Skip to content
Open
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 1 addition & 2 deletions django_mfa/templatetags/otp_tags.py
Original file line number Diff line number Diff line change
Expand Up @@ -12,8 +12,7 @@
@register.filter
@stringfilter
def qrcode(value, alt=None):
url = conditional_escape("http://chart.apis.google.com/chart?%s" %
urlencode({'chs': '150x150', 'cht': 'qr', 'chl': value, 'choe': 'UTF-8'}))
url = conditional_escape("https://qrcode.tec-it.com/API/QRCode?data=" + value)
Copy link
Preview

Copilot AI May 7, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The 'value' parameter is now concatenated directly to the URL without URL-encoding, which may lead to errors if it contains special characters. Consider applying URL encoding to 'value' to ensure a valid URL.

Suggested change
url = conditional_escape("https://qrcode.tec-it.com/API/QRCode?data=" + value)
url = conditional_escape("https://qrcode.tec-it.com/API/QRCode?data=" + quote(value))

Copilot uses AI. Check for mistakes.

alt = conditional_escape(alt or value)

return format_html(u"""<img class="qrcode" src="%s" width="150" height="150" alt="%s" />""" % (url, alt))