wcs: send quoted tracking code to wcs (#32646)

combo/apps/wcs/views.py

@@ -19,6 +19,7 @@ import re
 from django.contrib import messages
 from django.core.urlresolvers import reverse
 from django.http import JsonResponse, HttpResponseRedirect, HttpResponseBadRequest
+from django.utils.http import urlquote
 from django.utils.six.moves.urllib import parse as urlparse
 from django.utils.translation import ugettext_lazy as _
 from django.views.decorators.csrf import csrf_exempt
@@ -47,7 +48,7 @@ class TrackingCodeView(View):
             wcs_sites = get_wcs_services().values()
 
         for wcs_site in wcs_sites:
-            response = requests.get('/api/code/' + code,
+            response = requests.get('/api/code/' + urlquote(code),
                     remote_service=wcs_site, log_errors=False)
             if response.status_code == 200 and response.json().get('err') == 0:
                 return response.json().get('load_url')

tests/test_wcs.py

@@ -622,6 +622,13 @@ def test_tracking_code_cell(app):
     resp = resp.follow()
     assert '<li class="error">The tracking code could not been found.</li>' in resp.text
 
+    resp = app.get('/')
+    resp.form['code'] = 'FOO?BAR?bad<code>'
+    resp = resp.form.submit()
+    assert resp.status_code == 302
+    resp = resp.follow()
+    assert '<li class="error">The tracking code could not been found.</li>' in resp.text
+
     resp = app.get('/')
     resp.form['code'] = 'CNPHNTFB'
     resp = resp.form.submit()