Make hgweb.staticfile() more secure and portable. Without this, files in directories next to the static directory starting with 'static' could be retrieved, e.g. with '../static.private/foo'. Additionally staticfile now generates platform specific pathnames from the /-separated paths given in the URL. Illegal file names (e.g. containing %00) now yield a sane error message.

#!/bin/sh

mkdir test
cd test
echo foo>foo
hg init
hg addremove
hg commit -m 1
hg verify
hg serve -p 20059 -d --pid-file=hg.pid
cd ..

hg clone http://localhost:20059/ copy
cd copy
hg verify
hg co
cat foo
hg manifest
hg pull

kill `cat ../test/hg.pid`