Add proper URL-encoding of user-provided data

[g2-sharing] / src / gallery2.c

diff --git a/src/gallery2.c b/src/gallery2.c
index 09caf67..c592d3d 100644 (file)
--- a/src/gallery2.c
+++ b/src/gallery2.c
@@ -16,6 +16,10 @@
 #include <sharing-http.h>
 #include "gallery2.h"
 
+/* Helpers: */
+
+static gchar* url_encode (const gchar* source);
+
 /**
  * gallery2_login:
  * @con: Connection to use
@@ -43,16 +47,25 @@ gallery2_login (ConIcConnection* con,
 
        /* Do the login request */
 
-       gchar* url = g_strdup_printf("%s/main.php?g2_controller=remote:GalleryRemote&"
-                       "g2_form[cmd]=login&g2_form[protocol_version]=2.0&"
-                       "g2_form[uname]=%s&g2_form[password]=%s",
-                       urlbase, username, password);
+       SharingHTTPRunResponse res = 0;
 
-       sharing_http_set_connection (http, con);
-       SharingHTTPRunResponse res = sharing_http_run (http, url);
+       {
+               gchar* euser = url_encode (username);
+               gchar* epass = url_encode (password);
 
-       g_free (url);
-       url = 0;
+               gchar* url = g_strdup_printf("%s/main.php?g2_controller=remote:GalleryRemote&"
+                               "g2_form[cmd]=login&g2_form[protocol_version]=2.0&"
+                               "g2_form[uname]=%s&g2_form[password]=%s",
+                               urlbase, euser, epass);
+
+               g_free (euser);
+               g_free (epass);
+
+               sharing_http_set_connection (http, con);
+               res = sharing_http_run (http, url);
+
+               g_free (url);
+       }
 
        /* Parse the response */
 
@@ -394,23 +407,33 @@ gallery2_send (ConIcConnection* con,
 
        /* Prepare and send the request */
 
-       /* gchar* album = "1652"; */ /* TODO: get from UI/login */
-
        gchar* media_title = sharing_entry_media_get_title (media);
        gchar* media_mime = sharing_entry_media_get_mime (media);
        gchar* media_filename = sharing_entry_media_get_filename (media);
 
        const gchar* desc = sharing_entry_media_get_desc (media);
 
-       gchar* url = g_strdup_printf("%s/main.php?g2_controller=remote:GalleryRemote%s%s&"
-                       "g2_form[cmd]=add-item&g2_form[protocol_version]=2.0&"
-                       "g2_form[set_albumName]=%s&g2_form[caption]=%s"
-                       "%s%s%s%s",
-                       urlbase,
-                       auth ? "&g2_authToken=" : "", auth ? auth : "",
-                       album, media_title,
-                       desc ? "&g2_form[extrafield.Summary]=" : "", desc ? desc : "",
-                       desc ? "&g2_form[extrafield.Description]=" : "", desc ? desc : "");
+       const gchar* title = media_title;
+       if (!title || !*title) title = media_filename;
+       if (!title || !*title) title = "(unknown)";
+
+       gchar* url = 0;
+
+       {
+               gchar* edesc = (desc && *desc ? url_encode (desc) : 0);
+               gchar* etitle = url_encode (title);
+               url = g_strdup_printf("%s/main.php?g2_controller=remote:GalleryRemote%s%s&"
+                               "g2_form[cmd]=add-item&g2_form[protocol_version]=2.0&"
+                               "g2_form[set_albumName]=%s&g2_form[caption]=%s"
+                               "%s%s%s%s",
+                               urlbase,
+                               auth ? "&g2_authToken=" : "", auth ? auth : "",
+                               album, etitle,
+                               edesc ? "&g2_form[extrafield.Summary]=" : "", edesc ? edesc : "",
+                               edesc ? "&g2_form[extrafield.Description]=" : "", edesc ? edesc : "");
+               g_free (etitle);
+               g_free (edesc);
+       }
 
        if (cookies)
        {
@@ -529,3 +552,48 @@ gboolean gallery2_send_callback (SharingHTTP* http, guint64 bytes_sent, gpointer
 
        return TRUE;
 }
+
+/* Helper implementations */
+
+static gchar url_encode_hex[16] = {
+       '0', '1', '2', '3', '4', '5', '6', '7',
+       '8', '9', 'A', 'B', 'C', 'D', 'E', 'F'
+};
+
+static gchar* url_encode (const gchar* source)
+{
+       gchar* dest = 0;
+       gsize dest_len = 0;
+       const gchar* s;
+       gchar* d;
+
+       /* Count new string length */
+
+       for (s = source; *s; s++)
+       {
+               dest_len++;
+               if (!((*s >= '0' && *s <= '9') || (*s >= 'A' && *s <= 'Z') || (*s >= 'a' && *s <= 'z')))
+                       dest_len += 2;
+       }
+
+       /* Build encoded string */
+
+       dest = g_malloc (dest_len + 1);
+
+       for (s = source, d = dest; *s; s++)
+       {
+               if ((*s >= '0' && *s <= '9') || (*s >= 'A' && *s <= 'Z') || (*s >= 'a' && *s <= 'z'))
+                       *d++ = *s;
+               else if (*s == ' ')
+                       *d++ = '+';
+               else
+               {
+                       *d++ = '%';
+                       *d++ = url_encode_hex[(*s >> 4) & 0xf];
+                       *d++ = url_encode_hex[*s & 0xf];
+               }
+       }
+
+       *d = 0;
+       return dest;
+}