Merge pull request #3328 from Minnozz/escape-query-in-link

Escape search query in generated URLs
bookwyrm-social · Mar 23, 2024 · 21f75da · 21f75da
2 parents 20db968 + c3d25c5
commit 21f75da
Show file tree

Hide file tree

Showing 2 changed files with 5 additions and 5 deletions.
diff --git a/bookwyrm/templates/search/book.html b/bookwyrm/templates/search/book.html
@@ -109,7 +109,7 @@
 <p class="block">
     {% if request.user.is_authenticated %}
         {% if not remote %}
-        <a href="{{ request.path }}?q={{ query }}&type=book&remote=true" id="tour-load-from-other-catalogues">
+        <a href="{{ request.path }}?q={{ query|urlencode }}&type=book&remote=true" id="tour-load-from-other-catalogues">
             {% trans "Load results from other catalogues" %}
         </a>
         {% else %}

diff --git a/bookwyrm/templates/search/layout.html b/bookwyrm/templates/search/layout.html
@@ -41,18 +41,18 @@ <h1 class="title">
 <nav class="tabs">
     <ul>
         <li{% if type == "book" %} class="is-active"{% endif %}>
-            <a href="{% url 'search' %}?q={{ query }}&type=book">{% trans "Books" %}</a>
+            <a href="{% url 'search' %}?q={{ query|urlencode }}&type=book">{% trans "Books" %}</a>
         </li>
         <li{% if type == "author" %} class="is-active"{% endif %}>
-            <a href="{% url 'search' %}?q={{ query }}&type=author">{% trans "Authors" %}</a>
+            <a href="{% url 'search' %}?q={{ query|urlencode }}&type=author">{% trans "Authors" %}</a>
         </li>
         {% if request.user.is_authenticated %}
         <li{% if type == "user" %} class="is-active"{% endif %}>
-            <a href="{% url 'search' %}?q={{ query }}&type=user">{% trans "Users" %}</a>
+            <a href="{% url 'search' %}?q={{ query|urlencode }}&type=user">{% trans "Users" %}</a>
         </li>
         {% endif %}
         <li{% if type == "list" %} class="is-active"{% endif %}>
-            <a href="{% url 'search' %}?q={{ query }}&type=list">{% trans "Lists" %}</a>
+            <a href="{% url 'search' %}?q={{ query|urlencode }}&type=list">{% trans "Lists" %}</a>
         </li>
     </ul>
 </nav>