Page MenuHomePhabricator

Some input to Citoid extension, may already be URL encoded, and the Citoid extension encodes it again, resulting in double-encoded input to citoid.
Open, MediumPublic0 Estimated Story Points

Event Timeline

Change 313428 had a related patch set uploaded (by DLynch):
Decode likely URLs before sending them to citoid

https://gerrit.wikimedia.org/r/313428

I noticed that it was clearly fetching the wrong page as well, since it was showing "mauvais titre" rather than the actual article title. Therefore, the patch decodes URLs before sending them to the citoid service.

pasted_file (185×419 px, 25 KB)

Mvolz subscribed.

This is should really be done in the backend (citoid). (But probably no harm in duplicating it on front end).

Mvolz renamed this task from Cite tool should not encode percent char in URI to Some input to citoid may already be URL encoded, and the Citoid extension encodes it again, resulting in double-encoded input. .Sep 30 2016, 1:59 PM
Mvolz renamed this task from Some input to citoid may already be URL encoded, and the Citoid extension encodes it again, resulting in double-encoded input. to Some input to Citoid extension, may already be URL encoded, and the Citoid extension encodes it again, resulting in double-encoded input to citoid..

Change 313428 merged by jenkins-bot:
Decode input before sending to citoid

https://gerrit.wikimedia.org/r/313428

Mvolz updated the task description. (Show Details)

Dlynch did this one actually :)

There is a fix in the frontend, but this bug still exists in the backend.

Other clients of citoid are also exposed to this bug. Example affected gadget: https://he.wikipedia.org/w/index.php?title=%D7%9E%D7%93%D7%99%D7%94_%D7%95%D7%99%D7%A7%D7%99:Gadget-Checkty.js&oldid=prev&diff=28037937&uselang=en

kaldari subscribed.

Reopening per @eranroz's comment above. I also confirmed that this bug occurs with RefToolbar on English Wikipedia (which also uses Citoid). We should implement a fix within the Citoid service itself, rather than just in VE.

Thanks - I already stole the fix from VE into the gadget.

Mvolz removed Mvolz as the assignee of this task.May 28 2021, 9:34 AM