#3127 properly parse the theme query

UI/MainUI/SOGoRootPage.m

@@ -107,6 +107,21 @@ static const NSString *kJwtKey = @"jwt";
   return cookieLogin;
 }
 
+/* JavaScript string literal of the cookie username, safe to write inside a
+   <script> element: '<', '>' and '&' are escaped so the value can't close
+   the element. */
+- (NSString *) cookieUsernameAsJSString
+{
+  NSString *value;
+
+  value = [[self cookieUsername] doubleQuotedString];
+  value = [value stringByReplacingString: @"<" withString: @"\\u003c"];
+  value = [value stringByReplacingString: @">" withString: @"\\u003e"];
+  value = [value stringByReplacingString: @"&" withString: @"\\u0026"];
+
+  return value;
+}
+
 - (BOOL) rememberLogin
 {
   return ([[self cookieUsername] length]);

UI/SOGoUI/UIxComponent.m

@@ -745,6 +745,9 @@ static SoProduct      *commonProduct      = nil;
   theme = [[context request] formValueForKey: @"theme"];
   if ([theme length])
     {
+      // The value is decoded: encode it again so that it can't inject
+      // characters (eg. CR/LF) into the Location header
+      theme = [theme stringByEscapingURL];
       url = [NSURL URLWithString: newLocation];
       query = [url query];
       if ([query length])

UI/Templates/MainUI/SOGoRootPage.wox

@@ -10,7 +10,7 @@
     const:jsFiles="Main.js, Common.js"
     >
   <script type="text/javascript" var:nonce="cspNonce">
-    var cookieUsername = <var:string var:value="cookieUsername.doubleQuotedString" const:escapeHTML="NO"/>;
+    var cookieUsername = <var:string var:value="cookieUsernameAsJSString" const:escapeHTML="NO"/>;
     var language = '<var:string var:value="language" const:escapeHTML="NO"/>';
     var loginHint = '<var:string var:value="getLoginHint" const:escapeHTML="NO"/>'
   </script>