admin interface filter.html does not encode url attributes properly

[tony.perkins@…]

If you filter on a field that has a value that includes an ampersand when selecting that value to filter on it does not work.

The output of filter.html for an example

<li>
    <a href="?title=Escapade%20-%20Adult%20Kayak%20&amp;%20Snorkel,%20Northwest%20Maui">Escapade - Adult Kayak &amp; Snorkel, Northwest Maui</a></li>

I tried using the urlencode filter, but it encodes the ? as well which causes it to fail also.

<a href="{{ choice.query_string|urlencode }}">{{ choice.display|escape }}</a></li>

If I change the following it works. I know this is not the right place.

In filter.html
change

<a href="{{ choice.query_string }}">{{ choice.display|escape }}</a></li>

to

<a href="{{ choice.query_string|fix_ampersands }}">{{ choice.display|escape }}</a></li>

in html.py
change

def fix_ampersands(value):
    "Returns the given HTML with all unencoded ampersands encoded correctly"
    return unencoded_ampersands_re.sub('&', value)

to

  def fix_ampersands(value):
    "Returns the given HTML with all unencoded ampersands encoded correctly"
    return unencoded_ampersands_re.sub('%26', value)

[Robert Bunting]

One way to patch it - saves lots of potential problems with the query string

[Robert Bunting]

better unicode version

[Robert Bunting]

Not sure if this would be acceptable, but it's a patch which will make sure the querystring is more useable everywhere. It solves '&', and also a problem I have been having with '>' (which when used in another form confuses the CSRF substitution regexp!)

[Chris Beaven]

New patch (against SVN trunk, not newforms-admin branch) which fixes the issue at the core. I also added a small optimization.

The code in question hasn't changed in newforms, it may as well be fixed on trunk, yes?

[Malcolm Tredinnick]

Not worth fixing on trunk, since newforms-admin is so close. Pushing to the newforms-admin branch, though, so they can check it's been fixed over there.

[Karen Tracey <kmtracey@…>]

Same patch, only against newforms-admin

[Karen Tracey <kmtracey@…>]

No, it hasn't been fixed in newforms-admin. Verified the problem and that the patch (rebased since the trunk version would not apply) fixes it.

[Brian Rosner]

(In [7810]) newforms-admin: Fixed #4074 -- Properly urlencode the ChangeList query string when the value has an ampersand. Thanks Tony Perkins and SmileyChris.