From 8253aa79bd6efd120c1f2d3c2872deda9609ff3a Mon Sep 17 00:00:00 2001
From: Kitaiti Makoto <KitaitiMakoto@gmail.com>
Date: Sun, 3 May 2020 06:05:58 +0900
Subject: [PATCH] Percent-encode URI segments in ap_url

---
 plume-models/src/blogs.rs |  8 +++++++-
 plume-models/src/posts.rs |  6 ++++--
 plume-models/src/users.rs | 14 ++++++++++----
 3 files changed, 21 insertions(+), 7 deletions(-)

diff --git a/plume-models/src/blogs.rs b/plume-models/src/blogs.rs
index cbef35c6..d1c1f4ac 100644
--- a/plume-models/src/blogs.rs
+++ b/plume-models/src/blogs.rs
@@ -20,6 +20,7 @@ use plume_common::activity_pub::{
     inbox::{AsActor, FromId},
     sign, ActivityStream, ApSignature, Id, IntoId, PublicKey, Source,
 };
+use rocket::http::uri::Uri;
 use serde_json;
 use url::Url;
 use webfinger::*;
@@ -481,13 +482,18 @@ impl NewBlog {
         instance_id: i32,
     ) -> Result<NewBlog> {
         let (pub_key, priv_key) = sign::gen_keypair();
+        let instance = Instance::get_local()?;
+        let encoded_actor_id = Uri::percent_encode(&actor_id);
         Ok(NewBlog {
-            actor_id,
+            actor_id: actor_id.clone(),
             title,
             summary,
             instance_id,
             public_key: String::from_utf8(pub_key).or(Err(Error::Signature))?,
             private_key: Some(String::from_utf8(priv_key).or(Err(Error::Signature))?),
+            outbox_url: instance.compute_box(BLOG_PREFIX, &encoded_actor_id, "outbox"),
+            inbox_url: instance.compute_box(BLOG_PREFIX, &encoded_actor_id, "inbox"),
+            ap_url: instance.compute_box(BLOG_PREFIX, &encoded_actor_id, ""),
             ..NewBlog::default()
         })
     }
diff --git a/plume-models/src/posts.rs b/plume-models/src/posts.rs
index 73c0c915..3ff50ff5 100644
--- a/plume-models/src/posts.rs
+++ b/plume-models/src/posts.rs
@@ -19,6 +19,7 @@ use plume_common::{
     },
     utils::md_to_html,
 };
+use rocket::http::uri::Uri;
 use serde_json;
 use std::collections::HashSet;
 
@@ -69,11 +70,12 @@ impl Post {
             .execute(conn)?;
         let mut post = Self::last(conn)?;
         if post.ap_url.is_empty() {
+            // Should use uri!(plume::routes::posts::detauls) if possible
             post.ap_url = ap_url(&format!(
                 "{}/~/{}/{}/",
                 CONFIG.base_url,
-                post.get_blog(conn)?.fqn,
-                post.slug
+                Uri::percent_encode(&post.get_blog(conn)?.fqn),
+                Uri::percent_encode(&post.slug)
             ));
             let _: Post = post.save_changes(conn)?;
         }
diff --git a/plume-models/src/users.rs b/plume-models/src/users.rs
index 7da04d4a..7fc08d25 100644
--- a/plume-models/src/users.rs
+++ b/plume-models/src/users.rs
@@ -34,6 +34,7 @@ use reqwest::{
     ClientBuilder,
 };
 use rocket::{
+    http::uri::Uri,
     outcome::IntoOutcome,
     request::{self, FromRequest, Request},
 };
@@ -992,6 +993,7 @@ impl NewUser {
             return Err(Error::Blocklisted(x.notify_user, x.notification_text));
         }
 
+        let encoded_username = Uri::percent_encode(&username);
         let res = User::insert(
             conn,
             NewUser {
@@ -1005,11 +1007,15 @@ impl NewUser {
                 instance_id: instance.id,
                 public_key: String::from_utf8(pub_key).or(Err(Error::Signature))?,
                 private_key: Some(String::from_utf8(priv_key).or(Err(Error::Signature))?),
-                outbox_url: instance.compute_box(USER_PREFIX, &username, "outbox"),
-                inbox_url: instance.compute_box(USER_PREFIX, &username, "inbox"),
-                ap_url: instance.compute_box(USER_PREFIX, &username, ""),
+                outbox_url: instance.compute_box(USER_PREFIX, &encoded_username, "outbox"),
+                inbox_url: instance.compute_box(USER_PREFIX, &encoded_username, "inbox"),
+                ap_url: instance.compute_box(USER_PREFIX, &encoded_username, ""),
                 shared_inbox_url: Some(ap_url(&format!("{}/inbox", &instance.public_domain))),
-                followers_endpoint: instance.compute_box(USER_PREFIX, &username, "followers"),
+                followers_endpoint: instance.compute_box(
+                    USER_PREFIX,
+                    &encoded_username,
+                    "followers",
+                ),
                 fqn: username,
                 avatar_id: None,
             },