses. (Thank you stagit.c line 1020.)
             write_obj(fl, repo, repoinfo, repo.get(obj.id),
-                bf.util.path_join(path, obj.name))
+                util.path_join(path, obj.name))
             continue
-        if not os.path.isdir(bf.util.path_join(config.path,
+        if not os.path.isdir(util.path_join(config.path,
                 repoinfo['name'], config.objdir, path)):
-            util.mkdir(bf.util.path_join(bf.writer.output_dir,
+            util.mkdir(util.path_join(bf.writer.output_dir,
                 config.path, repoinfo['name'], config.objdir, path))
         isimage = False
         objsize = human_readable_size(obj.size)
         if obj.is_binary:
-            isimage, data = write_obj_binary(repoinfo, obj, path)
-        else: data = write_obj_text(repoinfo, obj, path)
+            isimage, data = format_obj_binary(repoinfo, obj, path)
+        else: data = format_obj_text(repoinfo, obj, path)
         if obj.name.startswith('.'): safename = 'dot{}'.format(obj.name[1:])
         else: safename = obj.name
         f = {
-            "fullname": bf.util.path_join(path, obj.name),
+            "fullname": util.html_escape(util.path_join(path, obj.name)),
             "id": obj.id,
             "isbinary": obj.is_binary,
             "isimage": isimage,
             "mode": stat.filemode(obj.filemode),
-            "name": obj.name,
+            "name": util.html_escape(obj.name),
             "objsize": objsize,
-            "sfname": bf.util.path_join(path, safename),
+            "sfname": util.html_escape(util.path_join(path, safename)),
             "type": obj.type_str
         }
-        tools.materialize_template("git_file.mako", bf.util.path_join(
+        tools.materialize_template("git_file.mako", util.path_join(
             config.path, repoinfo['name'], config.objdir, path, safename +
                 ".html"),
             {"file": f, "data": data, "repo": repoinfo} )
@@ -245,7 +245,7 @@ def run():
         print("gitview: repo root not found!")
         sys.exit(1)
     for d in os.listdir(config.reporoot):
-        fullpath = bf.util.path_join(config.reporoot, d)
+        fullpath = util.path_join(config.reporoot, d)
         if os.path.isdir(fullpath):
             repos.append(Repository(fullpath))
     ri = []
@@ -260,20 +260,20 @@ def run():
         cl = []
         fl = []
         try:
-            with open(bf.util.path_join(rd_path, "description"), "r") as f:
+            with open(util.path_join(rd_path, "description"), "r") as f:
                 rd_desc = f.readline().strip()
         except FileNotFoundError:
-            print("file " + bf.util.path_join(rd_path, "description") + \
+            print("file " + util.path_join(rd_path, "description") + \
                 " not found!")
             rd_desc = "Empty description"
         try:
-            with open(bf.util.path_join(rd_path, "owner"), "r") as f:
+            with open(util.path_join(rd_path, "owner"), "r") as f:
                 rd_owner = f.readline().strip()
         except FileNotFoundError:
-            print("file " + bf.util.path_join(rd_path, "owner") + " not found!")
+            print("file " + util.path_join(rd_path, "owner") + " not found!")
             rd_owner = "Undefined"
-        if not os.path.isdir(bf.util.path_join(config.path, rd_name)):
-            util.mkdir(bf.util.path_join(bf.writer.output_dir,
+        if not os.path.isdir(util.path_join(config.path, rd_name)):
+            util.mkdir(util.path_join(bf.writer.output_dir,
                 config.path, rd_name))
         for commit in r.walk(r.head.target, GIT_SORT_NONE):
             dt = datetime.datetime.fromtimestamp(commit.commit_time)
@@ -282,9 +282,9 @@ def run():
         # high-level repo description.
         rd = {
             "path": rd_path,
-            "name": rd_name,
-            "desc": rd_desc,
-            "owner": rd_owner,
+            "name": util.html_escape(rd_name),
+            "desc": util.html_escape(rd_desc),
+            "owner": util.html_escape(rd_owner),
             "last_commit": rd_last_commit
         }
         ri.append(rd)
@@ -297,20 +297,20 @@ def run():
         # NOTE: commented out in favor of git_repos.mako
         #
         # tools.materialize_template("git_files.mako",
-        #     bf.util.path_join(config.path, name, "files.html"),
+        #     util.path_join(config.path, name, "files.html"),
         #     {"commits": cl, "files": fl, "repo": rd })
         # 5. write the repo index
         tools.materialize_template("git_repo.mako",
-            bf.util.path_join(config.path, rd['name'], "index.html"),
+            util.path_join(config.path, rd['name'], "index.html"),
             {"commits": cl, "files": fl, "repo": rd})
         # NOTE: commented out in favor of git_repos.mako
         #
         # shutil.copyfile(
-        #     bf.util.path_join(bf.writer.output_dir,
+        #     util.path_join(bf.writer.output_dir,
         #         config.path, name, "files.html"),
-        #     bf.util.path_join(bf.writer.output_dir,
+        #     util.path_join(bf.writer.output_dir,
         #         config.path, name, "index.html"))
     # 6. write the overall repository list index
     tools.materialize_template("git_repos.mako",
-        bf.util.path_join(config.path, "index.html"), {"repos": ri} )
+        util.path_join(config.path, "index.html"), {"repos": ri} )