https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39224 --- Comment #168 from Martin Renvoize (ashimema) <martin.renvoize@openfifth.co.uk> --- Created attachment 204716 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=204716&action=edit Bug 39224: (QA follow-up) Unify identity provider login link rendering across protocols The SAML2 branch skipped the | url filter (needed because its URL is already fully percent-encoded server-side by Koha::Auth::Client::SAML2's login_url(), and re-encoding would double-encode it) while OAuth/OIDC applied it. The asymmetry looked like an escaping bug but wasn't one: AuthClient.pm's _provider_entry() already strips <>"' from every provider's URL regardless of protocol, which is what actually prevents href attribute breakout - the | url filter was redundant defense-in-depth on the OAuth/OIDC branch only. Drop the per-protocol branching entirely and use the same '| $raw' output for every protocol, matching the pattern already used elsewhere in these same templates (casServerUrl, Koha.CSPNonce). Verified against Koha::Template::Plugin::raw's own source (a documented no-op pass-through filter, required by Koha's auto-escaping TT setup) and confirmed both templates still pass xt/tt_tidy.t. Signed-off-by: Clemens Tubach <clemens.tubach@kit.edu> -- You are receiving this mail because: You are watching all bug changes.