From 0bcfbc941b832ab947e4f9c1b22e17aab7dc7e2a Mon Sep 17 00:00:00 2001
From: Justin Wong <46082645+uvjustin@users.noreply.github.com>
Date: Fri, 19 Aug 2022 17:52:45 +0800
Subject: [PATCH] Unquote label in flask routes Encode label in Camera.jsx

---
 frigate/http.py           | 47 ++++++++++++++++++++++-----------------
 web/src/routes/Camera.jsx |  4 ++--
 2 files changed, 29 insertions(+), 22 deletions(-)

diff --git a/frigate/http.py b/frigate/http.py
index b7ed51783..c5e5a1f9a 100644
--- a/frigate/http.py
+++ b/frigate/http.py
@@ -8,6 +8,7 @@ import subprocess as sp
 import time
 from functools import reduce
 from pathlib import Path
+from urllib.parse import unquote
 
 import cv2
 
@@ -17,6 +18,7 @@ from flask import (
     Flask,
     Response,
     current_app,
+    g,
     jsonify,
     make_response,
     request,
@@ -35,6 +37,11 @@ logger = logging.getLogger(__name__)
 bp = Blueprint("frigate", __name__)
 
 
+@bp.url_value_preprocessor
+def unquote_label(endpoint, values):
+    g.label = unquote(values.pop("label", ""))
+
+
 def create_app(
     frigate_config,
     database: SqliteDatabase,
@@ -340,8 +347,8 @@ def event_thumbnail(id, max_cache_age=2592000):
 
 @bp.route("/<camera_name>/<label>/best.jpg")
 @bp.route("/<camera_name>/<label>/thumbnail.jpg")
-def label_thumbnail(camera_name, label):
-    if label == "any":
+def label_thumbnail(camera_name):
+    if g.label == "any":
         event_query = (
             Event.select()
             .where(Event.camera == camera_name)
@@ -352,7 +359,7 @@ def label_thumbnail(camera_name, label):
         event_query = (
             Event.select()
             .where(Event.camera == camera_name)
-            .where(Event.label == label)
+            .where(Event.label == g.label)
             .where(Event.has_snapshot == True)
             .order_by(Event.start_time.desc())
         )
@@ -423,8 +430,8 @@ def event_snapshot(id):
 
 
 @bp.route("/<camera_name>/<label>/snapshot.jpg")
-def label_snapshot(camera_name, label):
-    if label == "any":
+def label_snapshot(camera_name):
+    if g.label == "any":
         event_query = (
             Event.select()
             .where(Event.camera == camera_name)
@@ -435,7 +442,7 @@ def label_snapshot(camera_name, label):
         event_query = (
             Event.select()
             .where(Event.camera == camera_name)
-            .where(Event.label == label)
+            .where(Event.label == g.label)
             .where(Event.has_snapshot == True)
             .order_by(Event.start_time.desc())
         )
@@ -491,7 +498,7 @@ def event_clip(id):
 def events():
     limit = request.args.get("limit", 100)
     camera = request.args.get("camera", "all")
-    label = request.args.get("label", "all")
+    label = unquote(request.args.get("label", "all"))
     sub_label = request.args.get("sub_label", "all")
     zone = request.args.get("zone", "all")
     after = request.args.get("after", type=float)
@@ -753,9 +760,9 @@ def recordings(camera_name):
     return jsonify([e for e in recordings.dicts()])
 
 
-@bp.route("/<camera>/start/<int:start_ts>/end/<int:end_ts>/clip.mp4")
-@bp.route("/<camera>/start/<float:start_ts>/end/<float:end_ts>/clip.mp4")
-def recording_clip(camera, start_ts, end_ts):
+@bp.route("/<camera_name>/start/<int:start_ts>/end/<int:end_ts>/clip.mp4")
+@bp.route("/<camera_name>/start/<float:start_ts>/end/<float:end_ts>/clip.mp4")
+def recording_clip(camera_name, start_ts, end_ts):
     download = request.args.get("download", type=bool)
 
     recordings = (
@@ -765,7 +772,7 @@ def recording_clip(camera, start_ts, end_ts):
             | (Recordings.end_time.between(start_ts, end_ts))
             | ((start_ts > Recordings.start_time) & (end_ts < Recordings.end_time))
         )
-        .where(Recordings.camera == camera)
+        .where(Recordings.camera == camera_name)
         .order_by(Recordings.start_time.asc())
     )
 
@@ -780,7 +787,7 @@ def recording_clip(camera, start_ts, end_ts):
         if clip.end_time > end_ts:
             playlist_lines.append(f"outpoint {int(end_ts - clip.start_time)}")
 
-    file_name = f"clip_{camera}_{start_ts}-{end_ts}.mp4"
+    file_name = f"clip_{camera_name}_{start_ts}-{end_ts}.mp4"
     path = f"/tmp/cache/{file_name}"
 
     ffmpeg_cmd = [
@@ -809,7 +816,7 @@ def recording_clip(camera, start_ts, end_ts):
     )
     if p.returncode != 0:
         logger.error(p.stderr)
-        return f"Could not create clip from recordings for {camera}.", 500
+        return f"Could not create clip from recordings for {camera_name}.", 500
 
     response = make_response()
     response.headers["Content-Description"] = "File Transfer"
@@ -825,9 +832,9 @@ def recording_clip(camera, start_ts, end_ts):
     return response
 
 
-@bp.route("/vod/<camera>/start/<int:start_ts>/end/<int:end_ts>")
-@bp.route("/vod/<camera>/start/<float:start_ts>/end/<float:end_ts>")
-def vod_ts(camera, start_ts, end_ts):
+@bp.route("/vod/<camera_name>/start/<int:start_ts>/end/<int:end_ts>")
+@bp.route("/vod/<camera_name>/start/<float:start_ts>/end/<float:end_ts>")
+def vod_ts(camera_name, start_ts, end_ts):
     recordings = (
         Recordings.select()
         .where(
@@ -835,7 +842,7 @@ def vod_ts(camera, start_ts, end_ts):
             | Recordings.end_time.between(start_ts, end_ts)
             | ((start_ts > Recordings.start_time) & (end_ts < Recordings.end_time))
         )
-        .where(Recordings.camera == camera)
+        .where(Recordings.camera == camera_name)
         .order_by(Recordings.start_time.asc())
     )
 
@@ -876,14 +883,14 @@ def vod_ts(camera, start_ts, end_ts):
     )
 
 
-@bp.route("/vod/<year_month>/<day>/<hour>/<camera>")
-def vod_hour(year_month, day, hour, camera):
+@bp.route("/vod/<year_month>/<day>/<hour>/<camera_name>")
+def vod_hour(year_month, day, hour, camera_name):
     start_date = datetime.strptime(f"{year_month}-{day} {hour}", "%Y-%m-%d %H")
     end_date = start_date + timedelta(hours=1) - timedelta(milliseconds=1)
     start_ts = start_date.timestamp()
     end_ts = end_date.timestamp()
 
-    return vod_ts(camera, start_ts, end_ts)
+    return vod_ts(camera_name, start_ts, end_ts)
 
 
 @bp.route("/vod/event/<id>")
diff --git a/web/src/routes/Camera.jsx b/web/src/routes/Camera.jsx
index 39f068568..528415ca2 100644
--- a/web/src/routes/Camera.jsx
+++ b/web/src/routes/Camera.jsx
@@ -133,8 +133,8 @@ export default function Camera({ camera }) {
               className="mb-4 mr-4"
               key={objectType}
               header={objectType}
-              href={`/events?camera=${camera}&label=${objectType}`}
-              media={<img src={`${apiHost}/api/${camera}/${objectType}/thumbnail.jpg`} />}
+              href={`/events?camera=${camera}&label=${encodeURIComponent(objectType)}`}
+              media={<img src={`${apiHost}/api/${camera}/${encodeURIComponent(objectType)}/thumbnail.jpg`} />}
             />
           ))}
         </div>