TaintedString, how is it determined, where ?
Hello, I am playing with the html_quote function, trying to get it to quote ALL html entities, not just the basic ones cgi.escape() handles. I've got that part working well enough, though I had to modify Zope code ... Is it possible to monkey patch (or in any other way modify) from a product a function (and not a class) ? The problem I discovered is that only "tainted strings" are passed to html_quote. BUT what Zope determines to be "tainted" isn't "wide" enough for my needs. In my case, strings with latin-1 accents are not deemed "tainted", which means they don't get quoted by the code I have in place (Which would replace "é" with "é"). Could anybody point me in the right direction? Where do I find the code that determines whether a <dtml-var> used variable (such as Title) is deemed tainted? I could just write a new PythonScript or something like that to do it ... But since the architecture is allready in place to do it, I'd rather just modify that. Also, the documentation for html_quote really suggests this shuld be the behavior. Either the behavior of the function, or the docs, should be ammended to be clearer. Thanks! Jean-François Doyon Internet Service Development and Systems Support / Soutien de systèmes et developement de services Internet GeoAccess Division / Division GéoAccès Canada Center for Remote Sensing / Centre canadien de télédétection Natural Resources Canada / Ressources naturelles Canada Phone / Téléphone: (613) 992-4902 Fax / Télécopieur: (613) 947-2410 http://atlas.gc.ca
I am playing with the html_quote function, trying to get it to quote ALL html entities, not just the basic ones cgi.escape() handles.
You don't need to do that if you're serving the content with the correct character set.
I've got that part working well enough, though I had to modify Zope code ... Is it possible to monkey patch (or in any other way modify) from a product a function (and not a class) ?
I've found, where there's a will there's a way, but you really don't need to in this case.
The problem I discovered is that only "tainted strings" are passed to html_quote. BUT what Zope determines to be "tainted" isn't "wide" enough for my needs. In my case, strings with latin-1 accents are not deemed "tainted", which means they don't get quoted by the code I have in place (Which would replace "é" with "é").
Why not just return the document with the charset header set to iso-8859-1?
I could just write a new PythonScript or something like that to do it ... But since the architecture is allready in place to do it, I'd rather just modify that.
I'd advise against that, cgi.escape gets used a lot, there's no point in making it more expensive than it needs to be. -- Jamie Heilman http://audible.transient.net/~jamie/ "Paranoia is a disease unto itself, and may I add, the person standing next to you may not be who they appear to be, so take precaution." -Sathington Willoughby
participants (2)
-
Jamie Heilman -
Jean-Francois.Doyon@CCRS.NRCan.gc.ca