Ticket #14809: 14809.3.diff

django/contrib/auth/views.py

@@ -99 +99 @@
     if redirect_field_name:
         querystring = QueryDict(login_url_parts[4], mutable=True)
         querystring[redirect_field_name] = next
-        login_url_parts[4] = querystring.urlencode()
+        login_url_parts[4] = querystring.urlencode(safe='/')
 
     return HttpResponseRedirect(urlparse.urlunparse(login_url_parts))
 

django/http/__init__.py

@@ -3 +3 @@
 import re
 import time
 from pprint import pformat
-from urllib import urlencode
+from urllib import urlencode, quote
 from urlparse import urljoin
 try:
     from cStringIO import StringIO
@@ -363 +363 @@
         """Returns a mutable copy of this object."""
         return self.__deepcopy__({})
 
-    def urlencode(self):
+    def urlencode(self, safe=None):
+        """
+        Returns an encoded string of all query string arguments.
+
+        :arg safe: Used to specify characters which do not require quoting, for
+            example::
+
+                >>> q = QueryDict('', mutable=True)
+                >>> q['next'] = '/a&b/'
+                >>> q.urlencode()
+                'next=%2Fa%26b%2F'
+                >>> q.urlencode(safe='/')
+                'next=/a%26b/'
+        """
         output = []
+        if safe:
+            encode = lambda k, v: '%s=%s' % ((quote(k, safe), quote(v, safe)))
+        else:
+            encode = lambda k, v: urlencode({k: v})
         for k, list_ in self.lists():
             k = smart_str(k, self.encoding)
-            output.extend([urlencode({k: smart_str(v, self.encoding)}) for v in list_])
+            for value in list_:
+                output.append(encode(k, smart_str(value, self.encoding)))
         return '&'.join(output)
 
 class CompatCookie(SimpleCookie):

tests/regressiontests/httpwrappers/tests.py

@@ -71 +71 @@
 
         self.assertEqual(q.urlencode(), 'foo=bar')
 
+    def test_urlencode(self):
+        q = QueryDict('', mutable=True)
+        q['next'] = '/a&b/'
+        self.assertEqual(q.urlencode(), 'next=%2Fa%26b%2F')
+        self.assertEqual(q.urlencode(safe='/'), 'next=/a%26b/')
+
     def test_mutable_copy(self):
         """A copy of a QueryDict is mutable."""
         q = QueryDict('').copy()