Be more strict with git arguments

routers/repo/editor.go

@@ -161,7 +161,8 @@ func NewFile(ctx *context.Context) {
 func editFilePost(ctx *context.Context, form auth.EditRepoFileForm, isNewFile bool) {
 	canCommit := renderCommitRights(ctx)
 	treeNames, treePaths := getParentTreeFields(form.TreePath)
-	branchName := ctx.Repo.BranchName
+	branchName := path.Clean("/" + ctx.Repo.BranchName)[1:]
+	form.NewBranchName = path.Clean("/" + form.NewBranchName)[1:]
 	if form.CommitChoice == frmCommitChoiceNewBranch {
 		branchName = form.NewBranchName
 	}