[server] Avoid %2B to be interpreted as space in querystring

arnaud-morvan · rldhont · commit f019bc069934 · 2018-05-02T22:21:39.000+02:00
If '+' is replaced by ' ' after percent decoding, '%2B' is interpreted as ' '.

Fix this by replacing '+' by '%20' before percent decoding.
diff --git a/src/server/qgsserverrequest.cpp b/src/server/qgsserverrequest.cpp
@@ -76,14 +76,12 @@ QMap<QString, QString> QgsServerRequest::parameters() const
     typedef QPair<QString, QString> pair_t;
 
     QUrlQuery query( mUrl );
+    query.setQuery( query.query().replace( '+', QStringLiteral( "%20" ) ) );
+
     QList<pair_t> items = query.queryItems( QUrl::FullyDecoded );
     Q_FOREACH ( const pair_t &pair, items )
     {
-      // prepare the value
-      QString value = pair.second;
-      value.replace( '+', ' ' );
-
-      mParams.insert( pair.first.toUpper(), value );
+      mParams.insert( pair.first.toUpper(), pair.second );
     }
     mDecoded = true;
   }
diff --git a/tests/src/python/test_qgsserver_request.py b/tests/src/python/test_qgsserver_request.py
@@ -48,6 +48,11 @@ def test_requestParameters(self):
         for k, v in request.headers().items():
             self.assertEqual(parameters[k], v)
 
+    def test_requestParametersDecoding(self):
+        """Test request parameters decoding"""
+        request = QgsServerRequest('http://somesite.com/somepath?parm1=val1%20%2B+val2', QgsServerRequest.GetMethod)
+        self.assertEqual(request.parameters()['PARM1'], 'val1 + val2')
+
     def test_requestUrl(self):
         """Test url"""
         request = QgsServerRequest('http://somesite.com/somepath', QgsServerRequest.GetMethod)

Original file line number	Diff line number	Diff line change
`@@ -76,14 +76,12 @@ QMap<QString, QString> QgsServerRequest::parameters() const`
`76`	`76`	`typedef QPair<QString, QString> pair_t;`
`77`	`77`
`78`	`78`	`QUrlQuery query( mUrl );`
	`79`	`+ query.setQuery( query.query().replace( '+', QStringLiteral( "%20" ) ) );`
	`80`	`+`
`79`	`81`	`QList<pair_t> items = query.queryItems( QUrl::FullyDecoded );`
`80`	`82`	`Q_FOREACH ( const pair_t &pair, items )`
`81`	`83`	`{`
`82`		`- // prepare the value`
`83`		`- QString value = pair.second;`
`84`		`- value.replace( '+', ' ' );`
`85`		`-`
`86`		`- mParams.insert( pair.first.toUpper(), value );`
	`84`	`+ mParams.insert( pair.first.toUpper(), pair.second );`
`87`	`85`	`}`
`88`	`86`	`mDecoded = true;`
`89`	`87`	`}`