264785 - config.rdf needs XML filtering of output to generate valid HTML (Template-Toolkit 2.15 and older do not escape all reserved characters correctly)

Status: RESOLVED FIXED

(Bugzilla :: Bugzilla-General, defect)

Description

[Christian Reis]

config.rdf needs XML filtering of output to generate valid RDF/XML; it's
currently breaking for component names with ampersands in them, for instance.

Comment 1

[Christian Reis]

Attachment: kiko_v1: trivial

Comment 2

[Christian Reis]

Comment on attachment 162384 [details] [diff] [review]
kiko_v1: trivial

This patch also adds content to certain <li> elements that had none. Makes the
output nicer to read and style and parse.

Comment 3

[Gervase Markham [:gerv]]

Comment on attachment 162384 [details] [diff] [review]
kiko_v1: trivial

Hang on, though. Shouldn't the first filter (URI) escape any ampersands? And,
if it doesn't, then we are using the wrong filter, and should be using
url_quote?

Gerv

Comment 4

[Christian Reis]

Hmmm. It isn't, and yeah, I suspect that's the way to do it.

Comment 5

[Gervase Markham [:gerv]]

Comment on attachment 162384 [details] [diff] [review]
kiko_v1: trivial

Removing review; this bug ish currently with kiko to update the patch.

Gerv

Comment 7

[Frédéric Buclin]

(In reply to comment #3)
> (From update of attachment 162384 [details] [diff] [review])
> Hang on, though. Shouldn't the first filter (URI) escape any ampersands? And,
> if it doesn't, then we are using the wrong filter, and should be using
> url_quote?

Ampersands and some other reserved characters were not correctly escaped in older versions of Template::Toolkit. This filter has been fixed in TT 2.16, released on Feb 9, 2007. As this release is a bit too recent to be required in Bugzilla 3.2, we will replace |FILTER uri| by |FILTER url_quote| for now, and then kill |FILTER url_quote| in favor of |FILTER uri| in Bugzilla 4.0 as both filters now behave exactly the same way, see bug 398701.

Comment 8

[Frédéric Buclin]

Attachment: patch, v2

Comment 9

[Max Kanat-Alexander]

Comment on attachment 283828 [details] [diff] [review]
patch, v2

Looks good to me. Looks like this also filters a few things correctly (with FILTER html) that really shouldn't have been FILTER uri, which is good.

Comment 10

[Frédéric Buclin]

Attachment: patch for 3.0.x, v1

Backport for 3.0.x. Same patch as on trunk, except that 'urlbase' is still written as Param('urlbase').

Comment 11

[Max Kanat-Alexander]

Comment on attachment 283941 [details] [diff] [review]
patch for 3.0.x, v1

r=mkanat by inspection. I'm just assuming you tested it.

Comment 12

[Frédéric Buclin]

tip:

Checking in template/en/default/config.rdf.tmpl;
/cvsroot/mozilla/webtools/bugzilla/template/en/default/config.rdf.tmpl,v  <--  config.rdf.tmpl
new revision: 1.11; previous revision: 1.10
done
Checking in template/en/default/admin/components/confirm-delete.html.tmpl;
/cvsroot/mozilla/webtools/bugzilla/template/en/default/admin/components/confirm-delete.html.tmpl,v  <--  confirm-delete.html.tmpl
new revision: 1.12; previous revision: 1.11
done
Checking in template/en/default/admin/products/confirm-delete.html.tmpl;
/cvsroot/mozilla/webtools/bugzilla/template/en/default/admin/products/confirm-delete.html.tmpl,v  <--  confirm-delete.html.tmpl
new revision: 1.9; previous revision: 1.8
done
Checking in template/en/default/bug/dependency-tree.html.tmpl;
/cvsroot/mozilla/webtools/bugzilla/template/en/default/bug/dependency-tree.html.tmpl,v  <--  dependency-tree.html.tmpl
new revision: 1.27; previous revision: 1.26
done
Checking in template/en/default/list/list.ics.tmpl;
/cvsroot/mozilla/webtools/bugzilla/template/en/default/list/list.ics.tmpl,v  <--  list.ics.tmpl
new revision: 1.9; previous revision: 1.8
done
Checking in template/en/default/list/quips.html.tmpl;
/cvsroot/mozilla/webtools/bugzilla/template/en/default/list/quips.html.tmpl,v  <--  quips.html.tmpl
new revision: 1.22; previous revision: 1.21
done


3.0.2:

Checking in template/en/default/config.rdf.tmpl;
/cvsroot/mozilla/webtools/bugzilla/template/en/default/config.rdf.tmpl,v  <--  config.rdf.tmpl
new revision: 1.7.2.2; previous revision: 1.7.2.1
done
Checking in template/en/default/admin/components/confirm-delete.html.tmpl;
/cvsroot/mozilla/webtools/bugzilla/template/en/default/admin/components/confirm-delete.html.tmpl,v  <--  confirm-delete.html.tmpl
new revision: 1.9.2.1; previous revision: 1.9
done
Checking in template/en/default/admin/products/confirm-delete.html.tmpl;
/cvsroot/mozilla/webtools/bugzilla/template/en/default/admin/products/confirm-delete.html.tmpl,v  <--  confirm-delete.html.tmpl
new revision: 1.7.2.1; previous revision: 1.7
done
Checking in template/en/default/bug/dependency-tree.html.tmpl;
/cvsroot/mozilla/webtools/bugzilla/template/en/default/bug/dependency-tree.html.tmpl,v  <--  dependency-tree.html.tmpl
new revision: 1.25.2.1; previous revision: 1.25
done
Checking in template/en/default/list/list.ics.tmpl;
/cvsroot/mozilla/webtools/bugzilla/template/en/default/list/list.ics.tmpl,v  <--  list.ics.tmpl
new revision: 1.6.2.1; previous revision: 1.6
done
Checking in template/en/default/list/quips.html.tmpl;
/cvsroot/mozilla/webtools/bugzilla/template/en/default/list/quips.html.tmpl,v  <--  quips.html.tmpl
new revision: 1.19.2.1; previous revision: 1.19
done