pidgin/pidgin

Stop using g_uri_escape_string() to escape the URI before launching it.
release-2.x.y
2014-01-13, Mark Doliner
41e1147347a5
Stop using g_uri_escape_string() to escape the URI before launching it.

This was wrong. Take this URL as an example:
https://developer.pidgin.im/search?q=brains&noquickjump=1&wiki=on

When escaped with g_uri_escape_string() it becomes:
https://developer.pidgin.im/search%3Fq%3Dbrains%26noquickjump%3D1%26wiki%3Don

?, = and & are replaced with %3F, %3D and %26 which means they are considered part of the path component rather than query args. I tested and I get 404s when launching that URL with Firefox, Google Chrome, and these manual commands: gnome-open, xdg-open, firefox, google-chrome.

Strangely I DON'T get a 404 when I launch the URL with Konqueror. The original unescaped URL loads. I consider this to be a bug in Konqueror. They would fail to load when launched with a URL that has a question mark as part of the path component because they would convert the remaining path into the query string.

So I ripped out uri_escaped and used uri in its place everywhere.

This bug never got released. We changed the behavior because someone reported
to us that this URL:
http://example.org/$(xterm)
caused xterm to be executed on his system. Obviously that's bad if that
happens, but I don't think it's a bug in Pidgin. We're correctly escaping
all arguments that we pass to the browser command. If a system unescapes those
at some point and execs them, then that system is dangerously broken.

I tested this newest code with Firefox, Google Chrome, Konqueror, and the
manual commands gnome-open and xdg-open and they all work perfectly for me.
Purple, Pidgin and Finch
========================
See AUTHORS and COPYRIGHT for the list of contributors.
libpurple is a library intended to be used by programmers seeking
to write an IM client that connects to many IM networks. It supports
AIM, ICQ, XMPP, MSN and Yahoo!, among others.
Pidgin is a graphical IM client written in C which uses the GTK+
toolkit.
Finch is a text-based IM client written in C which uses the ncurses
toolkit.
These programs are not endorsed by, nor affiliated with, AOL nor any
other company in any way.
BUILD
=====
Read the 'INSTALL' file for more detailed directions.
These programs use the standard ./configure ; make. You need to use
gmake, BSD make probably won't work. Remember, run ./configure --help
to see what build options are available.
In order to compile Pidgin you need to have GTK+ 2.0 installed (as
well as the development files!). The configure script will fail if you
don't. If you don't have GTK+ 2.0 installed, you should install it
using your distribution's package management tools.
For sound support, you also need gstreamer 0.10 or higher. For
spellchecking support, you need libgtkspell (http://gtkspell.sf.net/).
Your distro of choice probably already includes these, just be sure to
install the development packages.
RUN
===
You should run 'make install' as root to make sure plugins and other files
get installed into locations they want to be in. Once you've done that,
you only need to run 'pidgin' or 'finch'.
To get started, simply add a new account.
If you come across a bug, please report it at: http://developer.pidgin.im
PLUGINS
=======
If you do not wish to enable the plugin support within Purple, run the
./configure script with the --disable-plugins option and recompile your
source code. This will prevent the ability to load plugins.
'make install' puts the plugins in $PREFIX/lib/purple (PREFIX being what
you specified when you ./configure'd - it defaults to /usr/local). Purple
looks for the plugins in that directory by default. Plugins can be installed
per-user in ~/.purple/plugins as well. Pidgin and Finch also look in
$PREFIX/lib/pidgin and $PREFIX/lib/finch for UI-specific, respectively.
To build a plugin from a .c file, put it in the plugins/ directory in
the source and run 'make filename.so', e.g. if you have the .c file
'kickass.c', put it in the plugins/ directory, and from that directory,
run 'make kickass.so'.