From b19beee0aa3cc12fa8ef20d9dcaf991e9dbaca55 Mon Sep 17 00:00:00 2001 From: Linty Date: Mon, 23 Mar 2026 12:26:20 +0100 Subject: [PATCH] fixes #796 handle ampersand escaping for API URLs When generating URLs for the web service (IN_WS), ensure the argument separator is a raw '&' instead of the HTML entity '&'. add_url_params now switches the separator to '&' if IN_WS is defined and '&' was requested. Removed a redundant str_replace call in ws_std_get_urls since get_action_url/add_url_params now produce the correct separator. This prevents double-escaped ampersands. --- include/functions_url.inc.php | 5 +++++ include/ws_functions.inc.php | 2 +- 2 files changed, 6 insertions(+), 1 deletion(-) diff --git a/include/functions_url.inc.php b/include/functions_url.inc.php index 08fdbd5a9..34c3232aa 100644 --- a/include/functions_url.inc.php +++ b/include/functions_url.inc.php @@ -104,6 +104,11 @@ function add_url_params($url, $params, $arg_separator='&' ) { if ( !empty($params) ) { + if (defined('IN_WS') and '&' === $arg_separator) + { + $arg_separator = '&'; + } + assert( is_array($params) ); $is_first = true; foreach($params as $param=>$val) diff --git a/include/ws_functions.inc.php b/include/ws_functions.inc.php index 816c3cbb3..312c1c848 100644 --- a/include/ws_functions.inc.php +++ b/include/ws_functions.inc.php @@ -169,7 +169,7 @@ function ws_std_get_urls($image_row) $ret['download_url'] = null; if ($provide_download_url) { - $ret['download_url'] = str_replace('&', '&', get_action_url($image_row['id'], 'e', true)); + $ret['download_url'] = get_action_url($image_row['id'], 'e', true); } $derivatives = DerivativeImage::get_all($src_image);