# HG changeset patch
# User Matt Mackall <mpm@selenic.com>
# Date 2013-10-09 21:15:34
# Node ID e828975722c8ff632f08cbeb84ec184da2952823
# Parent  6cc696179869b7cafda6321221840f3f3d0e6748
# Parent  904061628dc42c88c1c3617a884ae23b7ace5dfd

merge with stable

diff --git a/mercurial/hgweb/server.py b/mercurial/hgweb/server.py
--- a/mercurial/hgweb/server.py
+++ b/mercurial/hgweb/server.py
@@ -60,7 +60,10 @@ class _httprequesthandler(BaseHTTPServer
         self._log_any(self.server.accesslog, format, *args)
 
     def log_request(self, code='-', size='-'):
-        xheaders = [h for h in self.headers.items() if h[0].startswith('x-')]
+        xheaders = []
+        if util.safehasattr(self, 'headers'):
+            xheaders = [h for h in self.headers.items()
+                        if h[0].startswith('x-')]
         self.log_message('"%s" %s %s%s',
                          self.requestline, str(code), str(size),
                          ''.join([' %s:%s' % h for h in sorted(xheaders)]))
diff --git a/mercurial/hgweb/webcommands.py b/mercurial/hgweb/webcommands.py
--- a/mercurial/hgweb/webcommands.py
+++ b/mercurial/hgweb/webcommands.py
@@ -994,7 +994,7 @@ def graph(web, req, tmpl):
             desc = templatefilters.firstline(ctx.description())
             desc = cgi.escape(templatefilters.nonempty(desc))
             user = cgi.escape(templatefilters.person(ctx.user()))
-            branch = ctx.branch()
+            branch = cgi.escape(ctx.branch())
             try:
                 branchnode = web.repo.branchtip(branch)
             except error.RepoLookupError:
@@ -1003,7 +1003,8 @@ def graph(web, req, tmpl):
 
             if usetuples:
                 data.append((node, vtx, edges, desc, user, age, branch,
-                             ctx.tags(), ctx.bookmarks()))
+                             [cgi.escape(x) for x in ctx.tags()],
+                             [cgi.escape(x) for x in ctx.bookmarks()]))
             else:
                 edgedata = [dict(col=edge[0], nextcol=edge[1],
                                  color=(edge[2] - 1) % 6 + 1,
diff --git a/mercurial/templatefilters.py b/mercurial/templatefilters.py
--- a/mercurial/templatefilters.py
+++ b/mercurial/templatefilters.py
@@ -215,6 +215,7 @@ def _uescape(c):
 _escapes = [
     ('\\', '\\\\'), ('"', '\\"'), ('\t', '\\t'), ('\n', '\\n'),
     ('\r', '\\r'), ('\f', '\\f'), ('\b', '\\b'),
+    ('<', '\\u003c'), ('>', '\\u003e')
 ]
 
 def jsonescape(s):
diff --git a/mercurial/ui.py b/mercurial/ui.py
--- a/mercurial/ui.py
+++ b/mercurial/ui.py
@@ -665,7 +665,7 @@ class ui(object):
         if not self.interactive():
             return default
         try:
-            self.write(self.label(prompt or _('password: '), 'ui.prompt'))
+            self.write_err(self.label(prompt or _('password: '), 'ui.prompt'))
             return getpass.getpass('')
         except EOFError:
             raise util.Abort(_('response expected'))
diff --git a/tests/test-propertycache.py b/tests/test-propertycache.py
--- a/tests/test-propertycache.py
+++ b/tests/test-propertycache.py
@@ -42,7 +42,7 @@ mercurial.localrepo.localrepository.test
 # create an empty repo. and instanciate it. It is important to run
 # those test on the real object to detect regression.
 repopath = os.path.join(os.environ['TESTTMP'], 'repo')
-subprocess.check_call(['hg', 'init', repopath])
+assert subprocess.call(['hg', 'init', repopath]) == 0
 ui = uimod.ui()
 repo = mercurial.hg.repository(ui, path=repopath).unfiltered()