commit ba5cbb6

URL decode data after splitting the arguments

Data decoding should happen after the parsing if not, a '?', '&', '#'
or other character decoded will interfere with the parsing. e.g. the
users password contains a '&', then it is truncated on that character,
and login will fail.

 1@@ -262,8 +262,7 @@ int oauth_post_handler(const xs_dict *req, const char *q_path,
 2     }
 3     else
 4     if (i_ctype && xs_startswith(i_ctype, "application/x-www-form-urlencoded") && payload) {
 5-        xs *upl = xs_url_dec(payload);
 6-        args    = xs_url_vars(upl);
 7+        args    = xs_url_vars(payload);
 8     }
 9     else
10         args = xs_dup(xs_dict_get(req, "p_vars"));
11@@ -2361,8 +2360,7 @@ int mastoapi_post_handler(const xs_dict *req, const char *q_path,
12     {
13         // Some apps send form data instead of json so we should cater for those
14         if (!xs_is_null(payload)) {
15-            xs *upl = xs_url_dec(payload);
16-            args    = xs_url_vars(upl);
17+            args    = xs_url_vars(payload);
18         }
19     }
20     else
21@@ -2959,8 +2957,7 @@ int mastoapi_delete_handler(const xs_dict *req, const char *q_path,
22     {
23         // Some apps send form data instead of json so we should cater for those
24         if (!xs_is_null(payload)) {
25-            xs *upl = xs_url_dec(payload);
26-            args    = xs_url_vars(upl);
27+            args = xs_url_vars(payload);
28         }
29     }
30     else
31@@ -3194,8 +3191,7 @@ int mastoapi_patch_handler(const xs_dict *req, const char *q_path,
32     {
33         // Some apps send form data instead of json so we should cater for those
34         if (!xs_is_null(payload)) {
35-            xs *upl = xs_url_dec(payload);
36-            args    = xs_url_vars(upl);
37+            args    = xs_url_vars(payload);
38         }
39     }
40     else

 1@@ -179,8 +179,7 @@ xs_dict *xs_fcgi_request(FILE *f, xs_str **payload, int *p_size, int *fcgi_id)
 2                         req = xs_dict_append(req, "method", v);
 3                     else
 4                     if (strcmp(k, "REQUEST_URI") == 0) {
 5-                        xs *udp = xs_url_dec(v);
 6-                        xs *pnv = xs_split_n(udp, "?", 1);
 7+                        xs *pnv = xs_split_n(v, "?", 1);
 8 
 9                         /* store the path */
10                         req = xs_dict_append(req, "path", xs_list_get(pnv, 0));
11@@ -233,8 +232,7 @@ xs_dict *xs_fcgi_request(FILE *f, xs_str **payload, int *p_size, int *fcgi_id)
12                 const char *ct = xs_dict_get(req, "content-type");
13 
14                 if (*payload && ct && strcmp(ct, "application/x-www-form-urlencoded") == 0) {
15-                    xs *upl = xs_url_dec(*payload);
16-                    p_vars  = xs_url_vars(upl);
17+                    p_vars  = xs_url_vars(*payload);
18                 }
19                 else
20                 if (*payload && ct && xs_startswith(ct, "multipart/form-data")) {

 1@@ -36,7 +36,7 @@ xs_dict *xs_httpd_request(FILE *f, xs_str **payload, int *p_size)
 2 
 3     {
 4         /* split the path with its optional variables */
 5-        xs *udp = xs_url_dec(xs_list_get(l2, 1));
 6+        const xs_val *udp = xs_list_get(l2, 1);
 7         xs *pnv = xs_split_n(udp, "?", 1);
 8 
 9         /* store the path */
10@@ -75,8 +75,7 @@ xs_dict *xs_httpd_request(FILE *f, xs_str **payload, int *p_size)
11     v = xs_dict_get(req, "content-type");
12 
13     if (*payload && v && strcmp(v, "application/x-www-form-urlencoded") == 0) {
14-        xs *upl = xs_url_dec(*payload);
15-        p_vars  = xs_url_vars(upl);
16+        p_vars  = xs_url_vars(*payload);
17     }
18     else
19     if (*payload && v && xs_startswith(v, "multipart/form-data")) {

1@@ -53,7 +53,7 @@ xs_dict *xs_url_vars(const char *str)
2         const xs_val *v;
3 
4         xs_list_foreach(args, v) {
5-            xs *kv = xs_split_n(v, "=", 1);
6+            xs *kv = xs_split_n(xs_url_dec(v), "=", 1);
7 
8             if (xs_list_len(kv) == 2) {
9                 const char *key = xs_list_get(kv, 0);