Merge branch 'issue-331' into 'master'

Encode url params in store

#331

See merge request !250

circle/dashboard/templates/dashboard/store/_list-box.html

@@ -4,7 +4,7 @@
   <div class="list-group-item">
     <div class="row">
       <div class="col-sm-6">
-        <a href="{% url "dashboard.views.store-upload"%}?directory={{ current }}"
+        <a href="{% url "dashboard.views.store-upload"%}?directory={{ current|urlencode }}"
           class="btn btn-info btn-xs js-hidden">
           {% trans "Upload" %}
         </a>
@@ -12,7 +12,7 @@
           method="POST" enctype="multipart/form-data" class="no-js-hidden"
           id="store-upload-form">
           {% csrf_token %}
-          <input type="hidden" name="current_dir" value="{{ current }}"/>
+          <input type="hidden" name="current_dir" value="{{ current|urlencode }}"/>
           <input type="hidden" name="next" value="{{ next_url }}"/>
           <div class="input-group" style="max-width: 350px;">
             <span class="input-group-btn" id="store-upload-browse">
@@ -33,12 +33,12 @@
       </div><!-- .col-sm-6 upload -->
 
       <div class="col-sm-6">
-        <a href="{% url "dashboard.views.store-remove" %}?path={{ current }}" 
+        <a href="{% url "dashboard.views.store-remove" %}?path={{ current|urlencode }}"
           class="btn btn-danger btn-xs pull-right store-action-button"
           title="{% trans "Remove directory" %}">
           <i class="fa fa-times"></i>
         </a>
-        <a href="{% url "dashboard.views.store-download" %}?path={{ current }}" 
+        <a href="{% url "dashboard.views.store-download" %}?path={{ current|urlencode }}"
           class="btn btn-primary btn-xs pull-right store-action-button"
           title="{% trans "Download directory" %}">
           <i class="fa fa-cloud-download"></i>
@@ -64,7 +64,7 @@
 </div><!-- .list-group -->
 
 <div class="list-group" id="store-list-list">
-  <a href="{% url "dashboard.views.store-list" %}?directory={{ up_url }}" 
+  <a href="{% url "dashboard.views.store-list" %}?directory={{ up_url|urlencode }}"
     class="list-group-item store-list-item" data-item-type="D">
     {% if current == "/" %}
       <div class="store-list-item-icon">
@@ -85,8 +85,8 @@
 
   {% for f in root %}
   <a class="list-group-item store-list-item" data-item-type="{{ f.TYPE }}"
-    href="{% if f.TYPE == "D" %}{% url "dashboard.views.store-list" %}?directory={{ f.path }}{% else %}
-    {% url "dashboard.views.store-download" %}?path={{ f.path }}{% endif %}"
+    href="{% if f.TYPE == "D" %}{% url "dashboard.views.store-list" %}?directory={{ f.path|urlencode }}{% else %}
+    {% url "dashboard.views.store-download" %}?path={{ f.path|urlencode }}{% endif %}"
     >
     <div class="store-list-item-icon">
       <i class="
@@ -122,12 +122,12 @@
         </dl>
       </div>
       <div class="col-sm-2" style="text-align: right;">
-        <a href="{% url "dashboard.views.store-download" %}?path={{ f.path }}" 
+        <a href="{% url "dashboard.views.store-download" %}?path={{ f.path|urlencode }}"
           class="btn btn-primary btn-sm store-download-button">
           <i class="fa fa-download"></i>
           {% trans "Download" %}
         </a>
-        <a href="{% url "dashboard.views.store-remove" %}?path={{ f.path }}" 
+        <a href="{% url "dashboard.views.store-remove" %}?path={{ f.path|urlencode }}"
           class="btn btn-danger btn-xs store-remove-button">
           <i class="fa fa-times"></i>
           {% trans "Remove" %}

circle/dashboard/views/store.py

@@ -23,6 +23,7 @@ from os.path import join, normpath, dirname, basename
 from django.conf import settings
 from django.contrib import messages
 from django.contrib.auth.decorators import login_required
+from django.template.defaultfilters import urlencode
 from django.core.cache import get_cache
 from django.core.exceptions import SuspiciousOperation
 from django.core.urlresolvers import reverse
@@ -55,7 +56,7 @@ class StoreList(LoginRequiredMixin, TemplateView):
         context['current'] = directory
         context['next_url'] = "%s%s?directory=%s" % (
             settings.DJANGO_URL.rstrip("/"),
-            reverse("dashboard.views.store-list"), directory)
+            reverse("dashboard.views.store-list"), urlencode(directory))
         return context
 
     def get(self, *args, **kwargs):
@@ -112,7 +113,7 @@ def store_upload(request):
 
     next_url = "%s%s?directory=%s" % (
         settings.DJANGO_URL.rstrip("/"),
-        reverse("dashboard.views.store-list"), directory)
+        reverse("dashboard.views.store-list"), urlencode(directory))
 
     return render(request, "dashboard/store/upload.html",
                   {'directory': directory, 'action': action,
@@ -168,7 +169,7 @@ class StoreRemove(LoginRequiredMixin, TemplateView):
 
         return redirect("%s?directory=%s" % (
             reverse("dashboard.views.store-list"),
-            dirname(dirname(path)),
+            urlencode(dirname(dirname(path))),
         ))
 
 
@@ -185,7 +186,7 @@ def store_new_directory(request):
                          name, path, unicode(request.user))
         messages.error(request, _("Unable to create folder."))
     return redirect("%s?directory=%s" % (
-        reverse("dashboard.views.store-list"), path))
+        reverse("dashboard.views.store-list"), urlencode(path)))
 
 
 @require_POST