From f779b20ec056f13671eccef28cd63e4f11cce19c Mon Sep 17 00:00:00 2001
From: Gunnar Beutner <gunnar@beutner.name>
Date: Wed, 30 Sep 2015 14:02:18 +0200
Subject: [PATCH] Properly encode URLs in Icinga Studio

fixes #10241
---
 icinga-studio/apiclient.cpp   | 37 +++++++++++++++++++++++------------
 lib/remote/url-characters.hpp |  1 +
 lib/remote/url.cpp            | 18 ++++++++++++++---
 lib/remote/url.hpp            |  2 ++
 4 files changed, 43 insertions(+), 15 deletions(-)

diff --git a/icinga-studio/apiclient.cpp b/icinga-studio/apiclient.cpp
index 4be3e241b..2a2321238 100644
--- a/icinga-studio/apiclient.cpp
+++ b/icinga-studio/apiclient.cpp
@@ -36,7 +36,15 @@ ApiClient::ApiClient(const String& host, const String& port,
 
 void ApiClient::GetTypes(const TypesCompletionCallback& callback) const
 {
-	Url::Ptr url = new Url("https://" + m_Connection->GetHost() + ":" + m_Connection->GetPort() + "/v1/types");
+	Url::Ptr url = new Url();
+	url->SetScheme("https");
+	url->SetHost(m_Connection->GetHost());
+	url->SetPort(m_Connection->GetPort());
+
+	std::vector<String> path;
+	path.push_back("v1");
+	path.push_back("types");
+	url->SetPath(path);
 
 	try {
 		boost::shared_ptr<HttpRequest> req = m_Connection->NewRequest();
@@ -98,29 +106,34 @@ void ApiClient::TypesHttpCompletionCallback(HttpRequest& request, HttpResponse&
 void ApiClient::GetObjects(const String& pluralType, const ObjectsCompletionCallback& callback,
     const std::vector<String>& names, const std::vector<String>& attrs) const
 {
-	String url = "https://" + m_Connection->GetHost() + ":" + m_Connection->GetPort() + "/v1/objects/" + pluralType;
+	Url::Ptr url = new Url();
+	url->SetScheme("https");
+	url->SetHost(m_Connection->GetHost());
+	url->SetPort(m_Connection->GetPort());
+
+	std::vector<String> path;
+	path.push_back("v1");
+	path.push_back("objects");
+	path.push_back(pluralType);
+	url->SetPath(path);
 	String qp;
 
-	BOOST_FOREACH(const String& name, names) {
-		if (!qp.IsEmpty())
-			qp += "&";
+	std::map<String, std::vector<String> > params;
 
-		qp += pluralType.ToLower() + "=" + name;
+	BOOST_FOREACH(const String& name, names) {
+		params[pluralType.ToLower()].push_back(name);
 	}
 
 	BOOST_FOREACH(const String& attr, attrs) {
-		if (!qp.IsEmpty())
-			qp += "&";
-
-		qp += "attrs[]=" + attr;
+		params["attrs"].push_back(attr);
 	}
 
-	Url::Ptr pUrl = new Url(url + "?" + qp);
+	url->SetQuery(params);
 
 	try {
 		boost::shared_ptr<HttpRequest> req = m_Connection->NewRequest();
 		req->RequestMethod = "GET";
-		req->RequestUrl = pUrl;
+		req->RequestUrl = url;
 		req->AddHeader("Authorization", "Basic " + Base64::Encode(m_User + ":" + m_Password));
 		m_Connection->SubmitRequest(req, boost::bind(ObjectsHttpCompletionCallback, _1, _2, callback));
 	} catch (const std::exception& ex) {
diff --git a/lib/remote/url-characters.hpp b/lib/remote/url-characters.hpp
index 73a098be7..65384f21e 100644
--- a/lib/remote/url-characters.hpp
+++ b/lib/remote/url-characters.hpp
@@ -16,6 +16,7 @@
  * along with this program; if not, write to the Free Software Foundation     *
  * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA.             *
  ******************************************************************************/
+
 #ifndef URL_CHARACTERS_H
 #define URL_CHARACTERS_H
 
diff --git a/lib/remote/url.cpp b/lib/remote/url.cpp
index 4a7c07015..537f221dd 100644
--- a/lib/remote/url.cpp
+++ b/lib/remote/url.cpp
@@ -27,7 +27,8 @@
 
 using namespace icinga;
 
-Url::Url() {}
+Url::Url()
+{ }
 
 Url::Url(const String& base_url)
 {
@@ -170,6 +171,7 @@ String Url::GetFragment(void) const
 {
 	return m_Fragment;
 }
+
 void Url::SetScheme(const String& scheme)
 {
 	m_Scheme = scheme;
@@ -183,6 +185,16 @@ void Url::SetAuthority(const String& username, const String& password, const Str
 	m_Port = port;
 }
 
+void Url::SetHost(const String& host)
+{
+	m_Host = host;
+}
+
+void Url::SetPort(const String& port)
+{
+	m_Port = port;
+}
+
 void Url::SetPath(const std::vector<String>& path)
 {
 	m_Path = path;
@@ -227,9 +239,9 @@ String Url::Format(bool print_credentials) const
 	if (m_Path.empty())
 		url += "/";
 	else {
-		BOOST_FOREACH (const String p, m_Path) {
+		BOOST_FOREACH (const String& segment, m_Path) {
 			url += "/";
-			url += Utility::EscapeString(p, ACPATHSEGMENT, false);
+			url += Utility::EscapeString(segment, ACPATHSEGMENT, false);
 		}
 	}
 
diff --git a/lib/remote/url.hpp b/lib/remote/url.hpp
index d2ad7d458..c416b4009 100644
--- a/lib/remote/url.hpp
+++ b/lib/remote/url.hpp
@@ -61,6 +61,8 @@ public:
 	void SetScheme(const String& scheme);
 	void SetAuthority(const String& username, const String& password, 
 	    const String& host, const String& port);
+	void SetHost(const String& host);
+	void SetPort(const String& port);
 	void SetPath(const std::vector<String>& path);
 	void SetQuery(const std::map<String, std::vector<String> >& query);
 	void AddQueryElement(const String& name, const String& query);
-- 
2.50.0