From ce4d4d3a86953863c78e19c23d5896b81e2c5670 Mon Sep 17 00:00:00 2001
From: Arthur Rosendahl <arthur.rosendahl@scilifelab.uu.se>
Date: Fri, 4 Oct 2024 16:24:47 +0200
Subject: [PATCH 1/2] [DCSS-87] Half-hearted attempt at fixing DCSS-87 (should
 be better).

---
 publications/__init__.py                  | 2 +-
 publications/label.py                     | 8 +++++---
 publications/templates/label/display.html | 2 +-
 publications/templates/label/edit.html    | 2 +-
 4 files changed, 8 insertions(+), 6 deletions(-)

diff --git a/publications/__init__.py b/publications/__init__.py
index fa5ab62..375dc1c 100644
--- a/publications/__init__.py
+++ b/publications/__init__.py
@@ -5,7 +5,7 @@
 import string
 import sys
 
-__version__ = "9.5.0"
+__version__ = "9.5.1-pretest"
 
 
 class Constants:
diff --git a/publications/label.py b/publications/label.py
index 41f21b2..59b24e3 100644
--- a/publications/label.py
+++ b/publications/label.py
@@ -4,6 +4,7 @@
 import io
 
 import tornado.web
+import tornado.escape
 
 from publications import constants
 from publications import settings
@@ -58,6 +59,7 @@ def get(self, identifier):
             publications=list(
                 publications.subset.Subset(self.db, label=label["value"])
             ),
+            escaped_label=tornado.escape.url_escape(label['value']),
         )
 
     @tornado.web.authenticated
@@ -200,17 +202,17 @@ class LabelEdit(RequestHandler):
     def get(self, identifier):
         self.check_admin()
         try:
-            label = self.get_label(identifier)
+            label = self.get_label(tornado.escape.url_unescape(identifier))
         except KeyError as error:
             self.see_other("labels", error=str(error))
             return
-        self.render("label/edit.html", label=label)
+        self.render("label/edit.html", label=label, escaped_label=identifier)
 
     @tornado.web.authenticated
     def post(self, identifier):
         self.check_admin()
         try:
-            label = self.get_label(identifier)
+            label = self.get_label(tornado.escape.url_unescape(identifier))
         except KeyError as error:
             self.see_other("labels", error=str(error))
             return
diff --git a/publications/templates/label/display.html b/publications/templates/label/display.html
index c1539e5..2496c30 100644
--- a/publications/templates/label/display.html
+++ b/publications/templates/label/display.html
@@ -64,7 +64,7 @@
 {% block meta_content %}
 {% if is_admin %}
 <p>
-  <a href="{{ reverse_url('label_edit', label['value']) }}"
+  <a href="{{ reverse_url('label_edit', escaped_label) }}"
      class="btn btn-primary btn-block"
      role="button">
     <span class="glyphicon glyphicon-edit"></span> Edit
diff --git a/publications/templates/label/edit.html b/publications/templates/label/edit.html
index f029ed0..c6c3fed 100644
--- a/publications/templates/label/edit.html
+++ b/publications/templates/label/edit.html
@@ -11,7 +11,7 @@
 {% end %} {# block body_title #}
 
 {% block main_content %}
-<form action="{{ reverse_url('label_edit', label['value']) }}"
+<form action="{{ reverse_url('label_edit', escaped_label) }}"
       method="POST" class="form-horizontal" role="form">
   {% module xsrf_form_html() %}
 

From d497da013af3b793da66f52a26653fe4c21dec9b Mon Sep 17 00:00:00 2001
From: Sonja Mathias <sonja.mathias@scilifelab.uu.se>
Date: Wed, 9 Oct 2024 13:39:36 +0200
Subject: [PATCH 2/2] Remove "-pretest" from the version number

---
 publications/__init__.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/publications/__init__.py b/publications/__init__.py
index 375dc1c..212919e 100644
--- a/publications/__init__.py
+++ b/publications/__init__.py
@@ -5,7 +5,7 @@
 import string
 import sys
 
-__version__ = "9.5.1-pretest"
+__version__ = "9.5.1"
 
 
 class Constants: