Summary: | Audit use of TT url filter for uses that should be uri instead | ||
---|---|---|---|
Product: | Koha | Reporter: | Phil Ringnalda <phil> |
Component: | Templates | Assignee: | Phil Ringnalda <phil> |
Status: | NEW --- | QA Contact: | Testopia <testopia> |
Severity: | enhancement | ||
Priority: | P5 - low | CC: | dcook |
Version: | Main | ||
Hardware: | All | ||
OS: | All | ||
See Also: | https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=22223 | ||
Change sponsored?: | --- | Patch complexity: | --- |
Documentation contact: | Documentation submission: | ||
Text to go in the release notes: | Version(s) released in: | ||
Circulation function: | |||
Bug Depends on: | 38467 | ||
Bug Blocks: |
Description
Phil Ringnalda
2024-10-18 23:08:14 UTC
And there's bug 22223 for the way that the url filter isn't really a good idea even if you do have a full URL to filter. My favourite is how the behaviour of "uri" and "url" also changes depending on your version of Template::Toolkit. We're on 2.27 but I think there's a change in 2.28. Right. 2.26 and 2.27 you need to call Template::Filters->use_rfc3986() to have "(", ")", "*", "!", and "'" escaped, 2.26 you need to update to 2.27 to have '"' escaped by use_rfc3986(). 2.28 you no longer need to use_rfc3986(). So, when do we switch to 2.28? (In reply to Phil Ringnalda from comment #3) > Right. 2.26 and 2.27 you need to call Template::Filters->use_rfc3986() to > have "(", ")", "*", "!", and "'" escaped, 2.26 you need to update to 2.27 to > have '"' escaped by use_rfc3986(). 2.28 you no longer need to use_rfc3986(). > > So, when do we switch to 2.28? Good question. I was just about to search up the packages in Debian and Ubuntu but both of their package search sites appear to be down. In any case, we'll be switching accidentally I'm sure 🤣 (In reply to David Cook from comment #4) > (In reply to Phil Ringnalda from comment #3) > > Right. 2.26 and 2.27 you need to call Template::Filters->use_rfc3986() to > > have "(", ")", "*", "!", and "'" escaped, 2.26 you need to update to 2.27 to > > have '"' escaped by use_rfc3986(). 2.28 you no longer need to use_rfc3986(). > > > > So, when do we switch to 2.28? > > Good question. I was just about to search up the packages in Debian and > Ubuntu but both of their package search sites appear to be down. > > In any case, we'll be switching accidentally I'm sure 🤣 Ok sites back up. It looks like Debian and Ubuntu are both sticking with 2.27 for the foreseeable future. On Metacpan, it looks like 2.28 is actually from 2018, and that Template::Toolkit actually has a 3.x release dating back to late 2019 with a 3.102 having gone out in June 2024. At a glance, I don't know that 3.x is a meaningful bump as I can't see any documentation about it... -- I'd say we probably wouldn't upgrade to 2.28 until upstream updates. |