Merge lp:~cmiller/django-openid-auth/encode-redirected-uris-better into lp:~django-openid-auth/django-openid-auth/trunk

[Chad Miller]

LP#936153, After login, redirecting to a URL that contains non-ASCII characters would fail because the naive "str(foo)" scheme used in urllib would use the default system encoding, which we can't trust at all.

[Facundo Batista (facundo)]

Encoding to UTF8 will give you a sequence of bytes with two or more values > 127 for each unicode character, and urllib.urlencode will transform those into encoded values, like:

>>> urllib.urlencode(dict(foo=u"moño".encode("utf8")))
'foo=mo%C3%B1o'

This is something that I saw a lot, so I think it's ok, but I'm no expert in URLs.

review: Approve

=== modified file 'django_openid_auth/views.py'
--- django_openid_auth/views.py	2011-08-23 18:50:29 +0000
+++ django_openid_auth/views.py	2012-05-30 18:31:29 +0000
@@ -244,7 +244,11 @@
             return_to += '&'
         else:
             return_to += '?'
-        return_to += urllib.urlencode({redirect_field_name: redirect_to})
+        # Django gives us Unicode, which is great.  We must encode URI. urllib
+        # dumbly enforces str. We can't trust anything about the default
+        # encoding inside  str(foo) , so we must explicitly make foo a str.
+        return_to += urllib.urlencode(
+                {redirect_field_name: redirect_to.encode("UTF-8")})
 
     return render_openid_request(request, openid_request, return_to)