default_escape on the templates

diff --git a/NDWeb/Include.pm b/NDWeb/Include.pm
index 2f062bc23fc9042859e93cc6a50ffe1a5b9ac317..5794b469c4eef5f9a1b7e7c9f239b3239c4039ec 100644 (file)
--- a/NDWeb/Include.pm
+++ b/NDWeb/Include.pm
@@ -65,7 +65,7 @@ sub alliances {
        my ($alliance) = @_;
        my @alliances;
        $alliance = -1 unless defined $alliance;
-       push @alliances,{Id => -1, Name => ' ', Selected => not $alliance};
+       push @alliances,{Id => -1, Name => '', Selected => not $alliance};
        my $query = $ND::DBH->prepare(q{SELECT id,name FROM alliances ORDER BY LOWER(name)});
        $query->execute;        
        while (my $ally = $query->fetchrow_hashref){

diff --git a/NDWeb/Pages/AddIntel.pm b/NDWeb/Pages/AddIntel.pm
index 529d4c24ac7a98ed43c01ebf3a9250e779f8f2fa..834fb0d6250130b371c6ec062134c76c754732a2 100644 (file)
--- a/NDWeb/Pages/AddIntel.pm
+++ b/NDWeb/Pages/AddIntel.pm
@@ -95,7 +95,7 @@ sub render_body {
                                }
                        }
                        if (my $thread = addForumThread $DBH,$board,$ND::UID,$subject){
-                               $error .= p 'Intel message added' if addForumPost $DBH,$thread,$ND::UID,param('intel')
+                               $error .= 'Intel message added' if addForumPost $DBH,$thread,$ND::UID,param('intel')
                        }
                }
        }

diff --git a/NDWeb/Pages/Calls.pm b/NDWeb/Pages/Calls.pm
index 9ab76ddf0d697d90fb3e703c7bd1694020f68909..27e88de39b3805d02cf27311cbe0779bb852e7f0 100644 (file)
--- a/NDWeb/Pages/Calls.pm
+++ b/NDWeb/Pages/Calls.pm
@@ -123,7 +123,7 @@ sub render_body {
                $BODY->param(DefensePoints => $call->{defense_points});
                $BODY->param(LandingTick => $call->{landing_tick});
                $BODY->param(ETA => $call->{landing_tick}-$self->{TICK});
-               $BODY->param(Info => escapeHTML $call->{info});
+               $BODY->param(Info => $call->{info});
                $BODY->param(DC => $call->{dc});
                $BODY->param(Member => $call->{member});
                $BODY->param(SMS => $call->{sms});
@@ -294,7 +294,7 @@ sub render_body {
                        $call->{dcstyle} = 'Hostile' unless defined $call->{dc};
                        $i++;
                        $call->{ODD} = $i % 2;
-                       $call->{shiptype} = escapeHTML($call->{shiptype});
+                       $call->{shiptype} = $call->{shiptype};
                        push @calls, $call;
                }
                $BODY->param(Calls => \@calls);

diff --git a/NDWeb/Pages/Intel.pm b/NDWeb/Pages/Intel.pm
index b1292655b6761452e998e6bff3f9e78220535044..3dc69b203ce8b07d7690263b5ffa74ec0fab686f 100644 (file)
--- a/NDWeb/Pages/Intel.pm
+++ b/NDWeb/Pages/Intel.pm
@@ -158,7 +158,7 @@ sub render_body {
                $BODY->param(Nick => escapeHTML($planet->{nick}));
                $BODY->param(Channel => $planet->{channel});
                my @status;
-               for my $status (" ","Friendly", "NAP", "Hostile"){
+               for my $status ("","Friendly", "NAP", "Hostile"){
                        push @status,{Status => $status, Selected => defined $planet->{planet_status} && $status eq $planet->{planet_status}}
                }
                $BODY->param(PlanetStatus => \@status);

diff --git a/NDWeb/Pages/Main.pm b/NDWeb/Pages/Main.pm
index 8bcbdc4b6cc8f7df549dc452bfe4e51673280752..62d91f33af76d25125e09c6e224f76cc699503aa 100644 (file)
--- a/NDWeb/Pages/Main.pm
+++ b/NDWeb/Pages/Main.pm
@@ -177,7 +177,7 @@ sub render_body {
                }
                $i++;
                $call->{ODD} = $i % 2;
-               $call->{shiptype} = escapeHTML($call->{shiptype});
+               $call->{shiptype} = $call->{shiptype};
                push @calls, $call;
        }
        $BODY->param(Calls => \@calls);

diff --git a/NDWeb/XMLPage.pm b/NDWeb/XMLPage.pm
index eb25c6815a7533a8acb6799837b354b8165eefbd..76c637465b76357bf7d3887d8bc0acfd9c963ead 100644 (file)
--- a/NDWeb/XMLPage.pm
+++ b/NDWeb/XMLPage.pm
@@ -90,7 +90,8 @@ sub render : method {
                $template = HTML::Template->new(filename => "templates/xml.tmpl", cache => 1);
                $body = HTML::Template->new(filename => "templates/$self->{PAGE}.xml.tmpl", cache => 1);
        }else{
-               $body = HTML::Template->new(filename => "templates/$self->{PAGE}.tmpl", global_vars => 1, cache => 1);
+               $body = HTML::Template->new(filename => "templates/$self->{PAGE}.tmpl", global_vars => 1
+                       , cache => 1, default_escape => 'HTML');
                $body->param(PAGE => $self->{PAGE});
        }
 

diff --git a/templates/calls.tmpl b/templates/calls.tmpl
index 467fcd4007836bb8ece0cff034f86eeecbc0ace0..63dde79c398e324fc254a6c81b1bd46bd9c751a9 100644 (file)
--- a/templates/calls.tmpl
+++ b/templates/calls.tmpl
@@ -157,7 +157,7 @@
                <td><TMPL_VAR NAME=Shiptype></td>
                <td><TMPL_VAR NAME=Curreta> (<TMPL_VAR NAME=Eta>)</td>
                <td><TMPL_VAR NAME=Alliance></td>
-               <td><TMPL_VAR NAME=Attackers></td>
+               <td><TMPL_VAR ESCAPE=NONE NAME=Attackers></td>
        </tr>
 </TMPL_LOOP>
 </table>

diff --git a/templates/editRaid.tmpl b/templates/editRaid.tmpl
index 0b176c31bb5b14a3288808c667775b103b944238..13ae19d6b8ab140563871564c9adfb301a6833fa 100644 (file)
--- a/templates/editRaid.tmpl
+++ b/templates/editRaid.tmpl
@@ -36,7 +36,7 @@
                </div>
                <div class="leftinfo">
                        <p>Raid message here</p>
-                       <textarea rows="15" cols="40" name="message"><TMPL_VAR NAME=Message></textarea>
+                       <textarea rows="15" cols="40" name="message"><TMPL_VAR ESCAPE=NONE NAME=Message></textarea>
                </div>
                <div class="leftinfo">
                        <p>List all target coords here</p>
@@ -94,7 +94,7 @@
        </div>
        <div class="leftinfo">
        <p>     Comment:<br/>
-               <textarea rows="5" cols="20" name="comment:<TMPL_VAR NAME=Id>"><TMPL_VAR NAME=Comment></textarea>
+               <textarea rows="5" cols="20" name="comment:<TMPL_VAR NAME=Id>"><TMPL_VAR ESCAPE=NONE NAME=Comment></textarea>
        </p>
        <TMPL_VAR NAME=PlanetScan>
        </div>

diff --git a/templates/forum.tmpl b/templates/forum.tmpl
index f1b3b26ecad2d68af2bd7070ea8e75edf637b475..b74de1f56f764dfc152702bf287e7ca5555b685c 100644 (file)
--- a/templates/forum.tmpl
+++ b/templates/forum.tmpl
@@ -10,7 +10,7 @@
 <TMPL_IF Thread>
 
 <TMPL_IF Moderate><a href="/<TMPL_VAR NAME=PAGE>?t=<TMPL_VAR NAME=FTID>;cmd=<TMPL_VAR NAME=Sticky>">Make this thread <TMPL_VAR NAME=Sticky></a></TMPL_IF>
-<TMPL_VAR Thread>
+<TMPL_VAR ESCAPE=NONE Thread>
 </TMPL_IF>
 <TMPL_IF ViewBoard>
 <p><a href="/<TMPL_VAR NAME=PAGE>?b=<TMPL_VAR NAME=Id>;markAsRead=<TMPL_VAR ESCAPE=URL NAME=DATE>">Mark threads as read</a></p>

diff --git a/templates/intel.tmpl b/templates/intel.tmpl
index 4158ad63a1f2fc6dccb6ac6ea33a9746eca2c874..20a46070d862bb1b9bd40dff73167972da45f74f 100644 (file)
--- a/templates/intel.tmpl
+++ b/templates/intel.tmpl
@@ -79,7 +79,7 @@
 
 <TMPL_IF Thread>
 <div>
-<TMPL_VAR NAME=Thread>
+<TMPL_VAR ESCAPE=NONE NAME=Thread>
 <form action="<TMPL_VAR NAME=PAGE>#NewPosts" method="post"><fieldset class="forum-post"> <legend>New Reply</legend>
        <textarea rows="10" cols="60" name="message"></textarea>
        <input type="hidden" name="cmd" value="forumpost"/>

diff --git a/templates/main.tmpl b/templates/main.tmpl
index 5356cdd57305b158a4e62c9c492da4c1c2124051..7dd2a467d6df7a53462845afc34f156a7c485c79 100644 (file)
--- a/templates/main.tmpl
+++ b/templates/main.tmpl
@@ -1,7 +1,7 @@
 <TMPL_VAR NAME=Error>
 <div class="leftinfo">
 <fieldset class="forum-post"> <legend>Message from HC<TMPL_IF isHC> <a href="motd?">EDIT</a></TMPL_IF></legend>
-       <TMPL_VAR NAME=MOTD>
+       <TMPL_VAR ESCAPE=NONE NAME=MOTD>
 </fieldset>
 </div>
 <TMPL_IF PLANET>
@@ -50,7 +50,7 @@
                <td><TMPL_VAR NAME=Shiptype></td>
                <td><TMPL_VAR NAME=Curreta></td>
                <td><TMPL_VAR NAME=Eta></td>
-               <td><TMPL_VAR NAME=Attackers></td>
+               <td><TMPL_VAR ESCAPE=NONE NAME=Attackers></td>
        </tr>
 </TMPL_LOOP>
 </table>

diff --git a/templates/raids.tmpl b/templates/raids.tmpl
index af9bc30efb16e0d508a0dc2f7b2f6d0bc7b858ad..203d31c04776eb68c46544a78d05e4413b2c08fe 100644 (file)
--- a/templates/raids.tmpl
+++ b/templates/raids.tmpl
@@ -52,7 +52,7 @@
        <p><b style="color: red;">DO NOT JOIN A WAVE UNLESS YOU HAVE PERMISSION FROM THE PERSON WHO CLAIMED IT</b></p>
        <p><b style="color: purple;">COORDS ARE NOT SHOWN UNTIL AT LEAST 10 MIN AFTER YOUR CLAIM</b></p>
        <p>Landing tick first wave: <TMPL_VAR NAME=LandingTick></p>
-       <TMPL_VAR NAME=Message>
+       <TMPL_VAR ESCAPE=NONE NAME=Message>
 </fieldset>
 
 <TMPL_IF Ajax>
@@ -81,7 +81,7 @@
        </ul>
        <TMPL_IF Comment>
                <fieldset> <legend>Comment</legend>
-                       <TMPL_VAR NAME=Comment>
+                       <TMPL_VAR ESCAPE=NONE NAME=Comment>
                </fieldset>
        </TMPL_IF>
        <table>

diff --git a/templates/viewthread.tmpl b/templates/viewthread.tmpl
index 8086162273c7f7c4e04772555f2b80d959964ff7..0bf6719be745628332cb85c50d7b22806b76befe 100644 (file)
--- a/templates/viewthread.tmpl
+++ b/templates/viewthread.tmpl
@@ -5,7 +5,7 @@
 </TMPL_IF>
 <fieldset class="forum-post">
 <legend class="unread:<TMPL_VAR NAME=Unread>"><b><TMPL_VAR NAME=Username></b> : <TMPL_VAR NAME=Time></legend>
-       <TMPL_VAR NAME=Message>
+       <TMPL_VAR ESCAPE=NONE NAME=Message>
 </fieldset>
 </TMPL_LOOP>
 <TMPL_IF Post>