attachments download url not encode

[TimmyOVO]

• Gitea version (or commit ref): 1.8
• Git version: 2.19.1.windows
• Operating system: Windows10 1809
• Database (use [x]):
  • PostgreSQL
  • MySQL
  • MSSQL
  • SQLite
• Can you reproduce the bug at https://try.gitea.io:
  • Yes (https://try.gitea.io/TimmyOVO/Test/releases)
  • No
  • Not relevant
• Log gist:

Description

https://try.gitea.io/TimmyOVO/Test/releases/download/Test/test#abc.jpg
not working but when url encoded
https://try.gitea.io/TimmyOVO/Test/releases/download/Test/test%23abc.jpg
its work
...

Screenshots

[zeripath]

sigh

The error is here:

gitea/templates/repo/release/list.tmpl

Line 80 in d3dc07f

<a target="_blank" rel="noopener noreferrer" href="{{$.RepoLink}}/releases/download/{{$release.TagName}}/{{$attachment.Name}}">

There are multiple uses of EscapePound elsewhere in that file - I am very suspicious that some of these may not be correct, but I am not certain that they're wrong and would require looking at the source code in depth, which I cannot do here.

Paging @mrsdizzie: fancy a quick fix?

[zeripath]

@TimmyOVO if you want to send a PR, Changing line 80 of templates/repo/release/list.tmpl from:

 <a target="_blank" rel="noopener noreferrer" href="{{$.RepoLink}}/releases/download/{{$release.TagName}}/{{$attachment.Name}}"> 

to:

 <a target="_blank" rel="noopener noreferrer" href="{{$.RepoLink}}/releases/download/{{$release.TagName | PathEscape }}/{{$attachment.Name | PathEscape}}"> 

Although another option is to rationalise this endpoint so that it does a similar thing to endpoints that use EscapePound elsewhere.

[mrsdizzie]

Sure I'll make a PR for this (that suggestion above seems right, seems somebody just forgot to do any escaping on this part).