merge with stable

mercurial/hgweb/server.py

@@ -60,7 +60,10 b' class _httprequesthandler(BaseHTTPServer'
         self._log_any(self.server.accesslog, format, *args)
 
     def log_request(self, code='-', size='-'):
-        xheaders = [h for h in self.headers.items() if h[0].startswith('x-')]
+        xheaders = []
+        if util.safehasattr(self, 'headers'):
+            xheaders = [h for h in self.headers.items()
+                        if h[0].startswith('x-')]
         self.log_message('"%s" %s %s%s',
                          self.requestline, str(code), str(size),
                          ''.join([' %s:%s' % h for h in sorted(xheaders)]))

mercurial/hgweb/webcommands.py

@@ -994,7 +994,7 b' def graph(web, req, tmpl):'
             desc = templatefilters.firstline(ctx.description())
             desc = cgi.escape(templatefilters.nonempty(desc))
             user = cgi.escape(templatefilters.person(ctx.user()))
-            branch = ctx.branch()
+            branch = cgi.escape(ctx.branch())
             try:
                 branchnode = web.repo.branchtip(branch)
             except error.RepoLookupError:
@@ -1003,7 +1003,8 b' def graph(web, req, tmpl):'
 
             if usetuples:
                 data.append((node, vtx, edges, desc, user, age, branch,
-                             ctx.tags(), ctx.bookmarks()))
+                             [cgi.escape(x) for x in ctx.tags()],
+                             [cgi.escape(x) for x in ctx.bookmarks()]))
             else:
                 edgedata = [dict(col=edge[0], nextcol=edge[1],
                                  color=(edge[2] - 1) % 6 + 1,

mercurial/templatefilters.py

@@ -215,6 +215,7 b' def _uescape(c):'
 _escapes = [
     ('\\', '\\\\'), ('"', '\\"'), ('\t', '\\t'), ('\n', '\\n'),
     ('\r', '\\r'), ('\f', '\\f'), ('\b', '\\b'),
+    ('<', '\\u003c'), ('>', '\\u003e')
 ]
 
 def jsonescape(s):

mercurial/ui.py

@@ -665,7 +665,7 b' class ui(object):'
         if not self.interactive():
             return default
         try:
-            self.write(self.label(prompt or _('password: '), 'ui.prompt'))
+            self.write_err(self.label(prompt or _('password: '), 'ui.prompt'))
             return getpass.getpass('')
         except EOFError:
             raise util.Abort(_('response expected'))

tests/test-propertycache.py

@@ -42,7 +42,7 b' mercurial.localrepo.localrepository.test'
 # create an empty repo. and instanciate it. It is important to run
 # those test on the real object to detect regression.
 repopath = os.path.join(os.environ['TESTTMP'], 'repo')
-subprocess.check_call(['hg', 'init', repopath])
+assert subprocess.call(['hg', 'init', repopath]) == 0
 ui = uimod.ui()
 repo = mercurial.hg.repository(ui, path=repopath).unfiltered()