vweb: escape form key, not only value. (#6269)

2020-08-30 13:09:12 -04:00 · 2020-08-30 13:09:12 -04:00 · b1a8e1e5b2
parent ea31c2a643
commit b1a8e1e5b2
1 changed files with 3 additions and 1 deletions
--- a/vlib/vweb/vweb.v
+++ b/vlib/vweb/vweb.v
@ -494,7 +494,9 @@ fn (mut ctx Context) parse_form(s string) {
 		}
 		keyval := word.trim_space().split('=')
 		if keyval.len != 2 { continue }
-		key := keyval[0]
+		key := urllib.query_unescape(keyval[0]) or {
+			continue
+		}
 		val := urllib.query_unescape(keyval[1]) or {
 			continue
 		}