[TWiki-Dev] [SVN] PeterThoeny r17839 - twiki/branches/TWikiRelease04x02/lib

[<de...@de...>]

Author: PeterThoeny
Date: 2009-02-23 00:04:11 -0600 (Mon, 23 Feb 2009)
New Revision: 17839
Trac url: http://develop.twiki.org/trac/changeset/17839

Modified:
   twiki/branches/TWikiRelease04x02/lib/TWiki.pm
Log:
Item6186: Adding safe mode to ENCODE and URLPARAM variables (docs and unit tests pending)

Modified: twiki/branches/TWikiRelease04x02/lib/TWiki.pm
===================================================================
--- twiki/branches/TWikiRelease04x02/lib/TWiki.pm	2009-02-23 06:03:30 UTC (rev 17838)
+++ twiki/branches/TWikiRelease04x02/lib/TWiki.pm	2009-02-23 06:04:11 UTC (rev 17839)
@@ -3470,6 +3470,13 @@
     } elsif ($type =~ /^url$/i) {
         $text =~ s/\r*\n\r*/<br \/>/; # Legacy.
         return urlEncode( $text );
+    } elsif ( $type =~ /^(off|none)$/i ) {
+        # no encoding
+        return $text;
+    } else { # safe or default
+        # entity encode ' " < > and %
+        $text =~ s/([<>%'"])/'&#'.ord($1).';'/ge;
+        return $text;
     }
 }
 
@@ -3614,7 +3621,7 @@
     my( $this, $params ) = @_;
     my $param     = $params->{_DEFAULT} || '';
     my $newLine   = $params->{newline};
-    my $encode    = $params->{encode};
+    my $encode    = $params->{encode} || 'safe';
     my $multiple  = $params->{multiple};
     my $separator = $params->{separator};
     $separator="\n" unless (defined $separator);
@@ -3642,16 +3649,7 @@
     }
     if( defined $value ) {
         $value =~ s/\r?\n/$newLine/go if( defined $newLine );
-        if ( $encode ) {
-            if ( $encode =~ /^entit(y|ies)$/i ) {
-                $value = entityEncode( $value );
-            } elsif ( $encode =~ /^quotes?$/i ) {
-                $value =~ s/\"/\\"/go;    # escape quotes with backslash (Bugs:Item3383 fix)
-            } else {
-                $value =~ s/\r*\n\r*/<br \/>/; # Legacy
-                $value = urlEncode( $value );
-            }
-        }
+        $value = _encode( $encode, $value );
     }
     unless( defined $value ) {
         $value = $params->{default};