From: Ben Sturmfels <ben@sturm.com.au>
Date: Thu, 9 Apr 2020 05:29:51 +0000 (+1000)
Subject: Decode request.query_string before use.
X-Git-Url: https://vcs.fsf.org/?a=commitdiff_plain;h=b6fba854007bb4392846085a60178c44dbd7989e;p=mediagoblin.git

Decode request.query_string before use.

This doesn't seem to be an issue in my Guix SD/Python 3.7 testing, but hit an
issue on Debian 9/Python3.5 where concatenating text to `request.query_string`
was causing the error:

  TypeError: a bytes-like object is required, not 'str'

This clearly hasn't been an issue in the past though, so I suspect there's a
library somewhere that's on a different version and is behaving differently.
---

diff --git a/mediagoblin/plugins/openid/templates/mediagoblin/plugins/openid/login.html b/mediagoblin/plugins/openid/templates/mediagoblin/plugins/openid/login.html
index 193a3b2d..4ebfdf54 100644
--- a/mediagoblin/plugins/openid/templates/mediagoblin/plugins/openid/login.html
+++ b/mediagoblin/plugins/openid/templates/mediagoblin/plugins/openid/login.html
@@ -41,13 +41,13 @@
       {% endif %}
       {% if allow_registration %}
         <p>
-        {% trans %}Log in to create an account!{% endtrans %} 
+        {% trans %}Log in to create an account!{% endtrans %}
         </p>
       {% endif %}
       {% template_hook('login_link') %}
       {% if pass_auth is defined %}
       <p>
-      <a href="{{ request.urlgen('mediagoblin.auth.login') }}?{{ request.query_string }}">
+      <a href="{{ request.urlgen('mediagoblin.auth.login') }}?{{ request.query_string.decode() }}">
         {%- trans %}Or login with a password!{% endtrans %}
       </a>
       </p>
@@ -63,4 +63,3 @@
     </div>
   </form>
 {% endblock %}
-
diff --git a/mediagoblin/plugins/openid/templates/mediagoblin/plugins/openid/login_link.html b/mediagoblin/plugins/openid/templates/mediagoblin/plugins/openid/login_link.html
index fa4d5e85..78d66745 100644
--- a/mediagoblin/plugins/openid/templates/mediagoblin/plugins/openid/login_link.html
+++ b/mediagoblin/plugins/openid/templates/mediagoblin/plugins/openid/login_link.html
@@ -19,7 +19,7 @@
 {% block openid_login_link %}
   {% if openid_link is defined %}
     <p>
-      <a href="{{ request.urlgen('mediagoblin.plugins.openid.login') }}?{{ request.query_string }}">
+      <a href="{{ request.urlgen('mediagoblin.plugins.openid.login') }}?{{ request.query_string.decode() }}">
           {%- trans %}Or login with OpenID!{% endtrans %}
       </a>
     </p>
diff --git a/mediagoblin/templates/mediagoblin/moderation/report_panel.html b/mediagoblin/templates/mediagoblin/moderation/report_panel.html
index c82cd412..52a6ad87 100644
--- a/mediagoblin/templates/mediagoblin/moderation/report_panel.html
+++ b/mediagoblin/templates/mediagoblin/moderation/report_panel.html
@@ -35,10 +35,10 @@
 <h2>{% trans %}Active Reports Filed{% endtrans %}</h2>
 {% if report_list.count() %}
   {% if not active_settings.last_page == 1 %}
-  {% if 'active_p='~active_settings.current_page in request.query_string %}
-    {% set query_string = request.query_string %}{% else %}
+  {% if 'active_p='~active_settings.current_page in request.query_string.decode() %}
+    {% set query_string = request.query_string.decode() %}{% else %}
     {% set query_string =
-'active_p='~active_settings.current_page~"&"+request.query_string %}
+'active_p='~active_settings.current_page~"&"+request.query_string.decode() %}
   {% endif %}
   <div class="right_align">
     {% set first_vis = active_settings.current_page-3  %}
@@ -127,10 +127,10 @@ curr_page !=p %}
 <h2>{% trans %}Closed Reports{% endtrans %}</h2>
 {% if closed_report_list.count() %}
   {% if not closed_settings.last_page == 1 %}
-  {% if 'closed_p='~closed_settings.current_page in request.query_string %}
-    {% set query_string = request.query_string %}{% else %}
+  {% if 'closed_p='~closed_settings.current_page in request.query_string.decode() %}
+    {% set query_string = request.query_string.decode() %}{% else %}
     {% set query_string =
-'closed_p='~closed_settings.current_page~"&"+request.query_string %}
+'closed_p='~closed_settings.current_page~"&"+request.query_string.decode() %}
   {% endif %}
   <div class="right_align">
     {% set first_vis = closed_settings.current_page-3  %}
diff --git a/mediagoblin/templates/mediagoblin/moderation/user_panel.html b/mediagoblin/templates/mediagoblin/moderation/user_panel.html
index 4949960e..4046fecd 100644
--- a/mediagoblin/templates/mediagoblin/moderation/user_panel.html
+++ b/mediagoblin/templates/mediagoblin/moderation/user_panel.html
@@ -35,10 +35,10 @@
 
 {% if user_list.count() %}
   {% if not last_page == 1 %}
-  {% if 'p='~current_page in request.query_string %}
-    {% set query_string = request.query_string %}{% else %}
+  {% if 'p='~current_page in request.query_string.decode() %}
+    {% set query_string = request.query_string.decode() %}{% else %}
     {% set query_string =
-'p='~current_page~"&"+request.query_string %}
+'p='~current_page~"&"+request.query_string.decode() %}
   {% endif %}
   <div class="right_align">
     {% set first_vis = current_page-3  %}