I found a bug in the latest version of HTML::Template (2.6 and at least
also 2.5) where if you have escape='url' in a <tmpl_var> tag, HTML
escaping is done instead.
This happens because although the main parsing regex checks for double
and single quotes around url, later when another regex is used to test
if an HTML escape or URL escape was used, it only checks for ESCAPE=URL
or ESCAPE="URL". So if you have ESCAPE='URL' it is treated as though
the default HTML escaping was specified. I submitted a patch for this
on SourceForge last week, but since there hasn't been any activity, I
thought I should post to the mailing list as well.
The url for the patch tracker entry is:
http://sourceforge.net/tracker/index.php?
func=detail&aid=889386&group_id=1075&atid=301075
--
Paul Baker
"Reality is that which, when you stop believing in it, doesn't go away."
-- Philip K. Dick
GPG Key: http://homepage.mac.com/pauljbaker/public.asc
|
