From: Frank Lichtenheld <frank@lichtenheld.de>
Date: Wed, 16 Apr 2008 20:51:12 +0000 (+0200)
Subject: html/show.tmpl: Fix several escaping issues
X-Git-Url: https://git.deb.at/?p=deb%2Fpackages.git;a=commitdiff_plain;h=82ba9e0c9f83aeda43626c8c3cdc56e767d8a97d;hp=5bc68216fc09af79aa6b21b43f43a5a62e215267

html/show.tmpl: Fix several escaping issues

The uri filter in TT 2.14 (i.e. the version in Debian etch) is broken
(or at least unusable). So always use URI::Escape::uri_escape instead.

Escaping the Homepage: field makes no sense since there is no reliable
way to decide what needs to be quoted. The URIs need to be correclty
quoted in the original field already. Use HTML quoting though.
---

diff --git a/templates/html/show.tmpl b/templates/html/show.tmpl
index 00effc9..eec364b 100644
--- a/templates/html/show.tmpl
+++ b/templates/html/show.tmpl
@@ -112,15 +112,15 @@
 [%- FOREACH maintainers;
   mailarchiveurl = '';
   IF (matches = mail.match('^(.*)@lists\.debian\.org$'));
-	mailarchiveurl = 'http://lists.debian.org/' _ matches.0 _ '/';
+	mailarchiveurl = 'http://lists.debian.org/' _ uri_escape(matches.0) _ '/';
   ELSIF (matches = mail.match('^(.*)@lists\.alioth\.debian\.org$'));
-	mailarchiveurl = 'http://lists.alioth.debian.org/pipermail/' _ matches.0 _ '/';
+	mailarchiveurl = 'http://lists.alioth.debian.org/pipermail/' _ uri_escape(matches.0) _ '/';
   ELSIF (matches = mail.match('^(.*)@lists\.ubuntu\.com$'));
-  	mailarchiveurl = 'http://lists.ubuntu.com/archives/' _ matches.0 _ '/';
+  	mailarchiveurl = 'http://lists.ubuntu.com/archives/' _ uri_escape(matches.0) _ '/';
   END -%]
   [%- '<ul>' IF loop.first -%]
-	<li><a href="mailto:[% mail | uri %]">[% name | html %]</a>
-	(<a href="[% ddpo_url %][% mail | uri %]" title="[% g("An overview over the maintainer's packages and uploads") %]">[% g('QA Page') %]</a>
+	<li><a href="mailto:[% mail | html %]">[% name | html %]</a>
+	(<a href="[% ddpo_url %][% uri_escape(mail) %]" title="[% g("An overview over the maintainer's packages and uploads") %]">[% g('QA Page') %]</a>
 	[%- IF mailarchiveurl %], <a href="[% mailarchiveurl %]" title="[% g('Archive of the Maintainer Mailinglist') %]">[% g('Mail Archive') %]</a>[% END %])
 	</li>
   [%- '</ul>' IF loop.last -%]
@@ -131,7 +131,7 @@
    IF url %]
 <h3>[% g('External Resources:') %]</h3>
 <ul>
-<li><a href="[% url | uri %]">[% g('Homepage') %]</a> [[% extract_host(url) | html %]]</li>
+<li><a href="[% url | html %]">[% g('Homepage') %]</a> [[% extract_host(url) | html %]]</li>
 </ul>
 [% END %]
 
@@ -185,7 +185,7 @@
 [% FOREACH tag IN tags %]
   [% IF loop.first -%]
     <div id="ptags"><p>
-    <a href="[% tags_url %]edit.html?pkg=[% pkg | uri %]">[% g('Tags') %]</a>:
+    <a href="[% tags_url %]edit.html?pkg=[% uri_escape(pkg) %]">[% g('Tags') %]</a>:
   [%- END %]
   [% facet = tag.0; lfacet = "$facet-$po_lang"; 
      facet_name = debtags_voc.$lfacet;