Re: [htmltmpl] Suggestion on how to eliminate Cross-site-scripting (XSS) bugs for good.

2006-11-16 Thread Tom Heady
Sam Tregar wrote: > On Tue, 17 Oct 2006, Tom Heady wrote: > >> Actually, I found that turning off escaping (ESCAPE="0") does not work >> if you specify a default escape. >> >> See http://rt.cpan.org/Public/Bug/Display.html?id=18274 for more details >>

Re: [htmltmpl] Suggestion on how to eliminate Cross-site-scripting (XSS) bugs for good.

2006-10-17 Thread Tom Heady
Alex Kapranoff wrote: > * Michael Peters <[EMAIL PROTECTED]> [October 17 2006, 17:01]: >> Alex Kapranoff wrote: >>> * Shlomi Fish <[EMAIL PROTECTED]> [October 17 2006, 14:23]: Now what I want is to sub-class HTML::Template so we'll always have to use "ESCAPE=HTML". If we want to override

Re: [htmltmpl] ESCAPE=XML

2006-04-26 Thread Tom Heady
Jim Spath wrote: > Hi all, > > Just joined the list... excuse me if this has been posted before, but I > didn't find a good way to search the mailing list archives. > > I use HTML::Template for XML templates frequently, and think that > ESCAPE=XML would be a useful addition. So far as I know HTML

[htmltmpl] default_escape patches

2006-03-15 Thread Tom Heady
Attached are patches/tests for the following bugs: * when specifying a default_escape, you can't turn it off I have fixed ESCAPE=0 and added ESCAPE=NONE to turn off escaping altogether for a TMPL_VAR. The pod was also updated to reflect this change. Usage: * ESCAPE='JS' did not work I

Re: [htmltmpl] Re: bug fixes/patches/tests

2006-03-15 Thread Tom Heady
Mark Stosberg wrote: On 2006-03-15, Tom Heady <[EMAIL PROTECTED]> wrote: Hello, What would be the most appropriate way to contribute bug fixes/patches/tests? ... Tom, I believe using the bug tracking system is the preferred route. I know Sam has mentioned that in the past. It&#x

[htmltmpl] bug fixes/patches/tests

2006-03-15 Thread Tom Heady
Hello, What would be the most appropriate way to contribute bug fixes/patches/tests? I have a patch and tests that will fix the following: use HTML::Template; my $text = q{}; my $template = HTML::Template->new( scalarref => \$text, default_escape