From e2925909b253d725cf834f855e6b128936cce461 Mon Sep 17 00:00:00 2001
From: Jeremy Kersten <jke@odoo.com>
Date: Fri, 8 Jan 2016 18:44:51 +0100
Subject: [PATCH] [FIX] website_forum: escape search by tag, quote char to
 search, don't create empty tag, only display alphanum first char in pager of
 tags, ...

---
 addons/website_forum/controllers/main.py     | 5 ++---
 addons/website_forum/models/forum.py         | 2 +-
 addons/website_forum/views/website_forum.xml | 6 ++----
 3 files changed, 5 insertions(+), 8 deletions(-)

diff --git a/addons/website_forum/controllers/main.py b/addons/website_forum/controllers/main.py
index a12bbfc85b0..449ce6a758d 100644
--- a/addons/website_forum/controllers/main.py
+++ b/addons/website_forum/controllers/main.py
@@ -183,7 +183,7 @@ class WebsiteForum(http.Controller):
     def tags(self, forum, tag_char=None, **post):
         # build the list of tag first char, with their value as tag_char param Ex : [('All', 'all'), ('C', 'c'), ('G', 'g'), ('Z', z)]
         first_char_tag = forum.get_tags_first_char()
-        first_char_list = [(t, t.lower()) for t in first_char_tag]
+        first_char_list = [(t, t.lower()) for t in first_char_tag if t.isalnum()]
         first_char_list.insert(0, (_('All'), 'all'))
         # get active first char tag
         active_char_tag = first_char_list[1][1] if len(first_char_list) > 1 else 'all'
@@ -193,7 +193,7 @@ class WebsiteForum(http.Controller):
         domain = [('forum_id', '=', forum.id), ('posts_count', '>', 0)]
         order_by = 'name'
         if active_char_tag and active_char_tag != 'all':
-            domain.append(('name', '=ilike', active_char_tag+'%'))
+            domain.append(('name', '=ilike', tools.escape_psql(active_char_tag)+'%'))
             order_by = 'posts_count DESC'
         tags = request.env['forum.tag'].search(domain, limit=None, order=order_by)
         # prepare values and render template
@@ -205,7 +205,6 @@ class WebsiteForum(http.Controller):
         })
         return request.website.render("website_forum.tag", values)
 
-
     @http.route('/forum/<model("forum.forum"):forum>/edit_welcome_message', auth="user", website=True)
     def edit_welcome_message(self, forum, **kw):
         return request.website.render("website_forum.edit_welcome_message", {'forum': forum})
diff --git a/addons/website_forum/models/forum.py b/addons/website_forum/models/forum.py
index a417b4f07f9..629cf0e125f 100644
--- a/addons/website_forum/models/forum.py
+++ b/addons/website_forum/models/forum.py
@@ -174,7 +174,7 @@ class Forum(models.Model):
                 else:
                     # check if user have Karma needed to create need tag
                     user = User.sudo().browse(self._uid)
-                    if user.exists() and user.karma >= self.karma_retag and len(tag.strip('_').strip()) > 0:
+                    if user.exists() and user.karma >= self.karma_retag and len(tag) and len(tag[1:].strip()):
                         post_tags.append((0, 0, {'name': tag[1:], 'forum_id': self.id}))
             else:
                 existing_keep.append(int(tag))
diff --git a/addons/website_forum/views/website_forum.xml b/addons/website_forum/views/website_forum.xml
index 658c621a3c4..879ca5ba379 100644
--- a/addons/website_forum/views/website_forum.xml
+++ b/addons/website_forum/views/website_forum.xml
@@ -1081,18 +1081,16 @@
             <ul class="pagination mt0 mb0">
                 <li class="disabled"><a><i class="fa fa-filter"></i></a></li>
                 <t t-foreach="pager_tag_chars" t-as="tuple_char">
-                    <li t-attf-class="#{'active' if active_char_tag == tuple_char[1] else ''}"><a t-attf-href="/forum/#{slug(forum)}/tag/#{tuple_char[1]}"><t t-esc="tuple_char[0]"/></a></li>
+                    <li t-attf-class="#{'active' if active_char_tag == tuple_char[1] else ''}"><a t-attf-href="/forum/#{slug(forum)}/tag/#{quote_plus(tuple_char[1])}"><t t-esc="tuple_char[0]"/></a></li>
                 </t>
             </ul>
         </nav>
         <div class="row">
             <div class="col-sm-3 mt16" t-foreach="tags" t-as="tag">
+                <span><t t-esc="tag.posts_count"/>&amp;nbsp;&amp;nbsp;<i class='fa fa-times'/>&amp;nbsp;&amp;nbsp;</span>
                 <a t-attf-href="/forum/#{ slug(forum) }/tag/#{ slug(tag) }/questions?{{ keep_query( filters='tag') }}" class="label label-default">
                     <span t-field="tag.name"/>
                 </a>
-                <span>
-                    X <t t-esc="tag.posts_count"/>
-                </span>
             </div>
         </div>
     </t>