zopefoundation / Products.ZSQLMethods

SQL method support for Zope.
Other
3 stars 14 forks source link

ZSQL Test Forms do no HTML escaping #44

Closed wlang42 closed 10 months ago

wlang42 commented 10 months ago

BUG/PROBLEM REPORT

What I did:

I added a ZSQLMethod in ZMI with this statement (I use a Oracle DB):

select 'a<xyz>b' VALUE from dual

sql-01

and clicked on the "Test" tab.

What I expect to happen:

That the Value a<xyz>b is shown.

What actually happened:

In the browser i see the value ab (instead of a<xyz>b). Both in the query and in the result table:

sql-02

What version of Python and Zope/Addons I am using:

Zope-5.9 Python-3.9.5 Products.ZSQLMethods-4.0

Additional Info

It seems that the "html_quote" is missing in some DTML reports. I will provide a PR with a fix and tests...