From: Sven Strickroth <email@cs-ware.de>
Date: Thu, 23 May 2019 14:44:01 +0000 (+0200)
Subject: WebView: Properly handle usernames with spaces and plus signs in it
X-Git-Tag: archive/raspbian/3.16.7-1_deb13u1+rpi1~1^2~279^2^2~19^2
X-Git-Url: https://dgit.raspbian.org/?a=commitdiff_plain;h=85d217ec9514babeb665dda0ab7b65fe2b0e9b21;p=nextcloud-desktop.git

WebView: Properly handle usernames with spaces and plus signs in it

The path returned from the server encodes a space in the username with `+` and if the username contains a `+` sign it is encoded as `%2B` (cf. https://www.php.net/manual/function.urlencode.php).

Fix: Don't (double) decode the URL path and then replace `+` with space (introduced in issue #279 resp. commit 9ec61a84ce682399b4c39182887e488c99f1d87a). Instead first replace `+` with space, then decode percent encoding.

Tested with a username containing a space, a username containing a `+`sign and a username containing just A-Za-z0-9- (with Nextcloud 16).

(fixes issue #1266)

Signed-off-by: Sven Strickroth <email@cs-ware.de>
---

diff --git a/src/gui/wizard/webview.cpp b/src/gui/wizard/webview.cpp
index 00913f387..8612e6e21 100644
--- a/src/gui/wizard/webview.cpp
+++ b/src/gui/wizard/webview.cpp
@@ -136,7 +136,7 @@ WebViewPageUrlSchemeHandler::WebViewPageUrlSchemeHandler(QObject *parent)
 void WebViewPageUrlSchemeHandler::requestStarted(QWebEngineUrlRequestJob *request) {
     QUrl url = request->requestUrl();
 
-    QString path = url.path().mid(1);
+    QString path = url.path(0).mid(1); // get undecoded path
     QStringList parts = path.split("&");
 
     QString server;
@@ -153,12 +153,14 @@ void WebViewPageUrlSchemeHandler::requestStarted(QWebEngineUrlRequestJob *reques
         }
     }
 
-    user = QUrl::fromPercentEncoding(user.toUtf8());
-    password = QUrl::fromPercentEncoding(password.toUtf8());
+    qCDebug(lcWizardWebiew()) << "Got raw user from request path: " << user;
 
     user = user.replace(QChar('+'), QChar(' '));
     password = password.replace(QChar('+'), QChar(' '));
 
+    user = QUrl::fromPercentEncoding(user.toUtf8());
+    password = QUrl::fromPercentEncoding(password.toUtf8());
+
     if (!server.startsWith("http://") && !server.startsWith("https://")) {
         server = "https://" + server;
     }