Item13837: Must encode # in url parameters

The URL Fragment delimiter is #, it must be encoded in any parameter string, or the generated URL parameters will be truncated at that character.
foswiki · Oct 29, 2015 · 4bc7094 · 4bc7094
1 parent deec907
commit 4bc7094
Show file tree

Hide file tree

Showing 2 changed files with 4 additions and 4 deletions.
diff --git a/UnitTestContrib/test/unit/Fn_ENCODE.pm b/UnitTestContrib/test/unit/Fn_ENCODE.pm
@@ -133,7 +133,7 @@ sub test_coverage {
       ->expandMacros( '%ENCODE{"' . $str . '" type="url"}%' );
 
     $this->assert_str_equals(
-"%27%22%03%04%05%06%07%08%09%0a%0b%0c%0d%0e%0f%10%11%12%13%14%15%16%17%18%19%1a%1b%1c%1d%1e%1f%20!%22#%24%25%26%27%28%29*%2b%2c-./0123456789:%3b%3c%3d%3e%3f%40ABCDEFGHIJKLMNOPQRSTUVWXYZ%5b%5c%5d%5e_%60abcdefghijklmnopqrstuvwxyz%7b%7c%7d~%7f",
+"%27%22%03%04%05%06%07%08%09%0a%0b%0c%0d%0e%0f%10%11%12%13%14%15%16%17%18%19%1a%1b%1c%1d%1e%1f%20!%22%23%24%25%26%27%28%29*%2b%2c-./0123456789:%3b%3c%3d%3e%3f%40ABCDEFGHIJKLMNOPQRSTUVWXYZ%5b%5c%5d%5e_%60abcdefghijklmnopqrstuvwxyz%7b%7c%7d~%7f",
         hexdump($results)
     );
 

diff --git a/core/lib/Foswiki.pm b/core/lib/Foswiki.pm
@@ -2967,7 +2967,7 @@ Encode by converting characters that are reserved in URLs to
 their %NN equivalents. This method is used for encoding
 strings that must be embedded _verbatim_ in URLs; it cannot
 be applied to URLs themselves, as it escapes reserved
-characters such as = and ?.
+characters such as =, &, %, ;, # and ?.
 
 RFC 1738, Dec. '94:
     <verbatim>
@@ -2977,7 +2977,7 @@ RFC 1738, Dec. '94:
     </verbatim>
 
 However this function is tuned for use with Foswiki. As such, it
-encodes *all* characters except 0-9a-zA-Z-_.:~!*#/
+encodes *all* characters except 0-9a-zA-Z-_.:~!*/
 
 This internal function is available for use by expanding the =%ENCODE= macro,
 specifying =type="url"=.  It is also the default encoding used by the =%URLPARAM= macro. 
@@ -2988,7 +2988,7 @@ sub urlEncode {
     my $text = shift;
 
     $text = encode_utf8($text);
-    $text =~ s{([^0-9a-zA-Z-_.:~!*#/])}{sprintf('%%%02x',ord($1))}ge;
+    $text =~ s{([^0-9a-zA-Z-_.:~!*/])}{sprintf('%%%02x',ord($1))}ge;
 
     return $text;
 }