From f4d0898a716aef02cc0daff331f3ccfa6c5a4e71 Mon Sep 17 00:00:00 2001
From: Tomas Kopecek <tkopecek@redhat.com>
Date: Tue, 8 Sep 2020 15:46:12 +0200
Subject: [PATCH] web: urlquote buildtarget/buildtag names

Fixes: https://pagure.io/koji/issue/2468
---
 www/kojiweb/taskinfo_params.chtml | 27 ++++++++++++++-------------
 1 file changed, 14 insertions(+), 13 deletions(-)

diff --git a/www/kojiweb/taskinfo_params.chtml b/www/kojiweb/taskinfo_params.chtml
index e98563b3..2bd7ef28 100644
--- a/www/kojiweb/taskinfo_params.chtml
+++ b/www/kojiweb/taskinfo_params.chtml
@@ -1,3 +1,4 @@
+#from urllib.parse import quote
 #import koji
 #from kojiweb import util
 
@@ -37,7 +38,7 @@ $value
 #if $task.method == 'buildSRPMFromSCM'
 <strong>SCM URL:</strong> $params[0]<br/>
 #if $len($params) > 1
-<strong>Build Tag:</strong> <a href="taginfo?tagID=$buildTag">$buildTag</a><br/>
+<strong>Build Tag:</strong> <a href="taginfo?tagID=$quote($buildTag)">$buildTag</a><br/>
 #end if
 #if $len($params) > 2
 $printOpts($params[2])
@@ -46,7 +47,7 @@ $printOpts($params[2])
 <strong>CVS URL:</strong> $params[0]
 #elif $task.method == 'buildArch'
 <strong>SRPM:</strong> $params[0]<br/>
-<strong>Build Tag:</strong> <a href="taginfo?tagID=$buildTag">$buildTag</a><br/>
+<strong>Build Tag:</strong> <a href="taginfo?tagID=$quote($buildTag)">$buildTag</a><br/>
 <strong>Arch:</strong> $params[2]<br/>
 <strong>Keep SRPM?</strong> #if $params[3] then 'yes' else 'no'#<br/>
 #if $len($params) > 4
@@ -65,7 +66,7 @@ $printOpts($params[4])
 #else
 <strong>Build Target:</strong> (no build target)<br/>
 #end if
-<strong>Web URL:</strong> <a href="$params[3]">$params[3]</a>
+<strong>Web URL:</strong> <a href="$quote($params[3])">$params[3]</a>
 #elif $task.method == 'tagNotification'
 <strong>Recipients:</strong>&nbsp;$printValue('', $params[0])<br/>
 <strong>Successful?:</strong> #if $params[1] then 'yes' else 'no'#<br/>
@@ -83,11 +84,11 @@ $printOpts($params[4])
 #end if
 #elif $task.method == 'build'
 <strong>Source:</strong> $params[0]<br/>
-<strong>Build Target:</strong> <a href="buildtargetinfo?name=$params[1]">$params[1]</a><br/>
+<strong>Build Target:</strong> <a href="buildtargetinfo?name=$quote($params[1])">$params[1]</a><br/>
 $printOpts($params[2])
 #elif $task.method == 'maven'
 <strong>SCM URL:</strong> $params[0]<br/>
-<strong>Build Target:</strong> <a href="buildtargetinfo?name=$params[1]">$params[1]</a><br/>
+<strong>Build Target:</strong> <a href="buildtargetinfo?name=$quote($params[1])">$params[1]</a><br/>
 $printOpts($params[2])
 #elif $task.method == 'buildMaven'
 <strong>SCM URL:</strong> $params[0]<br/>
@@ -99,7 +100,7 @@ $printOpts($params[2])
 <strong>Spec File URL:</strong> $params[0]<br/>
 #if 'locked' in $buildTarget
 #set $buildTag = $buildTarget.name
-<strong>Build Tag:</strong> <a href="taginfo?tagID=$buildTag">$buildTag</a><br/>
+<strong>Build Tag:</strong> <a href="taginfo?tagID=$quote($buildTag)">$buildTag</a><br/>
 #else
 <strong>Build Target:</strong> <a href="buildtargetinfo?targetID=$buildTarget.id">$buildTarget.name</a><br/>
 #end if
@@ -119,7 +120,7 @@ $printOpts($params[4])
 <tr><td><strong>$key:</strong></td><td>$printMap($val)</td></tr>
 #end for
 </table>
-<strong>Build Target:</strong> <a href="buildtargetinfo?name=$params[1]">$params[1]</a><br/>
+<strong>Build Target:</strong> <a href="buildtargetinfo?name=$quote($params[1])">$params[1]</a><br/>
 #if $len($params) > 2
 $printOpts($params[2])
 #end if
@@ -127,12 +128,12 @@ $printOpts($params[2])
 <strong>Name:</strong> $params[0]<br/>
 <strong>Version:</strong> $params[1]<br/>
 <strong>Arch:</strong> $params[2]<br/>
-<strong>Build Target:</strong> <a href="buildtargetinfo?name=$params[3]">$params[3]</a><br/>
+<strong>Build Target:</strong> <a href="buildtargetinfo?name=$quote($params[3])">$params[3]</a><br/>
 <strong>Kickstart File:</strong> $params[4]<br/>
 $printOpts($params[5])
 #elif $task.method == 'image'
 <strong>Arches:</strong> #echo ', '.join($params[2])#<br/>
-<strong>Build Target:</strong> <a href="buildtargetinfo?name=$params[3]">$params[3]</a><br/>
+<strong>Build Target:</strong> <a href="buildtargetinfo?name=$quote($params[3])">$params[3]</a><br/>
 <strong>Installation Tree:</strong> $params[4]<br/>
 $printOpts($params[5])
 #elif $task.method == 'createLiveCD' or $task.method == 'createAppliance' or $task.method == 'createLiveMedia'
@@ -146,7 +147,7 @@ $printOpts($params[8])
 #else
 ## old method signature
 <strong>Arch:</strong> $params[0]<br/>
-<strong>Build Target:</strong> <a href="buildtargetinfo?name=$params[1]">$params[1]</a><br/>
+<strong>Build Target:</strong> <a href="buildtargetinfo?name=$quote($params[1])">$params[1]</a><br/>
 <strong>Kickstart File:</strong> $params[2]<br/>
 #if $len($params) > 3
 $printOpts($params[3])
@@ -154,13 +155,13 @@ $printOpts($params[3])
 #end if
 #elif $task.method == 'createImage'
 #set $target = $params[4]
-<strong>Build Target:</strong> <a href="buildtargetinfo?name=$target.name">$target.name</a><br/>
+<strong>Build Target:</strong> <a href="buildtargetinfo?targetID=$target.id">$target.name</a><br/>
 <strong>Install Tree:</strong> $params[7]<br/>
 $printOpts($params[8])
 #elif $task.method == 'winbuild'
 <strong>VM:</strong> $params[0]<br/>
 <strong>SCM URL:</strong> $params[1]<br/>
-<strong>Build Target:</strong> <a href="buildtargetinfo?name=$params[2]">$params[2]</a><br/>
+<strong>Build Target:</strong> <a href="buildtargetinfo?name=$quote($params[2])">$params[2]</a><br/>
 #if $len($params) > 3
 $printOpts($params[3])
 #end if
@@ -228,7 +229,7 @@ $printMap($subtask[2], '&nbsp;&nbsp;&nbsp;&nbsp;')
 #set $groupNum += 1
 &nbsp;&nbsp;<strong>$groupNum</strong>: #echo ', '.join($urls)#<br/>
 #end for
-<strong>Build Target:</strong> <a href="buildtargetinfo?name=$params[1]">$params[1]</a><br/>
+<strong>Build Target:</strong> <a href="buildtargetinfo?name=$quote($params[1])">$params[1]</a><br/>
 $printOpts($params[2])
 #elif $task.method == 'waitrepo'
 <strong>Build Tag:</strong> $params[0]<br/>