Bug 136180 - use uri/url_quote filters correctly. Patch by ddk; 2xr=gerv.

diff --git a/Bugzilla/Token.pm b/Bugzilla/Token.pm
index 39584bd9c218c83b2f1c63072c6a81deac767af7..1400face967f7d53c16c5730a13e74b99a227c5d 100644 (file)
--- a/Bugzilla/Token.pm
+++ b/Bugzilla/Token.pm
@@ -67,7 +67,7 @@ sub IssueEmailChangeToken {
     $vars->{'oldemailaddress'} = $old_email . &::Param('emailsuffix');
     $vars->{'newemailaddress'} = $new_email . &::Param('emailsuffix');
 
-    $vars->{'token'} = &::url_quote($token);
+    $vars->{'token'} = $token;
     $vars->{'emailaddress'} = $old_email . &::Param('emailsuffix');
 
     my $message;
@@ -78,7 +78,7 @@ sub IssueEmailChangeToken {
     print SENDMAIL $message;
     close SENDMAIL;
 
-    $vars->{'token'} = &::url_quote($newtoken);
+    $vars->{'token'} = $newtoken;
     $vars->{'emailaddress'} = $new_email . &::Param('emailsuffix');
 
     $message = "";
@@ -211,7 +211,7 @@ sub Cancel {
     $vars->{'emailaddress'} = $username;
     $vars->{'maintainer'} = $maintainer;
     $vars->{'remoteaddress'} = $::ENV{'REMOTE_ADDR'};
-    $vars->{'token'} = &::url_quote($token);
+    $vars->{'token'} = $token;
     $vars->{'tokentype'} = $tokentype;
     $vars->{'issuedate'} = $issuedate;
     $vars->{'eventdata'} = $eventdata;

diff --git a/Token.pm b/Token.pm
index 39584bd9c218c83b2f1c63072c6a81deac767af7..1400face967f7d53c16c5730a13e74b99a227c5d 100644 (file)
--- a/Token.pm
+++ b/Token.pm
@@ -67,7 +67,7 @@ sub IssueEmailChangeToken {
     $vars->{'oldemailaddress'} = $old_email . &::Param('emailsuffix');
     $vars->{'newemailaddress'} = $new_email . &::Param('emailsuffix');
 
-    $vars->{'token'} = &::url_quote($token);
+    $vars->{'token'} = $token;
     $vars->{'emailaddress'} = $old_email . &::Param('emailsuffix');
 
     my $message;
@@ -78,7 +78,7 @@ sub IssueEmailChangeToken {
     print SENDMAIL $message;
     close SENDMAIL;
 
-    $vars->{'token'} = &::url_quote($newtoken);
+    $vars->{'token'} = $newtoken;
     $vars->{'emailaddress'} = $new_email . &::Param('emailsuffix');
 
     $message = "";
@@ -211,7 +211,7 @@ sub Cancel {
     $vars->{'emailaddress'} = $username;
     $vars->{'maintainer'} = $maintainer;
     $vars->{'remoteaddress'} = $::ENV{'REMOTE_ADDR'};
-    $vars->{'token'} = &::url_quote($token);
+    $vars->{'token'} = $token;
     $vars->{'tokentype'} = $tokentype;
     $vars->{'issuedate'} = $issuedate;
     $vars->{'eventdata'} = $eventdata;

diff --git a/globals.pl b/globals.pl
index 2b9434738f406f8726ec9694f22ed1dcfa675400..ced8b4f873910ffb2b3f4ba111a886c2e0e8d723 100644 (file)
--- a/globals.pl
+++ b/globals.pl
@@ -1616,6 +1616,13 @@ $::template ||= Template->new(
         } , 
         
         html => \&html_quote , 
+
+        # This subroutine in CGI.pl escapes characters in a variable
+        # or value string for use in a query string.  It escapes all
+        # characters NOT in the regex set: [a-zA-Z0-9_\-.].  The 'uri'
+        # filter should be used for a full URL that may have
+        # characters that need encoding.
+        url_quote => \&url_quote ,
       } ,
   }
 ) || DisplayError("Template creation failed: " . Template->error())

diff --git a/t/004template.t b/t/004template.t
index 2f9b252b210b15a9eb68b314ae17f681fa62d8b1..a63dbd64f16877fedb5d60c073a414755c96d8f6 100644 (file)
--- a/t/004template.t
+++ b/t/004template.t
@@ -63,8 +63,9 @@ my $template = Template->new(
     # actually have to function in this test, just be defined.
     FILTERS =>
     {
-        strike => sub { return $_ } ,
-        js     => sub { return $_ }
+        js        => sub { return $_ } ,
+        strike    => sub { return $_ } ,
+        url_quote => sub { return $_ } ,
     },
 }
 );

diff --git a/template/en/default/account/email/change-new.txt.tmpl b/template/en/default/account/email/change-new.txt.tmpl
index 5a5ae2535760869729f7652e054af4688e4a6a40..4739c50e7d168cb078391c33aef3b7c31423a7a3 100644 (file)
--- a/template/en/default/account/email/change-new.txt.tmpl
+++ b/template/en/default/account/email/change-new.txt.tmpl
@@ -27,10 +27,10 @@ for the [% oldemailaddress %] account to your address.
 
 To confirm the change, visit the following link:
 
-[% Param('urlbase') %]token.cgi?a=cfmem&t=[% token FILTER html %]
+[% Param('urlbase') %]token.cgi?a=cfmem&t=[% token FILTER url_quote %]
 
 If you are not the person who made this request, or you wish to cancel
 this request, visit the following link:
 
-[% Param('urlbase') %]token.cgi?a=cxlem&t=[% token FILTER html %]
+[% Param('urlbase') %]token.cgi?a=cxlem&t=[% token FILTER url_quote %]
 

diff --git a/template/en/default/account/email/change-old.txt.tmpl b/template/en/default/account/email/change-old.txt.tmpl
index 82ecf1dfcce1093ab65f3d03f06d822ad278ded3..ac42cccb0538131b5dca8619707ded637df40679 100644 (file)
--- a/template/en/default/account/email/change-old.txt.tmpl
+++ b/template/en/default/account/email/change-old.txt.tmpl
@@ -31,5 +31,5 @@ for your account to [% newemailaddress %].
 If you are not the person who made this request, or you wish to cancel
 this request, visit the following link:
 
-[% Param('urlbase') %]token.cgi?a=cxlem&t=[% token FILTER html %]
+[% Param('urlbase') %]token.cgi?a=cxlem&t=[% token FILTER url_quote %]
 

diff --git a/template/en/default/bug/create/create.html.tmpl b/template/en/default/bug/create/create.html.tmpl
index fe9688acdcf310d7eb83312897d05e2ce0d7cdf1..5047a213151c0151ae65d281e40dc0d0653d2248 100644 (file)
--- a/template/en/default/bug/create/create.html.tmpl
+++ b/template/en/default/bug/create/create.html.tmpl
@@ -71,7 +71,7 @@
     
     <td align="right" valign="top">
       <strong>
-        <a href="describecomponents.cgi?product=[% product FILTER uri %]">
+        <a href="describecomponents.cgi?product=[% product FILTER url_quote %]">
           Component:</a>
       </strong>
     </td>

diff --git a/template/en/default/bug/edit.html.tmpl b/template/en/default/bug/edit.html.tmpl
index deeb4e24d6353bd17f8cae9d7b5633882c2c2e1c..2dfd4278f952411ce50039b15e1bbc1c2a2da718 100644 (file)
--- a/template/en/default/bug/edit.html.tmpl
+++ b/template/en/default/bug/edit.html.tmpl
@@ -90,7 +90,7 @@
     <tr>
       <td align="right">
         <b>
-          <a href="describecomponents.cgi?product=[% bug.product FILTER uri %]">
+          <a href="describecomponents.cgi?product=[% bug.product FILTER url_quote %]">
             Component</a>:
         </b>
       </td>

diff --git a/template/en/default/global/choose-product.html.tmpl b/template/en/default/global/choose-product.html.tmpl
index 1d68f7fe77a92c2ee9737bc89c271f052b67844d..df7e0fb489f5f13614fce9a5b41922a8e6c21b1a 100644 (file)
--- a/template/en/default/global/choose-product.html.tmpl
+++ b/template/en/default/global/choose-product.html.tmpl
@@ -27,7 +27,7 @@
 [% FOREACH p = proddesc.keys.sort %]
   <tr>
     <th align="right" valign="top">
-      <a href="[% target %]?product=[% p FILTER uri %]">
+      <a href="[% target %]?product=[% p FILTER url_quote %]">
         [% p FILTER html %]</a>:
     </th>
 

diff --git a/template/en/default/list/list.html.tmpl b/template/en/default/list/list.html.tmpl
index 1665d7a1e3523bf13a7831df48c413dcc459e7fa..15d5fc0a055ba295539ab4a328a999d51d977b3f 100644 (file)
--- a/template/en/default/list/list.html.tmpl
+++ b/template/en/default/list/list.html.tmpl
@@ -25,6 +25,7 @@
 
 [% DEFAULT title = "Bug List" %]
 [% style_url = "css/buglist.css" %]
+[% qorder = order FILTER url_quote IF order %]
 
 
 [%############################################################################%]
@@ -137,7 +138,7 @@
 
     [% IF bugs.size > 1 && caneditbugs && !dotweak %]
       <a href="buglist.cgi?[% urlquerypart %]
-        [%- "&order=$order" FILTER uri html IF order %]&tweak=1">Change Several 
+        [%- "&order=$qorder" FILTER html IF order %]&amp;tweak=1">Change Several 
         Bugs at Once</a>
       &nbsp;&nbsp;
     [% END %]

diff --git a/template/en/default/list/table.html.tmpl b/template/en/default/list/table.html.tmpl
index 2afc9bb9d63826e9df32c1e6c0cfbbc576e10c88..230fb08759d72f6f61f25c6f9382e452688279d3 100644 (file)
--- a/template/en/default/list/table.html.tmpl
+++ b/template/en/default/list/table.html.tmpl
@@ -49,6 +49,8 @@
   }
 %]
 
+[% qorder = order FILTER url_quote IF order %]
+
 [%############################################################################%]
 [%# Table Header                                                             #%]
 [%############################################################################%]
@@ -98,8 +100,8 @@
 [% BLOCK columnheader %]
   <th colspan="[% splitheader ? 2 : 1 %]">
     <a href="buglist.cgi?[% urlquerypart %]&amp;order=
-      [% column.name FILTER uri html %]
-      [% ",$order" FILTER uri html IF order %]">
+      [% column.name FILTER url_quote FILTER html %]
+      [% ",$qorder" FILTER html IF order %]">
         [%- abbrev.$id.title || column.title -%]</a>
   </th>
 [% END %]

diff --git a/template/en/default/reports/keywords.html.tmpl b/template/en/default/reports/keywords.html.tmpl
index 28f684f4612e120b454e3411d76a6c84d69d3fd9..665e360c0e5be56874ddf514aee9ddb9ee52c094 100644 (file)
--- a/template/en/default/reports/keywords.html.tmpl
+++ b/template/en/default/reports/keywords.html.tmpl
@@ -53,7 +53,7 @@
     <td>[% keyword.description %]</td>
     <td align="right">
       [% IF keyword.bugcount > 0 %]
-        <A HREF="buglist.cgi?keywords=[% keyword.name FILTER uri %]">
+        <a href="buglist.cgi?keywords=[% keyword.name FILTER url_quote %]">
           [% keyword.bugcount %]</a>
       [% ELSE %]
         none

diff --git a/template/en/default/sidebar.xul.tmpl b/template/en/default/sidebar.xul.tmpl
index 6523176424a177f4dd0b682b677687b35c6f2cfd..65af4de4c951eac8d91ba668d600c1c881d43e3f 100644 (file)
--- a/template/en/default/sidebar.xul.tmpl
+++ b/template/en/default/sidebar.xul.tmpl
@@ -98,7 +98,7 @@ function normal_keypress_handler( aEvent ) {
   [%- END %]
 
   [%- FOREACH name = namedqueries %]
-      <text class="text-link" onclick="load_relative_url('buglist.cgi?cmdtype=runnamed&amp;namedcmd=[% name FILTER uri %]')" value="[% name FILTER html %]"/>
+      <text class="text-link" onclick="load_relative_url('buglist.cgi?cmdtype=runnamed&amp;namedcmd=[% name FILTER url_quote %]')" value="[% name FILTER html %]"/>
   [% END %]
 
 [% ELSE %]