From: Frank Lichtenheld <frank@lichtenheld.de>
Date: Wed, 16 Apr 2008 20:51:12 +0000 (+0200)
Subject: html/show.tmpl: Fix several escaping issues
X-Git-Url: https://git.deb.at/w?a=commitdiff_plain;h=82ba9e0c9f83aeda43626c8c3cdc56e767d8a97d;p=deb%2Fpackages.git

html/show.tmpl: Fix several escaping issues

The uri filter in TT 2.14 (i.e. the version in Debian etch) is broken
(or at least unusable). So always use URI::Escape::uri_escape instead.

Escaping the Homepage: field makes no sense since there is no reliable
way to decide what needs to be quoted. The URIs need to be correclty
quoted in the original field already. Use HTML quoting though.
---

diff --git a/templates/html/show.tmpl b/templates/html/show.tmpl
index 00effc9..eec364b 100644
--- a/templates/html/show.tmpl
+++ b/templates/html/show.tmpl
@@ -112,15 +112,15 @@
 [%- FOREACH maintainers;
   mailarchiveurl = '';
   IF (matches = mail.match('^(.*)@lists\.debian\.org$'));
-	mailarchiveurl = 'http://lists.debian.org/' _ matches.0 _ '/';
+	mailarchiveurl = 'http://lists.debian.org/' _ uri_escape(matches.0) _ '/';
   ELSIF (matches = mail.match('^(.*)@lists\.alioth\.debian\.org$'));
-	mailarchiveurl = 'http://lists.alioth.debian.org/pipermail/' _ matches.0 _ '/';
+	mailarchiveurl = 'http://lists.alioth.debian.org/pipermail/' _ uri_escape(matches.0) _ '/';
   ELSIF (matches = mail.match('^(.*)@lists\.ubuntu\.com$'));
-  	mailarchiveurl = 'http://lists.ubuntu.com/archives/' _ matches.0 _ '/';
+  	mailarchiveurl = 'http://lists.ubuntu.com/archives/' _ uri_escape(matches.0) _ '/';
   END -%]
   [%- '<ul>' IF loop.first -%]
-	<li><a href="mailto:[% mail | uri %]">[% name | html %]</a>
-	(<a href="[% ddpo_url %][% mail | uri %]" title="[% g("An overview over the maintainer's packages and uploads") %]">[% g('QA Page') %]</a>
+	<li><a href="mailto:[% mail | html %]">[% name | html %]</a>
+	(<a href="[% ddpo_url %][% uri_escape(mail) %]" title="[% g("An overview over the maintainer's packages and uploads") %]">[% g('QA Page') %]</a>
 	[%- IF mailarchiveurl %], <a href="[% mailarchiveurl %]" title="[% g('Archive of the Maintainer Mailinglist') %]">[% g('Mail Archive') %]</a>[% END %])
 	</li>
   [%- '</ul>' IF loop.last -%]
@@ -131,7 +131,7 @@
    IF url %]
 <h3>[% g('External Resources:') %]</h3>
 <ul>
-<li><a href="[% url | uri %]">[% g('Homepage') %]</a> [[% extract_host(url) | html %]]</li>
+<li><a href="[% url | html %]">[% g('Homepage') %]</a> [[% extract_host(url) | html %]]</li>
 </ul>
 [% END %]
 
@@ -185,7 +185,7 @@
 [% FOREACH tag IN tags %]
   [% IF loop.first -%]
     <div id="ptags"><p>
-    <a href="[% tags_url %]edit.html?pkg=[% pkg | uri %]">[% g('Tags') %]</a>:
+    <a href="[% tags_url %]edit.html?pkg=[% uri_escape(pkg) %]">[% g('Tags') %]</a>:
   [%- END %]
   [% facet = tag.0; lfacet = "$facet-$po_lang"; 
      facet_name = debtags_voc.$lfacet;