Skip to content

Commit 466ea37

Browse files
zokkiszokkis
committed
escaping
1 parent 30d9f02 commit 466ea37

File tree

7 files changed

+25
-19
lines changed

7 files changed

+25
-19
lines changed

‎routers/web/explore/code.go

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@ package explore
55

66
import (
77
"net/http"
8+
"net/url"
89

910
repo_model "code.gitea.io/gitea/models/repo"
1011
"code.gitea.io/gitea/modules/base"
@@ -37,9 +38,9 @@ func Code(ctx *context.Context) {
3738
queryType := ctx.FormTrim("t")
3839
isMatch := queryType == "match"
3940

40-
ctx.Data["Keyword"] = keyword
41-
ctx.Data["Language"] = language
42-
ctx.Data["queryType"] = queryType
41+
ctx.Data["Keyword"] = url.PathEscape(keyword)
42+
ctx.Data["Language"] = url.PathEscape(language)
43+
ctx.Data["queryType"] = url.PathEscape(queryType)
4344
ctx.Data["PageIsViewCode"] = true
4445

4546
if keyword == "" {

‎routers/web/explore/repo.go

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,7 @@ package explore
66
import (
77
"fmt"
88
"net/http"
9+
"net/url"
910

1011
"code.gitea.io/gitea/models/db"
1112
repo_model "code.gitea.io/gitea/models/repo"
@@ -107,7 +108,7 @@ func RenderRepoSearch(ctx *context.Context, opts *RepoSearchOptions) {
107108
ctx.Data["TopicOnly"] = topicOnly
108109

109110
language := ctx.FormTrim("language")
110-
ctx.Data["Language"] = language
111+
ctx.Data["Language"] = url.PathEscape(language)
111112

112113
archived := ctx.FormOptionalBool("archived")
113114
ctx.Data["IsArchived"] = archived
@@ -162,7 +163,7 @@ func RenderRepoSearch(ctx *context.Context, opts *RepoSearchOptions) {
162163
return
163164
}
164165

165-
ctx.Data["Keyword"] = keyword
166+
ctx.Data["Keyword"] = url.PathEscape(keyword)
166167
ctx.Data["Total"] = count
167168
ctx.Data["Repos"] = repos
168169
ctx.Data["IsRepoIndexerEnabled"] = setting.Indexer.RepoIndexerEnabled

‎routers/web/org/home.go

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@ package org
55

66
import (
77
"net/http"
8+
"net/url"
89
"path"
910
"strings"
1011

@@ -59,7 +60,7 @@ func Home(ctx *context.Context) {
5960
}
6061

6162
var orderBy db.SearchOrderBy
62-
ctx.Data["SortType"] = ctx.FormString("sort")
63+
ctx.Data["SortType"] = url.PathEscape(ctx.FormString("sort"))
6364
switch ctx.FormString("sort") {
6465
case "newest":
6566
orderBy = db.SearchOrderByNewest
@@ -87,10 +88,10 @@ func Home(ctx *context.Context) {
8788
}
8889

8990
keyword := ctx.FormTrim("q")
90-
ctx.Data["Keyword"] = keyword
91+
ctx.Data["Keyword"] = url.PathEscape(keyword)
9192

9293
language := ctx.FormTrim("language")
93-
ctx.Data["Language"] = language
94+
ctx.Data["Language"] = url.PathEscape(language)
9495

9596
page := ctx.FormInt("page")
9697
if page <= 0 {

‎routers/web/repo/search.go

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@ package repo
55

66
import (
77
"net/http"
8+
"net/url"
89

910
"code.gitea.io/gitea/modules/base"
1011
"code.gitea.io/gitea/modules/context"
@@ -27,9 +28,9 @@ func Search(ctx *context.Context) {
2728
queryType := ctx.FormTrim("t")
2829
isMatch := queryType == "match"
2930

30-
ctx.Data["Keyword"] = keyword
31-
ctx.Data["Language"] = language
32-
ctx.Data["queryType"] = queryType
31+
ctx.Data["Keyword"] = url.PathEscape(keyword)
32+
ctx.Data["Language"] = url.PathEscape(language)
33+
ctx.Data["queryType"] = url.PathEscape(queryType)
3334
ctx.Data["PageIsViewCode"] = true
3435

3536
if keyword == "" {

‎routers/web/user/code.go

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@ package user
55

66
import (
77
"net/http"
8+
"net/url"
89

910
repo_model "code.gitea.io/gitea/models/repo"
1011
"code.gitea.io/gitea/modules/base"
@@ -42,9 +43,9 @@ func CodeSearch(ctx *context.Context) {
4243
queryType := ctx.FormTrim("t")
4344
isMatch := queryType == "match"
4445

45-
ctx.Data["Keyword"] = keyword
46-
ctx.Data["Language"] = language
47-
ctx.Data["queryType"] = queryType
46+
ctx.Data["Keyword"] = url.PathEscape(keyword)
47+
ctx.Data["Language"] = url.PathEscape(language)
48+
ctx.Data["queryType"] = url.PathEscape(queryType)
4849
ctx.Data["IsCodePage"] = true
4950

5051
if keyword == "" {

‎routers/web/user/profile.go

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,7 @@ package user
77
import (
88
"fmt"
99
"net/http"
10+
"net/url"
1011
"path"
1112
"strings"
1213

@@ -137,10 +138,10 @@ func prepareUserProfileTabData(ctx *context.Context, showPrivate bool, profileDb
137138
}
138139

139140
keyword := ctx.FormTrim("q")
140-
ctx.Data["Keyword"] = keyword
141+
ctx.Data["Keyword"] = url.PathEscape(keyword)
141142

142143
language := ctx.FormTrim("language")
143-
ctx.Data["Language"] = language
144+
ctx.Data["Language"] = url.PathEscape(language)
144145

145146
followers, numFollowers, err := user_model.GetUserFollowers(ctx, ctx.ContextUser, ctx.Doer, db.ListOptions{
146147
PageSize: pagingNum,

‎templates/shared/repo_search.tmpl

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@
1616
{{if not .TabName}}{{$tabQuery = ""}}{{end}}
1717
{{$languageQuery := printf "language=%s&" .Language}}
1818
{{if not .TabName}}{{$languageQuery = ""}}{{end}}
19-
{{$queryParams := (printf "%s%sq=%s" $tabQuery $languageQuery .Keyword) | PathEscape}}
19+
{{$queryParams := printf "%s%sq=%s" $tabQuery $languageQuery .Keyword}}
2020
<!-- Filter -->
2121
{{$queryParamsWithSort := printf "%s&sort=%s" $queryParams .SortType}}
2222
<form class="ui form ignore-dirty" id="repo-search-form" data-query-params="{{$queryParamsWithSort}}">
@@ -26,7 +26,7 @@
2626
</span>
2727
{{svg "octicon-triangle-down" 14 "dropdown icon"}}
2828
<div class="menu">
29-
<a class="item" href="{{printf "%s?%s" (.Link | PathEscapeSegments) $queryParamsWithSort}}">{{ctx.Locale.Tr "filter.clear"}}</a>
29+
<a class="item" href="{{printf "%s?%s" .Link $queryParamsWithSort}}">{{ctx.Locale.Tr "filter.clear"}}</a>
3030
<div class="divider"></div>
3131
<label class="item"><input type="radio" name="archived" {{if .IsArchived.IsTrue}}checked{{end}} value="1"> {{ctx.Locale.Tr "filter.is_archived"}}</label>
3232
<label class="item"><input type="radio" name="archived" {{if .IsArchived.IsFalse}}checked{{end}} value="0"> {{ctx.Locale.Tr "filter.not_archived"}}</label>
@@ -52,7 +52,7 @@
5252
</span>
5353
{{svg "octicon-triangle-down" 14 "dropdown icon"}}
5454
<div class="menu">
55-
{{$href := printf "%s?%s" (.Link | PathEscapeSegments) $queryParams}}
55+
{{$href := printf "%s?%s" .Link $queryParams}}
5656
<a class="{{if eq .SortType "newest"}}active {{end}}item" href="{{$href}}&sort=newest">{{ctx.Locale.Tr "repo.issues.filter_sort.latest"}}</a>
5757
<a class="{{if eq .SortType "oldest"}}active {{end}}item" href="{{$href}}&sort=oldest">{{ctx.Locale.Tr "repo.issues.filter_sort.oldest"}}</a>
5858
<a class="{{if eq .SortType "alphabetically"}}active {{end}}item" href="{{$href}}&sort=alphabetically">{{ctx.Locale.Tr "repo.issues.label.filter_sort.alphabetically"}}</a>

0 commit comments

Comments
 (0)