django/django — pull request #2408 by erikvanzijst (2014-03-07 06:45:32+00:00)
Title: Fix unnecessary escaping of path chars in reverse()

The path segments concatenated by reverse() only need to get characters
quoted that are reserved as per section 3.3 of RFC-3986.

Unreserved characters that Django currently quotes as part of the work done
on #13260 are: ":@&=+$,"

Quoting unreserved characters leads to issues in situations where client and
server require unambigious URL representation, like creating a signature base
string in OAuth 1. Here the client produces a digest of a URL with quoted
chars, while the server ends up with a digest of the unquoted chars, leading
to different signatures (see
https://groups.google.com/forum/#!msg/django-developers/ZLGk7T4mJuw/4RqfgbZ-jOQJ).

To address this change still applies urlquote, but excludes the unreserved
path characters.