BUG: formhandler table cell link is not urlencoded, fixes #42

src/formhandler.template.html

@@ -97,7 +97,7 @@ Each template receives these variables:
               <div class="dropdown-divider"></div>
             <% } %>
             <% if (colinfo.hideable) { %>
-              <a class="dropdown-item urlfilter" href="?_c=-<%- colinfo.name %>" data-mode="add">Hide</a>
+              <a class="dropdown-item urlfilter" href="?_c=-<%- encodeURIComponent(colinfo.name) %>" data-mode="add">Hide</a>
             <% } %>
           </div><!-- .dropdown-menu -->
         </div><!-- .dropdown -->
@@ -156,7 +156,7 @@ Each template receives these variables:
             </td>
           <% } else { %>
               <td>
-                <a class="urlfilter" href="?<%- colinfo.name %>=<%- val %>&amp;_offset=">
+                <a class="urlfilter" href="?<%- encodeURIComponent(colinfo.name) %>=<%- encodeURIComponent(val) %>&amp;_offset=">
                   <%= disp %>
                 </a>
               </td>
@@ -317,7 +317,7 @@ Each template receives these variables:
     qparts.update({_c: col_name}, 'add')
     var hide_col = col_name[0] == '-'
     var display_name = hide_col ? col_name.slice(1) : col_name %>
-    <a href="?_c=<%- col_name %>" data-mode="del" class="badge badge-pill <%- hide_col ? 'badge-dark' : 'badge-danger' %> urlfilter"
+    <a href="?_c=<%- encodeURIComponent(col_name) %>" data-mode="del" class="badge badge-pill <%- hide_col ? 'badge-dark' : 'badge-danger' %> urlfilter"
       title="<%- hide_col ? 'Show' : 'Hide' %> column <%- display_name %>">
       <%- display_name %>
     </a>
@@ -328,7 +328,7 @@ Each template receives these variables:
         var update = {}
         update[key] = col_name
         qparts.update(update, 'add') %>
-        <a href="?<%- key %>=<%- col_name %>" data-mode="del" class="badge badge-pill badge-dark urlfilter" title="Clear <%- key %> filter">
+        <a href="?<%- encodeURIComponent(key) %>=<%- encodeURIComponent(col_name) %>" data-mode="del" class="badge badge-pill badge-dark urlfilter" title="Clear <%- key %> filter">
           <%- key %> = <%- col_name %>
         </a>
       <% })
@@ -386,7 +386,7 @@ Each template receives these variables:
                     var col_link = typeof colinfo.link == 'function' ? colinfo.link({row: row, value: val, index: rowIndex, name: colinfo.name, data: data, format: disp}) : _.template(colinfo.link)({row: row, value: val, index: rowIndex, name: colinfo.name, data: data, format: disp}) %>
                     <a href="<%- col_link %>" target="_blank"><%= disp %></a>
                 <% } else { %>
-                  <a class="urlfilter" href="?<%- colinfo.name %>=<%- val %>&amp;_offset=">
+                  <a class="urlfilter" href="?<%- encodeURIComponent(colinfo.name) %>=<%- encodeURIComponent(val) %>&amp;_offset=">
                     <%= disp %>
                   </a>
                 <% } %>

test/formhandler.csv

-Continent,Cross,ID,Name,Shapes,Stripes,Symbols,Text,Union-Flag,c1,c2,c3,c4,c5,c6,c7,c8,date col
+Continent,Cross,ID,Name,Shapes,Stripes,Symbols,Text&,Union-Flag,c1,c2,c3,c4,c5,c6,c7,c8,date col
 Europe,,AND,Andorra,,Horizontal,,,,35,1,26,0,32,0,0,4,16-01-2013
 Asia,,ARE,United Arab Emirates,,Horizontal,,,,24.0,0.0,0.0,25.0,0.0,0.0,25.0,24.0,17-02-2013
-Asia,,AFG,Afghanistan,,Vertical,,Country,,28.0,1.0,0.0,33.0,0.0,0.0,33.0,3.0,06-02-2013
+Asia,,AFG,Afghanistan,,Vertical,,Country&,,28.0,1.0,0.0,33.0,0.0,0.0,33.0,3.0,06-02-2013
 North America,,ATG,Antigua Barbuda,,,,,,50.0,0.0,5.0,0.0,0.0,10.0,25.0,7.0,11-02-2013
 Europe,,ALB,Albania,,,Bird,,,87.0,0.0,0.0,0.0,0.0,0.0,12.0,0.0,18-01-2013
 Asia,,ARM,Armenia,,Horizontal,,,,33.0,33.0,0.0,0.0,33.0,0.0,0.0,0.0,12-01-2013

test/test-formhandler-unit.html

@@ -80,6 +80,8 @@
         edit: true
       })
       .on('load', function () {
+        // Test if column name and value filtered are URIEncoded
+        t.equals($('.delete_btn tr:nth-child(3) td:nth-child(8) a').attr('href'), '?Text%26=Country%26&_offset=')
         $('.edit-btn').click()
         t.ok($('.add-btn').prop('disabled'))
         $('.edit-btn').click()