[htmltmpl] WML escaping for ::JIT

2007-03-16 Thread Alex Kapranoff
Patch to enable "ESCAPE=WML" in HTML::Template::JIT. -- Alex Kapranoff, $n=["1another7Perl213Just3hacker49"=~/\d|\D*/g]; $$n[0]={grep/\d/,@$n};print"@$n{1..4}\n" patch-t::10escape.t Description: Troff document --- t/templates/wmlescape.tmpl.orig Thu Sep 16

[htmltmpl] Updated WML escaping patch

2007-03-16 Thread Alex Kapranoff
Good day! We serve lots of WAP pages with HTML::Template. So this is my old WML patch updated for 2.9 in case anyone is interested. It's small, includes tests and docs so I still hope it will be included in base some day :) -- Alex Kapranoff, $n=["1another7Perl213Just3hacker49"=~

Re: [htmltmpl] Suggestion on how to eliminate Cross-site-scripting (XSS) bugs for good.

2006-10-17 Thread Alex Kapranoff
* Michael Peters <[EMAIL PROTECTED]> [October 17 2006, 17:01]: > Alex Kapranoff wrote: > > * Shlomi Fish <[EMAIL PROTECTED]> [October 17 2006, 14:23]: > >> Now what I want is to sub-class HTML::Template so we'll always have to > >> use "ESCAPE=HTML

Re: [htmltmpl] Suggestion on how to eliminate Cross-site-scripting (XSS) bugs for good.

2006-10-17 Thread Alex Kapranoff
in recent HTML::Template. Is it not enough? -- Alex Kapranoff, $n=["1another7Perl213Just3hacker49"=~/\d|\D*/g]; $$n[0]={grep/\d/,@$n};print"@$n{1..4}\n" - Using Tomcat but need to do more? Need to support web

Re: [htmltmpl] extra whitespace

2006-02-08 Thread Alex Kapranoff
tructs. That would be very useful option indeed if done well and fast. I'd use it everywhere. -- Alex Kapranoff, $n=["1another7Perl213Just3hacker49"=~/\d|\D*/g]; $$n[0]={grep/\d/,@$n};print"@$n{1..4}\n" --- This S

Re: [htmltmpl] option to turn ESCAPE=HTML on by default

2005-12-22 Thread Alex Kapranoff
ESCAPE=none (as a synonym for ESCAPE=0) patch for completeness. It was sleeping time over here between your two mails -- this and release announcement :) -- Alex Kapranoff, $n=["1another7Perl213Just3hacker49"=~/\d|\D*/g]; $$n[0]={grep/\d/,@$n};print"@$n{1..4}\n" --

Re: [htmltmpl] Speed loss with parameters global_vars and loop_context_vars

2005-12-14 Thread Alex Kapranoff
global_vars=1, loop_context_vars=0: 5.7 seconds > global_vars=0, loop_context_vars=1: 5.7 seconds > global_vars=1, loop_context_vars=1: 13.0 seconds !!! > > So here is my question: Is this behavior normal ? Yes. HTML::Template global_vars are very inefficient. -- Alex Kapranoff, $n=

Re: [htmltmpl] option to turn ESCAPE=HTML on by default

2005-10-24 Thread Alex Kapranoff
ew escape > module called, say "HTML_JS" > > Mathew > > Alex Kapranoff wrote: > > >* Philip Tellis <[EMAIL PROTECTED]> [October 18 2005, 16:02]: > > > > > >>>s/pretty hard/impossible/; > >>>That's why there'

Re: [htmltmpl] option to turn ESCAPE=HTML on by default

2005-10-18 Thread Alex Kapranoff
, then JS escaping (in that order) or else the code is likely just plain insecure. This task is not solved right now. -- Alex Kapranoff, $n=["1another7Perl213Just3hacker49"=~/\d|\D*/g]; $$n[0]={grep/\d/,@$n};print"@$n{1..4}\n" ---

Re: [htmltmpl] option to turn ESCAPE=HTML on by default

2005-10-18 Thread Alex Kapranoff
they are to be defaults for the template file? Exactly > what they are called I don't mind, but since there are 2 escaping options > in H::T, using 'default_escape' could be ambiguous. > > Alex's patch seems to work well for the html escapin

Re: [htmltmpl] option to turn ESCAPE=HTML on by default

2005-10-18 Thread Alex Kapranoff
=> ''); +$output = $template->output(); +like($output, qr{^Joined&with"cruft}); +like($output, qr{<&>>&<}); +like($output, qr{because it's <b>}); + +eval { +$template = HTML::Template->new(path => ['templates'], +

Re: [htmltmpl] option to turn ESCAPE=HTML on by default

2005-10-17 Thread Alex Kapranoff
; + +eval { +$template = HTML::Template->new(path => ['templates'], +filename => 'default_escape.tmpl', + default_escape => 'wml'); +}; +like($@, qr/Wrong default_escap

Re: [htmltmpl] option to turn ESCAPE=HTML on by default

2005-10-14 Thread Alex Kapranoff
eclaring "no strict" where needed. > > Thoughts? All for it. About 10% of my TMPL_VARS are not escaped. "NOESCAPE=html" looks very confusing. Should probably be "ESCAPE=none". -- Alex Kapranoff, $n=["1another7Perl213Just3hacker49"=~/\d|\D*/g]; $$n[0]

Re: [htmltmpl] HTML::Template for WML

2005-06-29 Thread Alex Kapranoff
not only custom ESCAPErs! I strongly advise you to upload your work to CPAN as a HTML::Template fork. Those features will certainly benefit a wider audience. I'm going to try to port your ESCAPE abstraction to HT::JIT as that's really what we use in production. -- Alex Kapranoff, $n=[&qu

[htmltmpl] HTML::Template for WML

2005-06-28 Thread Alex Kapranoff
only way to add an ESCAPE filter is to hack _parse method (subclassing or just patching). Looks like ESCAPE filters are all hardwired and spread over the code of the method. Did anyone face these problems? Or is WML that dead and no one cares about it anymore? :) -- Alex Kapranof

Re: [htmltmpl] Problems with HTML::TEMPLATE

2005-03-16 Thread Alex Kapranoff
* Rama Srinivas <[EMAIL PROTECTED]> [March 16 2005, 19:29]: > Here is the snippet of the code in my tmpl file. > > Beeps: yes: > NAME="yesBeeps"> > > Keep tag on one line. -- Alex Kapranoff, $n=["1another7Perl213Just3hacker49"=~/\d|

Re: [htmltmpl] tmpl_loops and with if and unless

2005-02-10 Thread Alex Kapranoff
; [EMAIL PROTECTED] && @loop_two) from your Perl code and check it inside template with a simple . -- Alex Kapranoff, $n=["1another7Perl213Just3hacker49"=~/\d|\D*/g]; $$n[0]={grep/\d/,@$n};print"@$n{1..4}\n" --- SF ema

[htmltmpl] Two types of 'ESCAPE' for one item

2004-11-30 Thread Alex Kapranoff
in something like q{'John Doe' <[EMAIL PROTECTED]>} and break on either apostroph or less-than whichever way of ESCAPing we use. Is there an elegant method of dealing with such data? I can certainly pre-JS-escape in Perl and then use ESCAPE="HTML" in template but that w

Re: [htmltmpl] Patch to encode iso-8859-1 using HTML::Entities

2004-10-19 Thread Alex Kapranoff
-encode.diff > > To maintain backward compatibility for people who expect single-quotes to be > escaped (e.g., for existing unit tests), single quotes are escaped either > way. -- Alex Kapranoff, #!/usr/bin/perl -w $SIG{__WARN__}=sub{print substr("@_",-43+ord$_,1)for '6

Re: [htmltmpl] language support

2004-08-25 Thread Alex Kapranoff
, clean namespace in > is advantage and I don't want to turn it on only because > translations. And global_vars slow down processing by a factor of 4. I once was very surprised with a profile where HTML::Template::output too

Re: [htmltmpl] language support

2004-08-24 Thread Alex Kapranoff
ort, it's perplexing how to balance > between language specific templates, replaceable text, and some > replaceable text which is pull-down values you'd more naturally > consider to be part of the template. [skip] -- Alex Kapranoff. --

[htmltmpl] [patch] Allow blessed hashrefs as loop rows in HT::JIT-ed templates

2004-06-09 Thread Alex Kapranoff
bless({ val => 'foo' }, 'barfoo'), +bless({ val => 'bar' }, 'barbar') ]); +$output = $template->output(); +like($output, qr/bar: foo,bar,/); -- Alex Kapranoff. --- This SF.Net email is sp

Re: [htmltmpl] RFC: Template Tag Attributes

2004-06-02 Thread Alex Kapranoff
aning for external programs that need additional information on the > template tag. > > I'm sure it can be done with a filter, but frankly, I think that's a > cop-out solution, being that the current filter mechanism does not have a > way to hook into HTML::Template's p

Re: [htmltmpl] [patch] HT::JIT .so-s die while urlescaping 8bit chars

2004-05-20 Thread Alex Kapranoff
* Sam Tregar <[EMAIL PROTECTED]> [May 19 2004, 20:55]: > On Wed, 19 May 2004, Alex Kapranoff wrote: > > > The patch is obvious. There's a test for the case, too. > > Hey, thanks! Does it work with UTF-8 in the template text too? I had > a theory that that woul

[htmltmpl] [patch] HT::JIT .so-s die while urlescaping 8bit chars

2004-05-19 Thread Alex Kapranoff
jit_path => 't/jit_path', + jit_debug => $debug, +); +$template->param(STUFF => "\xf4"); #" +$output = $template->output; +like($output, qr/%F4/); #" -- Alex Kapranoff.