Page MenuHomePhabricator

'from' parameter of rollback urls in the web interface include '+' signs (wrong encoding)
Closed, InvalidPublic

Description

Example url:

http://www.mediawiki.org/w/index.php?title=Manual:$wgInvalidateCacheOnLocalSettingsChange&action=rollback&from=Jack+Phoenix&token=foo1234

"Jack+Phoenix" should either have been "Jack%20Phoenix" (rawurlencode) or Jack_Phoenix (wfUrlencode).

This is causing javascript gadgets to fail from time to time when the username contains a space.

Although I think we just didn't notice it before, it could be regression in 1.17 since 1.16wmf4.


Version: unspecified
Severity: major

Details

Reference
bz27606

Event Timeline

bzimport raised the priority of this task from to Medium.Nov 21 2014, 11:27 PM
bzimport set Reference to bz27606.
bzimport added a subscriber: Unknown Object (MLST).

alexsm333 wrote:

Looks like "+" is used in a lot of places, compare this:
/wiki/Contributions/A_b
w/index.php?title=Special:Contributions...&target=A+b
w/index.php?title=Special:Log...&page=A+b

This works fine for MediaWiki itself so I'm not sure you can call it a bug.

you can, because we also have pagenames with + in them, so we really shouldn't use + as an escape char.

"+" is perfectly 100% normal URL form encoding for a space, and is always correct in this circumstance. Code that is attempting to pull URL query string parameters but doesn't know how to decode URL form encoding needs to be fixed.

(In reply to comment #3)

"+" is perfectly 100% normal URL form encoding for a space, and is always
correct in this circumstance. Code that is attempting to pull URL query string
parameters but doesn't know how to decode URL form encoding needs to be fixed.

Agreed (after IRC elucidation by brion). wfUrlEncode is only to be used for 'nice' urls in the core (ie. /wiki/Page:Name_here or Special:Contributions/John_Doe.

query formed links are always with urlencode and encode spaces with '+', this is consistent throughout the core, such as on : http://www.mediawiki.org/wiki/User:Jack_Phoenix the sidebar links to http://www.mediawiki.org/w/index.php?title=Special:Log&user=Jack+Phoenix