[Django] #32345: i18n.set_language unquotes next_url and produces wrong url for url params containing "&" character
Django
containing "&" character
-------------------------------------+-------------------------------------
Reporter: Sebastian | Owner: nobody
Kapunkt |
Type: Bug | Status: new
Component: | Version: 3.1
Internationalization |
Severity: Normal | Keywords: i18n unquote
Triage Stage: | Has patch: 0
Unreviewed |
Needs documentation: 0 | Needs tests: 0
Patch needs improvement: 0 | Easy pickings: 0
UI/UX: 0 |
-------------------------------------+-------------------------------------
When changing the language and the current URL parameter include a
parameter value with an encoded "&" like
{{{
?paramter=some%20%26%20thing
}}}
the redirect response from ```set_langauge``` is
{{{
?paramter=some%20&%20thing
}}}
where I would still expect the same URL from as in the beginning.
I've written a Django test that shows this bug:
{{{
def test_set_language_url_params():
from django.test import RequestFactory
from django.views.i18n import set_language
rf = RequestFactory()
request = rf.post("", next="")
request.META['HTTP_REFERER'] = '/someurl/?paramter=some%20%26%20thing'
response = set_language(request)
assert response.url == '/someurl/?paramter=some%20%26%20thing'
}}}
--
Ticket URL: <https://code.djangoproject.com/ticket/32345>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.
Django
containing "&" character
Reporter: Sebastian Kapunkt | Owner: nobody
Type: Bug | Status: new
Component: Internationalization | Version: 3.1
Severity: Normal | Resolution:
Keywords: i18n unquote | Triage Stage: Accepted
Has patch: 0 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
--------------------------------------+------------------------------------
Changes (by Johannes Maron):
* cc: Johannes Maron (added)
* easy: 0 => 1
* stage: Unreviewed => Accepted
Old description:
> When changing the language and the current URL parameter include a
> parameter value with an encoded "&" like
>
> {{{
> ?paramter=some%20%26%20thing
> }}}
>
> the redirect response from ```set_langauge``` is
>
> {{{
> ?paramter=some%20&%20thing
> }}}
> where I would still expect the same URL from as in the beginning.
>
> I've written a Django test that shows this bug:
> {{{
> def test_set_language_url_params():
> from django.test import RequestFactory
> from django.views.i18n import set_language
>
> rf = RequestFactory()
> request = rf.post("", next="")
> request.META['HTTP_REFERER'] =
> '/someurl/?paramter=some%20%26%20thing'
>
> response = set_language(request)
> assert response.url == '/someurl/?paramter=some%20%26%20thing'
> }}}
New description:
When changing the language and the current URL parameter include a
parameter value with an encoded "&" like
{{{
?paramter=some%20%26%20thing
}}}
the redirect response from `set_langauge` is
{{{
?paramter=some%20&%20thing
}}}
where I would still expect the same URL from as in the beginning.
I've written a Django test that shows this bug:
{{{
def test_set_language_url_params():
from django.test import RequestFactory
from django.views.i18n import set_language
rf = RequestFactory()
request = rf.post("", next="")
request.META['HTTP_REFERER'] = '/someurl/?paramter=some%20%26%20thing'
response = set_language(request)
assert response.url == '/someurl/?paramter=some%20%26%20thing'
}}}
--
Comment:
After some serious digging, the bug was introduced here:
https://github.com/django/django/commit/9e3f141701b96b6974b3386f83dc76e70a41377d
via #26466.
The problem seems to be, that the URL is not properly parsed. The path and
GET attributes needs to be handled differently for that to work.
--
Ticket URL: <https://code.djangoproject.com/ticket/32345#comment:1>
Django
containing "&" character
Reporter: Sebastian Kapunkt | Owner: nobody
Component: Internationalization | Version: 3.1
Severity: Normal | Resolution:
Has patch: 0 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
--------------------------------------+------------------------------------
Comment (by Johannes Maron):
I can also confirm what Chrome and Firefox both send an encoded path, but
they do not "re"-encode the query.
--
Ticket URL: <https://code.djangoproject.com/ticket/32345#comment:2>
Django
containing "&" character
-------------------------------------+-------------------------------------
| Covo
Type: Bug | Status: assigned
Component: | Version: 3.1
Internationalization |
Severity: Normal | Resolution:
Keywords: i18n unquote | Triage Stage: Accepted
Has patch: 0 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
-------------------------------------+-------------------------------------
Changes (by Sandro Covo):
* owner: nobody => Sandro Covo
* status: new => assigned
--
Ticket URL: <https://code.djangoproject.com/ticket/32345#comment:3>
Django
containing "&" character
-------------------------------------+-------------------------------------
| Covo
Type: Bug | Status: assigned
Internationalization |
Severity: Normal | Resolution:
Keywords: i18n unquote | Triage Stage: Accepted
Has patch: 1 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
-------------------------------------+-------------------------------------
Changes (by Sandro Covo):
* has_patch: 0 => 1
Comment:
I created a pull request with my changes here:
[https://github.com/django/django/pull/13884]
They solve the issue of preserving the encoded & in the URL, but I didn't
really see a connection of the testcase from #26466 with the issue that
was described there, but maybe this was fixed through another change to
reverse or translate_url. I added a quoted & and an unquoted & to the
test, so for an url in the form of {{{some%26thing&another%26thing}}} is
preserved.
--
Ticket URL: <https://code.djangoproject.com/ticket/32345#comment:4>
Django
containing "&" character
-------------------------------------+-------------------------------------
| Covo
Type: Bug | Status: assigned
Internationalization |
Severity: Normal | Resolution:
Keywords: i18n unquote | Triage Stage: Accepted
Needs tests: 1 | Patch needs improvement: 0
Easy pickings: 1 | UI/UX: 0
-------------------------------------+-------------------------------------
* needs_docs: 0 => 1
* needs_tests: 0 => 1
--
Ticket URL: <https://code.djangoproject.com/ticket/32345#comment:5>
Django
containing "&" character
-------------------------------------+-------------------------------------
| Covo
Type: Bug | Status: assigned
Internationalization |
Severity: Normal | Resolution:
Keywords: i18n unquote | Triage Stage: Ready for
| checkin
Has patch: 1 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
-------------------------------------+-------------------------------------
Changes (by Johannes Maron):
* needs_docs: 1 => 0
* needs_tests: 1 => 0
* stage: Accepted => Ready for checkin
--
Ticket URL: <https://code.djangoproject.com/ticket/32345#comment:6>
Django
containing "&" character
-------------------------------------+-------------------------------------
| Covo
Component: | Version: 3.1
Internationalization |
Severity: Normal | Resolution: fixed
Keywords: i18n unquote | Triage Stage: Ready for
| checkin
Needs tests: 0 | Patch needs improvement: 0
-------------------------------------+-------------------------------------
Comment (by Mariusz Felisiak <felisiak.mariusz@…>):
In [changeset:"0a3d93ffba6fa7ee39404c692c8874a8fae27ea8" 0a3d93f]:
{{{
#!CommitTicketReference repository=""
revision="0a3d93ffba6fa7ee39404c692c8874a8fae27ea8"
[3.2.x] Fixed #32345 -- Fixed preserving encoded query strings in
set_language() view.
Thanks Johannes Maron for the review.
Backport of 6822aa5c6c3fbec7c5393a05e990865ba59fe167 from master
}}}
--
Ticket URL: <https://code.djangoproject.com/ticket/32345#comment:8>
Django
containing "&" character
-------------------------------------+-------------------------------------
| Covo
Type: Bug | Status: closed
Internationalization |
Severity: Normal | Resolution: fixed
Keywords: i18n unquote | Triage Stage: Ready for
| checkin
Needs tests: 0 | Patch needs improvement: 0
-------------------------------------+-------------------------------------
* status: assigned => closed
* resolution: => fixed
Comment:
In [changeset:"6822aa5c6c3fbec7c5393a05e990865ba59fe167" 6822aa5c]:
{{{
#!CommitTicketReference repository=""
revision="6822aa5c6c3fbec7c5393a05e990865ba59fe167"
Fixed #32345 -- Fixed preserving encoded query strings in set_language()
view.
Thanks Johannes Maron for the review.
}}}
--
Ticket URL: <https://code.djangoproject.com/ticket/32345#comment:7>