From 4362c6127f1520bee50662dd151c073b2e94c91c Mon Sep 17 00:00:00 2001
From: Xavier Morel <xmo@openerp.com>
Date: Fri, 23 May 2014 15:03:23 +0200
Subject: [PATCH 1/2] [IMP] use url_encode when building url query string

I have no idea why I originall implemented that crap via string munging.
---
 addons/website/models/ir_qweb.py | 20 ++++++++++++--------
 1 file changed, 12 insertions(+), 8 deletions(-)

diff --git a/addons/website/models/ir_qweb.py b/addons/website/models/ir_qweb.py
index 40b407a040a..0e1fe2beb89 100644
--- a/addons/website/models/ir_qweb.py
+++ b/addons/website/models/ir_qweb.py
@@ -15,6 +15,7 @@ import urllib2
 import urlparse
 import re
 
+import werkzeug.urls
 import werkzeug.utils
 from dateutil import parser
 from lxml import etree, html
@@ -265,16 +266,19 @@ class Image(orm.AbstractModel):
         if options is None: options = {}
         classes = ['img', 'img-responsive'] + options.get('class', '').split()
 
-        size_params = []
-        if options.has_key('max_width'):
-            size_params.append("max_width=%i" % options['max_width'])
-        if options.has_key('max_height'):
-            size_params.append("max_height=%i" % options['max_height'])
+        url_params = {
+            'model': record._model._name,
+            'field': field_name,
+            'id': record.id,
+        }
+        for options_key in ['max_width', 'max_height']:
+            if options.get(options_key):
+                url_params[options_key] = options[options_key]
 
-        return ir_qweb.HTMLSafe('<img class="%s" src="/website/image?model=%s&field=%s&id=%s&%s"/>' % (
+        return ir_qweb.HTMLSafe('<img class="%s" src="/website/image?%s"/>' % (
             ' '.join(itertools.imap(werkzeug.utils.escape, classes)),
-            record._model._name,
-            field_name, record.id, '&'.join(size_params)))
+            werkzeug.urls.url_encode(url_params)
+        ))
 
     local_url_re = re.compile(r'^/(?P<module>[^]]+)/static/(?P<rest>.+)$')
     def from_html(self, cr, uid, model, column, element, context=None):

From 327dda0bded911078ec4155247adec8522f6ba87 Mon Sep 17 00:00:00 2001
From: Xavier Morel <xmo@openerp.com>
Date: Fri, 23 May 2014 15:11:13 +0200
Subject: [PATCH 2/2] [FIX] correctly handle invalid max_width/max_height
 passed to website._image

---
 addons/website/models/website.py | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/addons/website/models/website.py b/addons/website/models/website.py
index e0aac6dbbbf..9828e9aa39d 100644
--- a/addons/website/models/website.py
+++ b/addons/website/models/website.py
@@ -555,8 +555,10 @@ class website(osv.osv):
         if record.get(presized):
             response.data = data
             return response
-
-        fit = int(max_width), int(max_height)
+        try:
+            fit = int(max_width), int(max_height)
+        except TypeError:
+            fit = (maxint, maxint)
         w, h = image.size
         max_w, max_h = fit