Re: How to set configuration to always using ?html ?

Sounds good, I already have a custom template loader I've been manipulating things with.  configuration.setEscapeAllInterpolations(Escape.HTML); would be useful to many I think.

Thanks.

-----Original Message-----
From: [email protected] [mailto:[email protected]] On Behalf Of Attila Szegedi
Sent: Wednesday, February 20, 2008 11:09 AM
To: FreeMarker-user
Subject: Re: [FreeMarker-user] How to set configuration to always using ?html ?

You can't set it in configuration, but you can enclose the body of
each of your templates into a [#escape x as x?html]...[/#escape] block.

See <http://freemarker.org/docs/ref_directive_escape.html>

There's been some talk about making a feature that'll automatically
escape all interpolations in all loaded templates. For now, if you
want it automatically, you can implement your own TemplateLoader that
inserts the directive tags at the beginning and the end of the loaded
template content.

Attila.

On 2008.02.20., at 16:36, Newman, John W wrote:

> Hi,
>
> I just found out that I need to always use ?html in html pages!  I
> entered  <script>alert('boo');</script> on a text field, and got an
> alert on the next page that output this value!
>
> So I can go through all my web pages search for ${.*} and replace it
> with ${.*?html}, but isn't there a simple way to set that in the
> configuration?  I haven't been able to find it thus far, any help is
> appreciated.  Also is there any reason that would not be a good
> idea, even if I am always rendering html?
>
> Thanks,
> John


-------------------------------------------------------------------------
This SF.net email is sponsored by: Microsoft
Defy all challenges. Microsoft(R) Visual Studio 2008.
http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/
_______________________________________________
FreeMarker-user mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/freemarker-user

-------------------------------------------------------------------------
This SF.net email is sponsored by: Microsoft
Defy all challenges. Microsoft(R) Visual Studio 2008.
http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/