From 83f5664cf514a351fea87587cde6167ba0facc66 Mon Sep 17 00:00:00 2001
From: Francis Lachapelle <flachapelle@inverse.ca>
Date: Thu, 29 Aug 2019 22:08:35 -0400
Subject: [PATCH] (js) Encode URL of card

---
 NEWS                                          |  1 +
 .../js/Contacts/Card.service.js               | 31 ++++++++++++++-----
 2 files changed, 25 insertions(+), 7 deletions(-)

diff --git a/NEWS b/NEWS
index 27edab5b0..f2d443da0 100644
--- a/NEWS
+++ b/NEWS
@@ -16,6 +16,7 @@ Bug fixes
  - [web] properly handle Windows-1256 charaset (#4781)
  - [web] fixed saving value of receipt action for main IMAP account
  - [web] fixed search results in Calendar module when targeting all events
+ - [web] properly encode URL of cards from exteral sources
  - [core] honor IMAPLoginFieldName also when setting IMAP ACLs
  - [core] honor groups when setting IMAP ACLs
  - [core] honor "any authenticated user" when setting IMAP ACLs
diff --git a/UI/WebServerResources/js/Contacts/Card.service.js b/UI/WebServerResources/js/Contacts/Card.service.js
index a96d25731..50d256f0c 100644
--- a/UI/WebServerResources/js/Contacts/Card.service.js
+++ b/UI/WebServerResources/js/Contacts/Card.service.js
@@ -38,9 +38,10 @@
    * @desc The factory we'll use to register with Angular.
    * @returns the Card constructor
    */
-  Card.$factory = ['$q', '$timeout', 'sgSettings', 'sgCard_STATUS', 'Resource', 'Preferences', function($q, $timeout, Settings, Card_STATUS, Resource, Preferences) {
+  Card.$factory = ['$q', '$timeout', 'sgSettings', 'sgCard_STATUS', 'encodeUriFilter', 'Resource', 'Preferences', function($q, $timeout, Settings, Card_STATUS, encodeUriFilter, Resource, Preferences) {
     angular.extend(Card, {
       STATUS: Card_STATUS,
+      encodeUri: encodeUriFilter,
       $$resource: new Resource(Settings.activeUser('folderURL') + 'Contacts', Settings.activeUser()),
       $q: $q,
       $timeout: $timeout,
@@ -201,6 +202,19 @@
     });
   };
 
+  /**
+   * @function $path
+   * @memberof Card.prototype
+   * @desc Return the relative URL of the card.
+   * @returns the relative URL, properly encoded
+   */
+  Card.prototype.$path = function() {
+    return [
+      Card.encodeUri(this.pid),
+      Card.encodeUri(this.id)
+    ].join('/');
+  };
+
   /**
    * @function $isLoading
    * @memberof Card.prototype
@@ -223,7 +237,7 @@
     if (this.$futureCardData)
       return this;
 
-    futureCardData = Card.$$resource.fetch([this.pid, this.id].join('/'), 'view');
+    futureCardData = Card.$$resource.fetch(this.$path(), 'view');
 
     return this.$unwrap(futureCardData);
   };
@@ -241,7 +255,7 @@
       return Card.$q.when(this.members);
 
     if (this.isgroup) {
-      return Card.$$resource.fetch([this.pid, this.id].join('/'), 'members').then(function(data) {
+      return Card.$$resource.fetch(this.$path(), 'members').then(function(data) {
         _this.members = _.map(data.members, function(member) {
           return new Card(member);
         });
@@ -266,7 +280,10 @@
       });
     }
 
-    return Card.$$resource.save([this.pid, this.id || '_new_'].join('/'),
+    return Card.$$resource.save([
+      Card.encodeUri(this.pid),
+      Card.encodeUri(this.id) || '_new_'
+    ].join('/'),
                                 this.$omit(),
                                 { action: action })
       .then(function(data) {
@@ -289,7 +306,7 @@
     }
     else {
       // No arguments -- delete card
-      return Card.$$resource.remove([this.pid, this.id].join('/'));
+      return Card.$$resource.remove(this.$path());
     }
   };
 
@@ -523,7 +540,7 @@
       if (this.$$certificate)
         return Card.$q.when(this.$$certificate);
       else {
-        return Card.$$resource.fetch([this.pid, this.id].join('/'), 'certificate').then(function(data) {
+        return Card.$$resource.fetch(this.$path(), 'certificate').then(function(data) {
           _this.$$certificate = data;
           return data;
         });
@@ -543,7 +560,7 @@
   Card.prototype.$removeCertificate = function() {
     var _this = this;
 
-    return Card.$$resource.fetch([this.pid, this.id].join('/'), 'removeCertificate').then(function() {
+    return Card.$$resource.fetch(this.$path(), 'removeCertificate').then(function() {
       _this.hasCertificate = false;
     });
   };