X-Git-Url: https://git.openstreetmap.org./osqa.git/blobdiff_plain/76d6665baae1d1485b99323cc4dd2836661295aa..52b732386eaabbe2d99e3b13ad680ab06bdc4c47:/forum/utils/pagination.py

diff --git a/forum/utils/pagination.py b/forum/utils/pagination.py
index c36ad2f..fb99244 100644
--- a/forum/utils/pagination.py
+++ b/forum/utils/pagination.py
@@ -6,8 +6,8 @@ from django.utils.translation import ugettext as _
 from django.http import Http404
 from django.utils.http import urlquote
 from django.utils.safestring import mark_safe
-from django.utils.html import strip_tags
-
+from django.utils.html import strip_tags, escape
+from forum.utils.html import sanitize_html
 import logging
 
 def generate_uri(querydict, exclude=None):
@@ -15,7 +15,7 @@ def generate_uri(querydict, exclude=None):
 
     for k, l in querydict.iterlists():
         if (not exclude) or (not k in exclude):
-            all += ["%s=%s" % (k, urlquote(v)) for v in l]
+            all += ["%s=%s" % (k, urlquote(strip_tags(v))) for v in l]
         
     return "&".join(all)
 
@@ -204,7 +204,7 @@ def _paginated(request, objects, context):
         if get_params:
             base_path += "?" + get_params
 
-    url_joiner = "?" in base_path and "&" or "?"
+    url_joiner = "?" in base_path and "&" or "?"
 
 
     def get_page():
@@ -240,7 +240,7 @@ def _paginated(request, objects, context):
             page_numbers = []
 
             if sort:
-                url_builder = lambda n: mark_safe("%s%s%s=%s&%s=%s" % (base_path, url_joiner, context.SORT, sort, context.PAGE, n))
+                url_builder = lambda n: mark_safe("%s%s%s=%s&%s=%s" % (base_path, url_joiner, context.SORT, sort, context.PAGE, n))
             else:
                 url_builder = lambda n: mark_safe("%s%s%s=%s" % (base_path, url_joiner, context.PAGE, n))
 
@@ -273,9 +273,9 @@ def _paginated(request, objects, context):
     if pagesize:
         def page_sizes():
             if sort:
-                url_builder = lambda s: mark_safe("%s%s%s=%s&%s=%s" % (base_path, url_joiner, context.SORT, sort, context.PAGESIZE, s))
+                url_builder = lambda s: mark_safe("%s%s%s=%s&%s=%s" % (escape(base_path), url_joiner, context.SORT, sort, context.PAGESIZE, s))
             else:
-                url_builder = lambda s: mark_safe("%s%s%s=%s" % (base_path, url_joiner, context.PAGESIZE, s))
+                url_builder = lambda s: mark_safe("%s%s%s=%s" % (escape(base_path), url_joiner, context.PAGESIZE, s))
 
             sizes = [(s, url_builder(s)) for s in context.pagesizes]
 
@@ -290,7 +290,7 @@ def _paginated(request, objects, context):
 
     if sort:
         def sort_tabs():
-            url_builder = lambda s: mark_safe("%s%s%s=%s" % (base_path, url_joiner, context.SORT, s))
+            url_builder = lambda s: mark_safe("%s%s%s=%s" % (escape(base_path), url_joiner, context.SORT, s))
             sorts = [(n, s.label, url_builder(n), strip_tags(s.description)) for n, s in context.sort_methods.items()]
 
             for name, label, url, descr in sorts:
@@ -310,4 +310,4 @@ def _paginated(request, objects, context):
 
     context.set_preferences(request, session_prefs)
     objects.paginator = paginator
-    return objects
\ No newline at end of file
+    return objects