[Slashcode-development] Slash & Bender bug

[Alessio B. <al...@al...>]

There is a problem in Slash if an admin has an aid including spaces or
other "unsafe" characters: the link 'Also by' is constructed blindly
from the aid without escaping those chars, preventing the search to work
properly.

in admin.pl:

sub otherLinks {
	my $aid = shift;
	my $tid = shift;

	my $T = getTopic($tid);

	return <<EOT;
<LI><A HREF="$I{rootdir}/search.pl?topic=$tid">More on
$T->{alttext}</A></LI>
<LI><A HREF="$I{rootdir}/search.pl?author=$aid">Also by $aid</A></LI>
EOT

should be something like

sub otherLinks {
	my $aid = shift;
	my $esc_aid = $I{query}->escape($aid);
	my $tid = shift;

	my $T = getTopic($tid);

	return <<EOT;
<LI><A HREF="$I{rootdir}/search.pl?topic=$tid">More on
$T->{alttext}</A></LI>
<LI><A HREF="$I{rootdir}/search.pl?author=$esc_aid">Also by
$aid</A></LI>
EOT

This has been ported to Bender:

plugins/Slash-Admin/dump:11:INSERT INTO templates VALUES
('','otherLinks','admin','default','eng','<LI><A HREF=\"[%
constants.rootdir %]/search.pl?topic=[% tid
%]\">More on [% topic.alttext %]</A></LI>\r\n<LI><A HREF=\"[%
constants.rootdir
%]/search.pl?author=[% aid %]\">Also by [% aid
%]</A></LI>',500,'',NULL);   


Hope it helps
    
-- 
Alessio F. Bragadini		al...@al...
APL Financial Services		http://village.albourne.com
Nicosia, Cyprus		 	phone: +357-2-755750

"It is more complicated than you think"
		-- The Eighth Networking Truth from RFC 1925