Shame the two things look so much alike in so many fonts, when you have old eyes. The url filter is for filtering a full URL, when you don't want to escape : or // since starting a URL with http%3A%2F%2F won't work well. The uri filter is for filtering a URL parameter, where you want '/search?query=why%3F' rather than '/search?query=why?' which breaks your URL by having a second '?'. Using url when you should use uri means you are leaving &, @, /, ;, :, =, +, ? and $ unescaped when you shouldn't. In many cases, the wrong use of url is on things like biblionumber, where that doesn't result in any interesting behavior, but in other cases... you can create an authorized value category named This&That=Stuff, and when you try to add a value to it, you will add a value to the category This, and pass the parameter That with the value Stuff to the script.
And there's bug 22223 for the way that the url filter isn't really a good idea even if you do have a full URL to filter.
My favourite is how the behaviour of "uri" and "url" also changes depending on your version of Template::Toolkit. We're on 2.27 but I think there's a change in 2.28.
Right. 2.26 and 2.27 you need to call Template::Filters->use_rfc3986() to have "(", ")", "*", "!", and "'" escaped, 2.26 you need to update to 2.27 to have '"' escaped by use_rfc3986(). 2.28 you no longer need to use_rfc3986(). So, when do we switch to 2.28?
(In reply to Phil Ringnalda from comment #3) > Right. 2.26 and 2.27 you need to call Template::Filters->use_rfc3986() to > have "(", ")", "*", "!", and "'" escaped, 2.26 you need to update to 2.27 to > have '"' escaped by use_rfc3986(). 2.28 you no longer need to use_rfc3986(). > > So, when do we switch to 2.28? Good question. I was just about to search up the packages in Debian and Ubuntu but both of their package search sites appear to be down. In any case, we'll be switching accidentally I'm sure 🤣
(In reply to David Cook from comment #4) > (In reply to Phil Ringnalda from comment #3) > > Right. 2.26 and 2.27 you need to call Template::Filters->use_rfc3986() to > > have "(", ")", "*", "!", and "'" escaped, 2.26 you need to update to 2.27 to > > have '"' escaped by use_rfc3986(). 2.28 you no longer need to use_rfc3986(). > > > > So, when do we switch to 2.28? > > Good question. I was just about to search up the packages in Debian and > Ubuntu but both of their package search sites appear to be down. > > In any case, we'll be switching accidentally I'm sure 🤣 Ok sites back up. It looks like Debian and Ubuntu are both sticking with 2.27 for the foreseeable future. On Metacpan, it looks like 2.28 is actually from 2018, and that Template::Toolkit actually has a 3.x release dating back to late 2019 with a 3.102 having gone out in June 2024. At a glance, I don't know that 3.x is a meaningful bump as I can't see any documentation about it... -- I'd say we probably wouldn't upgrade to 2.28 until upstream updates.