#32345 closed Bug (fixed)
i18n.set_language unquotes next_url and produces wrong url for url params containing "&" character
Reported by: | Sebastian Kapunkt | Owned by: | Sandro Covo |
---|---|---|---|
Component: | Internationalization | Version: | 3.1 |
Severity: | Normal | Keywords: | i18n unquote |
Cc: | Johannes Maron | Triage Stage: | Ready for checkin |
Has patch: | yes | Needs documentation: | no |
Needs tests: | no | Patch needs improvement: | no |
Easy pickings: | yes | UI/UX: | no |
Description (last modified by )
When changing the language and the current URL parameter include a parameter value with an encoded "&" like
?paramter=some%20%26%20thing
the redirect response from set_langauge
is
?paramter=some%20&%20thing
where I would still expect the same URL from as in the beginning.
I've written a Django test that shows this bug:
def test_set_language_url_params(): from django.test import RequestFactory from django.views.i18n import set_language rf = RequestFactory() request = rf.post("", next="") request.META['HTTP_REFERER'] = '/someurl/?paramter=some%20%26%20thing' response = set_language(request) assert response.url == '/someurl/?paramter=some%20%26%20thing'
Change History (8)
comment:1 by , 4 years ago
Cc: | added |
---|---|
Description: | modified (diff) |
Easy pickings: | set |
Triage Stage: | Unreviewed → Accepted |
comment:2 by , 4 years ago
I can also confirm what Chrome and Firefox both send an encoded path, but they do not "re"-encode the query.
comment:3 by , 4 years ago
Owner: | changed from | to
---|---|
Status: | new → assigned |
comment:4 by , 4 years ago
Has patch: | set |
---|
I created a pull request with my changes here: https://github.com/django/django/pull/13884
They solve the issue of preserving the encoded & in the URL, but I didn't really see a connection of the testcase from #26466 with the issue that was described there, but maybe this was fixed through another change to reverse or translate_url. I added a quoted & and an unquoted & to the test, so for an url in the form of some%26thing&another%26thing
is preserved.
comment:5 by , 4 years ago
Needs documentation: | set |
---|---|
Needs tests: | set |
comment:6 by , 4 years ago
Needs documentation: | unset |
---|---|
Needs tests: | unset |
Triage Stage: | Accepted → Ready for checkin |
After some serious digging, the bug was introduced here: https://github.com/django/django/commit/9e3f141701b96b6974b3386f83dc76e70a41377d via #26466.
The problem seems to be, that the URL is not properly parsed. The path and GET attributes needs to be handled differently for that to work.