ageric/nagios — pull request #5 by pengi (2013-05-20 14:26:49+00:00)
Title: Encode macros correctly

Sending this pull request so the code can be reviewed and discussed before tests is written.

The encoding of macros was earlier made by looking at two things:
- The target of the string the macro was put in (url, command line, note)
- Which macro was going to be expanded (url, command line argument, note)

The only thing deciding how to escape is actually the first one; putting an url in a notes-field shouldn't url-encode the url again, just because it's a url.

A side effect of this was that the url-encode routine whitelisted to many characters, so the url didn't got broken to much, so double escaping worked most of the time.

This has an impact on the routines calling the macro escaping: those routinges needs to be picky about actually asking for the correct escaping; macros isn't command-line-escaped by default, and the bug auto-escaping those (because most argument types says they should be command-line-escaped). The code sending notifications indicates that this was the original though (by passing those arguments to the macro expansion routine). The check execution is patched in this pull request.

The same effect affects third party broker modules using the macro expansion code. Two modules is found to have this problem; op5 testthis, but this is patched in the master, but doesn't have a version number yet. And also mod_gearman is affected.