Bug 523827 - CGI.pm popup_menu if optgroup, $selected is not properly escaped.
Summary: CGI.pm popup_menu if optgroup, $selected is not properly escaped.
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 5
Classification: Red Hat
Component: perl
Version: 5.4
Hardware: All
OS: Linux
high
high
Target Milestone: rc
: ---
Assignee: perl-maint-list
QA Contact: Petr Šplíchal
URL:
Whiteboard:
Depends On:
Blocks: 590060 701631
TreeView+ depends on / blocked
 
Reported: 2009-09-16 19:23 UTC by Bryan Mason
Modified: 2018-10-27 12:23 UTC (History)
6 users (show)

Fixed In Version: perl-5.8.8-29.el5
Doc Type: Bug Fix
Doc Text:
Cause CGI::popup_menu does not generated correct HTML if the default option contains a plus-sign ("+"). Consequence There could be missing closing tag. Fix Fix of regular expression fixed generation of HTML code. Result Closing tags are generated allright.
Clone Of:
Environment:
Last Closed: 2012-02-21 05:39:26 UTC


Attachments (Terms of Use)
Proposed patch (575 bytes, patch)
2009-09-16 19:23 UTC, Bryan Mason
no flags Details | Diff


Links
System ID Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2012:0199 normal SHIPPED_LIVE perl bug fix update 2012-02-20 14:54:01 UTC

Description Bryan Mason 2009-09-16 19:23:29 UTC
Created attachment 361356 [details]
Proposed patch

Description of problem:

    CGI::popup_menu does not generated correct HTML if the default 
    option contains a plus-sign ("+").

Version-Release number of selected component (if applicable):

    perl-5.8.8-27.el5

How reproducible:

    Every time

Steps to Reproduce:

    perl -MCGI -e 'print CGI::popup_menu(-values=>[CGI::optgroup(-name=>"A",-values=>["a","b+"])],-default=>"b+")';
  
Actual results:

    <select name="" >
    <optgroup label="A">
    <option value="a">a</option>
    <option value="b+">b+</option>
    </optgroup>

Expected results:
    
    <select name="" >
    <optgroup label="A">
    <option value="a">a</option>
    <option selected="selected" value="b+">b+</option>
    </optgroup>
    </select>

Additional info:

    Proposed patch submitted by Ian Page Hands with help from
    #raleigh.pm on irc.perl.org, is attached and has been 
    accepted upstream:

        http://rt.cpan.org/Public/Bug/Display.html?id=49606#txn-663058

Comment 6 RHEL Product and Program Management 2010-08-09 18:55:51 UTC
This request was evaluated by Red Hat Product Management for
inclusion in the current release of Red Hat Enterprise Linux.
Because the affected component is not scheduled to be updated in the
current release, Red Hat is unfortunately unable to address this
request at this time. Red Hat invites you to ask your support
representative to propose this request, if appropriate and relevant,
in the next release of Red Hat Enterprise Linux.

Comment 20 Marcela Mašláňová 2011-09-26 07:11:08 UTC
    Technical note added. If any revisions are required, please edit the "Technical Notes" field
    accordingly. All revisions will be proofread by the Engineering Content Services team.
    
    New Contents:
Cause
    CGI::popup_menu does not generated correct HTML if the  default option contains a plus-sign ("+").
Consequence
    There could be missing closing tag.
Fix
    Fix of regular expression fixed generation of HTML code.
Result
    Closing tags are generated allright.

Comment 22 errata-xmlrpc 2012-02-21 05:39:26 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

http://rhn.redhat.com/errata/RHBA-2012-0199.html


Note You need to log in before you can comment on or make changes to this bug.