Escape slashes in query strings. This fixes #445

diff --git a/CHANGES b/CHANGES
index cfe4c43c1b60d8f3de5be593cb7d9d9197d7fdae..ba820cc02ff93902a6908f6260443c49a0d12d33 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -31,6 +31,8 @@ Version 2.8
   (`code_generator_class` and `context_class`) (pull request ``#404``).
 - added support for context/environment/evalctx decorator functions on
   the finalize callback of the environment.
+- escape query strings for urlencode properly.  Previously slashes were not
+  escaped in that place.
 
 Version 2.7.3
 -------------

diff --git a/jinja2/filters.py b/jinja2/filters.py
index 0fb5a5aa8ca1792137bdd93f016062fc4899349f..4b444852e0ff39d5b9f351dc05c3e56539f3a565 100644 (file)
--- a/jinja2/filters.py
+++ b/jinja2/filters.py
@@ -94,7 +94,8 @@ def do_urlencode(value):
     if itemiter is None:
         return unicode_urlencode(value)
     return u'&'.join(unicode_urlencode(k) + '=' +
-                     unicode_urlencode(v) for k, v in itemiter)
+                     unicode_urlencode(v, for_qs=True)
+                     for k, v in itemiter)
 
 
 @evalcontextfilter

diff --git a/jinja2/utils.py b/jinja2/utils.py
index e12255f25d8a9cde0aae3f680fd343da014f143c..cdd4cd3af05c34be55eaba61761d3f25e44d8b00 100644 (file)
--- a/jinja2/utils.py
+++ b/jinja2/utils.py
@@ -283,7 +283,7 @@ def generate_lorem_ipsum(n=5, html=True, min=20, max=100):
     return Markup(u'\n'.join(u'<p>%s</p>' % escape(x) for x in result))
 
 
-def unicode_urlencode(obj, charset='utf-8'):
+def unicode_urlencode(obj, charset='utf-8', for_qs=False):
     """URL escapes a single bytestring or unicode string with the
     given charset if applicable to URL safe quoting under all rules
     that need to be considered under all supported Python versions.
@@ -295,7 +295,11 @@ def unicode_urlencode(obj, charset='utf-8'):
         obj = text_type(obj)
     if isinstance(obj, text_type):
         obj = obj.encode(charset)
-    return text_type(url_quote(obj))
+    safe = for_qs and b'' or b'/'
+    rv = text_type(url_quote(obj, safe))
+    if for_qs:
+        rv = rv.replace('%20', '+')
+    return rv
 
 
 class LRUCache(object):