Bug 264785: config.rdf needs XML filtering of output to generate valid HTML (Template-Toolkit 2.15 and older do not escape all reserved characters correctly) - Patch by Frédéric Buclin <LpSolit@gmail.com> r/a=mkanat

6 files changed, 17 insertions, 17 deletions

diff --git a/template/en/default/admin/components/confirm-delete.html.tmpl b/template/en/default/admin/components/confirm-delete.html.tmpl
index bd48ff882..53bba1e35 100644
--- a/template/en/default/admin/components/confirm-delete.html.tmpl
+++ b/template/en/default/admin/components/confirm-delete.html.tmpl
@@ -74,7 +74,7 @@ from '[% product.name FILTER html %]' product
 <tr>
   <td valign="top">Product Milestone URL:</td>
   <td valign="top">
-    <a href="[% product.milestone_url FILTER uri %]">
+    <a href="[% product.milestone_url FILTER html %]">
       [% product.milestone_url FILTER html %]
     </a>
   </td>
diff --git a/template/en/default/admin/products/confirm-delete.html.tmpl b/template/en/default/admin/products/confirm-delete.html.tmpl
index 8a24cfd4e..7667d70e5 100644
--- a/template/en/default/admin/products/confirm-delete.html.tmpl
+++ b/template/en/default/admin/products/confirm-delete.html.tmpl
@@ -89,7 +89,7 @@
       <td>Milestone URL:</td>
       <td>
         [% IF product.milestone_url %]
-          <a href="[% product.milestone_url FILTER uri %]">
+          <a href="[% product.milestone_url FILTER html %]">
             [%- product.milestone_url FILTER html %]
           </a>
         [% ELSE %]
diff --git a/template/en/default/bug/dependency-tree.html.tmpl b/template/en/default/bug/dependency-tree.html.tmpl
index 6adb96aa6..5eb370838 100644
--- a/template/en/default/bug/dependency-tree.html.tmpl
+++ b/template/en/default/bug/dependency-tree.html.tmpl
@@ -143,10 +143,10 @@
       <span class="summ_text">[%+ bug.short_desc FILTER html %]</span>
       <span class="summ_info">[[% INCLUDE buginfo %]]</span>
     </a>
-    <a href="showdependencytree.cgi?id=[% bugid FILTER uri %]"
+    <a href="showdependencytree.cgi?id=[% bugid FILTER url_quote %]"
        class="tree_link">
       <img src="skins/standard/dependency-tree/tree.png"
-           title="See dependency tree for [% terms.bug %] [%+ bugid FILTER uri %]">
+           title="See dependency tree for [% terms.bug %] [%+ bugid FILTER html %]">
     </a>
   [% END %]
 [% END %]
diff --git a/template/en/default/config.rdf.tmpl b/template/en/default/config.rdf.tmpl
index 4b5004992..99850fa71 100644
--- a/template/en/default/config.rdf.tmpl
+++ b/template/en/default/config.rdf.tmpl
@@ -117,13 +117,13 @@
     <Seq>
       [% FOREACH product = products %]
         <li>
-          <bz:product rdf:about="[% urlbase FILTER xml %]product.cgi?name=[% product.name FILTER uri %]">
+          <bz:product rdf:about="[% urlbase FILTER xml %]product.cgi?name=[% product.name FILTER url_quote %]">
             <bz:name>[% product.name FILTER html %]</bz:name>
 
             <bz:components>
               <Seq>
                 [% FOREACH component = product.components %]
-                  <li resource="[% urlbase FILTER xml %]component.cgi?name=[% component.name FILTER uri %]"/>
+                  <li resource="[% urlbase FILTER xml %]component.cgi?name=[% component.name FILTER url_quote %]"/>
                 [% END %]
               </Seq>
             </bz:components>
@@ -131,7 +131,7 @@
             <bz:versions>
               <Seq>
                 [% FOREACH version = product.versions %]
-                  <li resource="[% urlbase FILTER xml %]version.cgi?name=[% version.name FILTER uri %]"/>
+                  <li resource="[% urlbase FILTER xml %]version.cgi?name=[% version.name FILTER url_quote %]"/>
                 [% END %]
               </Seq>
             </bz:versions>
@@ -140,7 +140,7 @@
               <bz:target_milestones>
                 <Seq>
                   [% FOREACH milestone = product.milestones %]
-                    <li resource="[% urlbase FILTER xml %]milestone.cgi?name=[% milestone.name FILTER uri %]"/>
+                    <li resource="[% urlbase FILTER xml %]milestone.cgi?name=[% milestone.name FILTER url_quote %]"/>
                   [% END %]
                 </Seq>
               </bz:target_milestones>
@@ -157,7 +157,7 @@
       [% FOREACH product = products %]
         [% FOREACH component = product.components %]
           <li>
-            <bz:component rdf:about="[% urlbase FILTER xml %]component.cgi?name=[% component.name FILTER uri %]">
+            <bz:component rdf:about="[% urlbase FILTER xml %]component.cgi?name=[% component.name FILTER url_quote %]">
               <bz:name>[% component.name FILTER html %]</bz:name>
             </bz:component>
           </li>
@@ -171,7 +171,7 @@
       [% FOREACH product = products %]
         [% FOREACH version = product.versions %]
           <li>
-            <bz:version rdf:about="[% urlbase FILTER xml %]version.cgi?name=[% version.name FILTER uri %]">
+            <bz:version rdf:about="[% urlbase FILTER xml %]version.cgi?name=[% version.name FILTER url_quote %]">
               <bz:name>[% version.name FILTER html %]</bz:name>
             </bz:version>
           </li>
@@ -186,7 +186,7 @@
         [% FOREACH product = products %]
           [% FOREACH milestone = product.milestones %]
             <li>
-              <bz:target_milestone rdf:about="[% urlbase FILTER xml %]milestone.cgi?name=[% milestone.name FILTER uri %]">
+              <bz:target_milestone rdf:about="[% urlbase FILTER xml %]milestone.cgi?name=[% milestone.name FILTER url_quote %]">
                 <bz:name>[% milestone.name FILTER html %]</bz:name>
               </bz:target_milestone>
             </li>
@@ -201,7 +201,7 @@
       [% PROCESS "global/field-descs.none.tmpl" %]
       [% FOREACH item = field %]
         <li>
-          <bz:field rdf:about="[% urlbase FILTER xml %]field.cgi?name=[% item.name FILTER uri %]">
+          <bz:field rdf:about="[% urlbase FILTER xml %]field.cgi?name=[% item.name FILTER url_quote %]">
             <bz:name>[% item.name FILTER html %]</bz:name>
             <bz:description>[% (field_descs.${item.name} OR item.description) FILTER html %]</bz:description>
           </bz:field>
diff --git a/template/en/default/list/list.ics.tmpl b/template/en/default/list/list.ics.tmpl
index 02444472a..f8953d996 100644
--- a/template/en/default/list/list.ics.tmpl
+++ b/template/en/default/list/list.ics.tmpl
@@ -57,11 +57,11 @@ END:VCALENDAR
 [% END %]
 
 [% BLOCK ics_uid %]
-  [% "${bug_id}@${base_url}" FILTER uri FILTER ics('UID') %]
+  [% "${bug_id}@${base_url}" FILTER url_quote FILTER ics('UID') %]
 [% END %]
 
 [% BLOCK ics_url %]
-  [% "${base_url}show_bug.cgi?id=${bug_id}" FILTER uri FILTER ics('URL;VALUE=URI') %]
+  [% "${base_url}show_bug.cgi?id=${bug_id}" FILTER url_quote FILTER ics('URL;VALUE=URI') %]
 [% END %]
 
 [% BLOCK ics_dtstart %]
diff --git a/template/en/default/list/quips.html.tmpl b/template/en/default/list/quips.html.tmpl
index e730e7cce..14cecb26e 100644
--- a/template/en/default/list/quips.html.tmpl
+++ b/template/en/default/list/quips.html.tmpl
@@ -119,13 +119,13 @@
               [% "Unknown" IF NOT users.$userid %]
             </td>
             <td>
-              <a href="quips.cgi?action=delete&amp;quipid=[% quipid FILTER uri%]">
+              <a href="quips.cgi?action=delete&amp;quipid=[% quipid FILTER url_quote %]">
                 Delete
               </a>
             </td>
             <td>
-              <input type="checkbox" name="quipid_[% quipid FILTER uri%]"
-                     id="quipid_[% quipid FILTER uri%]"
+              <input type="checkbox" name="quipid_[% quipid FILTER html %]"
+                     id="quipid_[% quipid FILTER html %]"
                      [%- ' checked="checked"' IF quips.$quipid.approved %]>
             </td>
           </tr>