| Subject: | all query string values should be uri escaped. |
Currently, four parameters will be returned from the sign() method
unescaped: email, ts, token, and sig.
This causes a problem, most notably in the sig param due to the fact
that "=" signs go unescaped and some uri parsers use that as a the
key/value delimiter.
Attached is a patch that will uri escape all values.
| Subject: | Sign.pm.patch |
--- lib/Authen/TypeKey/Sign.pm.orig 2007-08-15 17:06:48.000000000 -0300
+++ lib/Authen/TypeKey/Sign.pm 2007-08-15 17:07:05.000000000 -0300
@@ -85,7 +85,7 @@
my $s = MIME::Base64::encode_base64(mp2bin($sig->s()),'');
$in->{sig} = "$r:$s";
my @qs = map { "$_=".encode_url($in->{$_}||'') } qw( name nick );
- push(@qs, map { "$_=".$in->{$_} }
+ push(@qs, map { "$_=".encode_url($in->{$_}) }
grep { defined($in->{$_}) }
qw( email ts token sig ));
join('&',@qs);