Item10505: Double encoding of formfields when redirected through login

Visit System/PerlDoc without a session, and submit a module - Foswiki::Func.

URL becomes

http://foswiki.org/System/PerlDoc?module=Foswiki%3A%3AFunc

Click Login - URL becomes

http://foswiki.org/bin/login/System/PerlDoc?foswiki_origin=GET%2cview%2c/System/PerlDoc%3fmodule%3dFoswiki%253A%253AFunc

Note that the %3A has been encoded to %25%3A

Complete login, Module field has been corrupted to Foswiki%3A%3AFunc

If this were to happen on a longer more complex form with the fields out of view, it seems as though the user could then submit the form and corrupt data without realizing that the form field had changed.

-- GeorgeClark - 18 Mar 2011

With me URL params also get double encoded with form data (not only form fields) after Foswiki::Func::redirectCgiQuery.

-- ArthurClemens - 26 Apr 2011

This appears to have been fixed somewhere along the way in 1.1.4. Marking as waiting for release.

-- GeorgeClark - 03 Nov 2011

Commenting is disabled while not logged in