Skip Menu |
 

Preferred bug tracker

Please visit the preferred bug tracker to report your issue.

This queue is for tickets about the CGI CPAN distribution.

Report information
The Basics
Id: 49606
Status: resolved
Priority: 0/
Queue: CGI

People
Owner: Nobody in particular
Requestors: iphands [...] gmail.com
Cc:
AdminCc:

Bug Information
Severity: Normal
Broken in: (no value)
Fixed in: (no value)



Subject: [Patch] CGI.pm popup_menu if optgroup, $selected is not properly escaped.
Download (untitled) / with headers
text/plain 753b
# perl -MCGI -e 'print CGI::popup_menu(-values=>[CGI::optgroup(-name=>"A",-values=>["a","b+"])],-default=>"b\\+")'; ^ selects b+ # mp perl -MCGI -e 'print CGI::popup_menu(-values=>[CGI::optgroup(-name=>"A",-values=>["a","b+"])],-default=>"b+")'; ^ selects nothing (or b if b exists) ... but why is the \\+ needed --- old/CGI.pm 2009-09-10 17:11:18.000000000 -0400 +++ new/CGI.pm 2009-09-10 17:11:29.000000000 -0400 @@ -2572,7 +2572,7 @@ for my $v (split(/\n/)) { my $selectit = $XHTML ? 'selected="selected"' : 'selected'; for my $selected (keys %selected) { - $v =~ s/(value="$selected")/$selectit $1/; + $v =~ s/(value="\Q$selected\E")/$selectit $1/; } $result .= "$v\n"; }
Subject: Re: [rt.cpan.org #49606] [Patch] CGI.pm popup_menu if optgroup, $selected is not properly escaped.
Date: Fri, 11 Sep 2009 09:43:05 -0400
To: bug-CGI.pm [...] rt.cpan.org
From: Mark Stosberg <mark [...] summersault.com>
Download (untitled) / with headers
text/plain 1.1k
Show quoted text
> # perl -MCGI -e 'print > CGI::popup_menu(-values=>[CGI::optgroup(-name=>"A",-values=>["a","b+"])],-default=>"b\\+")'; > ^ selects b+ > # mp perl -MCGI -e 'print > CGI::popup_menu(-values=>[CGI::optgroup(-name=>"A",-values=>["a","b+"])],-default=>"b+")'; > ^ selects nothing (or b if b exists) > ... but why is the \\+ needed > > > --- old/CGI.pm 2009-09-10 17:11:18.000000000 -0400 > +++ new/CGI.pm 2009-09-10 17:11:29.000000000 -0400 > @@ -2572,7 +2572,7 @@ > for my $v (split(/\n/)) { > my $selectit = $XHTML ? 'selected="selected"' : 'selected'; > for my $selected (keys %selected) { > - $v =~ s/(value="$selected")/$selectit $1/; > + $v =~ s/(value="\Q$selected\E")/$selectit $1/; > } > $result .= "$v\n"; > }
Thanks for the patch. We'll see about getting this into the next release, with credit to you. Mark -- . . . . . . . . . . . . . . . . . . . . . . . . . . . Mark Stosberg Principal Developer mark@summersault.com Summersault, LLC 765-939-9301 ext 202 database driven websites . . . . . http://www.summersault.com/ . . . . . . . .
Download (untitled) / with headers
text/plain 1.1k
On Fri Sep 11 09:43:23 2009, mark@summersault.com wrote: Show quoted text
> > # perl -MCGI -e 'print > > CGI::popup_menu(-values=>[CGI::optgroup(-name=>"A",-
> values=>["a","b+"])],-default=>"b\\+")';
> > ^ selects b+ > > # mp perl -MCGI -e 'print > > CGI::popup_menu(-values=>[CGI::optgroup(-name=>"A",-
> values=>["a","b+"])],-default=>"b+")';
> > ^ selects nothing (or b if b exists) > > ... but why is the \\+ needed > > > > > > --- old/CGI.pm 2009-09-10 17:11:18.000000000 -0400 > > +++ new/CGI.pm 2009-09-10 17:11:29.000000000 -0400 > > @@ -2572,7 +2572,7 @@ > > for my $v (split(/\n/)) { > > my $selectit = $XHTML ? 'selected="selected"' :
> 'selected';
> > for my $selected (keys %selected) { > > - $v =~ s/(value="$selected")/$selectit $1/; > > + $v =~ s/(value="\Q$selected\E")/$selectit $1/; > > } > > $result .= "$v\n"; > > }
> > Thanks for the patch. We'll see about getting this into the next > release, with > credit to you. > > Mark > >
Great, but the credit should go to the people in #raleigh.pm (on irc.perl.org) :-) Thanks, -Ian Page Hands
Download (untitled) / with headers
text/plain 139b
Thanks, I added a test for this and pushed it to my github repo, to appear in the next release. Credit will go to #raleigh.pm as requested.
Released in 3.48


This service is sponsored and maintained by Best Practical Solutions and runs on Perl.org infrastructure.

Please report any issues with rt.cpan.org to rt-cpan-admin@bestpractical.com.