Re: [htmltmpl] Suggestion on how to eliminate Cross-site-scripting (XSS) bugs for good.

2006-11-15 Thread Sam Tregar
On Tue, 17 Oct 2006, Tom Heady wrote: > Actually, I found that turning off escaping (ESCAPE="0") does not work > if you specify a default escape. > > See http://rt.cpan.org/Public/Bug/Display.html?id=18274 for more details > and a fix. I'll make sure this gets into the next release. I'm planning

Re: [htmltmpl] The sf.net Subversion Repository and the Phalanx One

2006-11-15 Thread Sam Tregar
On Wed, 15 Nov 2006, Shlomi Fish wrote: > A question if I may. Why weren't the tests and other changes that > were done to the Phalanx work on HTML-Template: > > * http://svn.perl.org/phalanx/HTML-Template/ > * http://hew.ca/yapc/phalanx/slides/TABLE_OF_CONTENTS.html > > Integrated into the mainli

[htmltmpl] The sf.net Subversion Repository and the Phalanx One

2006-11-15 Thread Shlomi Fish
Hi all! A question if I may. Why weren't the tests and other changes that were done to the Phalanx work on HTML-Template: * http://svn.perl.org/phalanx/HTML-Template/ * http://hew.ca/yapc/phalanx/slides/TABLE_OF_CONTENTS.html Integrated into the mainline HTML-Template at: https://svn.sourcefor

Re: [htmltmpl] Suggestion on how to eliminate Cross-site-scripting (XSS) bugs for good.

2006-11-15 Thread Shlomi Fish
On Thursday 26 October 2006 02:12, Mathew Robertson wrote: > >> Having read the thread, I don't think that's enough for me. I want to > >> still need to explicitly specify "ESCAPE=HTML" everywhere (without > >> having a default escape), to have an exception raised on a non-escaped > >> occurence, a

Re: [htmltmpl] Suggestion on how to eliminate Cross-site-scripting (XSS) bugs for good.

2006-11-15 Thread Shlomi Fish
On Thursday 26 October 2006 01:07, Jonathan Lang wrote: > Shlomi Fish wrote: > > Having read the thread, I don't think that's enough for me. I want to > > still need to explicitly specify "ESCAPE=HTML" everywhere (without having > > a default escape), to have an exception raised on a non-escaped >