Item6766: DBIQueryPlugin's protected option causes page error on TWiki 5 - worked on TWiki4

TWiki detected an internal error - please check your TWiki logs and webserver logs for more information.

Can't locate object method "unescapeHTML" via package "TWiki::Request"

However, this same thing works on TWiki 4.

The log file entry for this is

| 2011-07-09 - 1
2:41 | Can't locate object method "unescapeHTML" via package "TWiki::Request" at /var/www/twiki/lib/TWiki/Plugins/DBIQueryPlugin.pm line 130.

The code around this area reads:

sub unprotectValue
{
    my $val = shift;
    dprint "Before unprotecting: $val\n";
    my $cgiQuery = TWiki::Func::getCgiQuery();
    $val = $cgiQuery->unescapeHTML($val);
    $val =~ s/(?<!\\)\\n/\n/gs;
    $val =~ s/(?<!\\)\\r/\r/gs;
    $val =~ s/\\\\(n|r)/\\$1/gs;
    $val =~ s/\.(.)/$1/gs;
    dprint "After unprotecting: $val\n";
    return $val;
}

When I check the getCGIQuery() function, I notice that it has changed between versions 4 and 5, viz.

In TWiki 4, it was
sub getCgiQuery {
    ASSERT($TWiki::Plugins::SESSION) if DEBUG;
    return $TWiki::Plugins::SESSION->{cgiQuery};
}

In TWiki 5, it is

sub getCgiQuery {
    ASSERT($TWiki::Plugins::SESSION) if DEBUG;
    return $TWiki::Plugins::SESSION->{request};
}

Does request.pm need to explicitly support escapeHTML and unescapeHTML?

The offending TML is the following...

%DBI_QUERY{"Zermatt" protected="description schedules" }%
SELECT product_id, product_name, description, schedules from product WHERE product_id = '%URLPARAM{product_id}%' 
.body
....
....
%DBI_QUERY%

If I remove the "protected=...", then I do not get an error, but the contents of the database fields messes up the page display.

Should this be considered a Plugin problem, or a TWiki compatibility issue?

Since this option has been used in many pages, it is causing us a delay in upgrading from TWiki 4 to Twiki 5.

-- TWiki:Main/DipuDeshmukh - 2011-07-09

Lowering the priority. Trying to workaround by not using the option for now.

-- TWiki:Main.DipuDeshmukh - 2011-07-10

TWiki-5.0 has its own CGI request method. This has bitten plugin programmers elsewhere too. Safest to not rely on CGI functions. Hand-craft the entity decoding (as in TWiki::Plugins::DBCachePlugin::Core::entityDecode), or use CPAN:HTML::Entities.

-- TWiki:Main.PeterThoeny - 2011-07-11