filters: quote param names and values when constructing querystrings

[patchwork] / apps / patchwork / filters.py

diff --git a/apps/patchwork/filters.py b/apps/patchwork/filters.py
index 77fc768dd485f3b6afbe3a2c0e5e9e42f5b1d946..52fc03fe19d655f78324cea43ef3533a7d232b6e 100644 (file)
--- a/apps/patchwork/filters.py
+++ b/apps/patchwork/filters.py
@@ -22,6 +22,7 @@ from patchwork.models import Person, State
 from django.utils.safestring import mark_safe
 from django.utils.html import escape
 from django.contrib.auth.models import User
+from urllib import quote
 
 class Filter(object):
     def __init__(self, filters):
@@ -444,7 +445,8 @@ class Filters:
             if remove.param in params.keys():
                 del params[remove.param]
 
-        return '?' + '&'.join(['%s=%s' % x for x in params.iteritems()])
+        return '?' + '&'.join(['%s=%s' % (quote(k), quote(v))
+                                for (k,v) in params.iteritems()])
 
     def querystring_without_filter(self, filter):
         return self.querystring(filter)