From c3d25c59c51431cf7d5a2700b842a07410dd8936 Mon Sep 17 00:00:00 2001
From: Bart Schuurmans <bart@minnozz.com>
Date: Thu, 21 Mar 2024 16:48:28 +0100
Subject: [PATCH] Escape search query in generated URLs

Otherwise, a query containing '&' or other special characters results in a broken URL.
---
 bookwyrm/templates/search/book.html   | 2 +-
 bookwyrm/templates/search/layout.html | 8 ++++----
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/bookwyrm/templates/search/book.html b/bookwyrm/templates/search/book.html
index 262dcf2f9..b93c96754 100644
--- a/bookwyrm/templates/search/book.html
+++ b/bookwyrm/templates/search/book.html
@@ -109,7 +109,7 @@
 <p class="block">
     {% if request.user.is_authenticated %}
         {% if not remote %}
-        <a href="{{ request.path }}?q={{ query }}&type=book&remote=true" id="tour-load-from-other-catalogues">
+        <a href="{{ request.path }}?q={{ query|urlencode }}&type=book&remote=true" id="tour-load-from-other-catalogues">
             {% trans "Load results from other catalogues" %}
         </a>
         {% else %}
diff --git a/bookwyrm/templates/search/layout.html b/bookwyrm/templates/search/layout.html
index 725a4f43f..59ea0304e 100644
--- a/bookwyrm/templates/search/layout.html
+++ b/bookwyrm/templates/search/layout.html
@@ -41,18 +41,18 @@
 <nav class="tabs">
     <ul>
         <li{% if type == "book" %} class="is-active"{% endif %}>
-            <a href="{% url 'search' %}?q={{ query }}&type=book">{% trans "Books" %}</a>
+            <a href="{% url 'search' %}?q={{ query|urlencode }}&type=book">{% trans "Books" %}</a>
         </li>
         <li{% if type == "author" %} class="is-active"{% endif %}>
-            <a href="{% url 'search' %}?q={{ query }}&type=author">{% trans "Authors" %}</a>
+            <a href="{% url 'search' %}?q={{ query|urlencode }}&type=author">{% trans "Authors" %}</a>
         </li>
         {% if request.user.is_authenticated %}
         <li{% if type == "user" %} class="is-active"{% endif %}>
-            <a href="{% url 'search' %}?q={{ query }}&type=user">{% trans "Users" %}</a>
+            <a href="{% url 'search' %}?q={{ query|urlencode }}&type=user">{% trans "Users" %}</a>
         </li>
         {% endif %}
         <li{% if type == "list" %} class="is-active"{% endif %}>
-            <a href="{% url 'search' %}?q={{ query }}&type=list">{% trans "Lists" %}</a>
+            <a href="{% url 'search' %}?q={{ query|urlencode }}&type=list">{% trans "Lists" %}</a>
         </li>
     </ul>
 </nav>