From 6fa95da04ecae740ce14b2db1a3898b0743a15c6 Mon Sep 17 00:00:00 2001
From: x <admin@f0ck.it>
Date: Sat, 24 Jan 2026 22:20:05 +0100
Subject: [PATCH] feat: Encode URL components for tag and user in contextUrl
 and use the generated contextUrl for data.url.pathname.

---
 src/inc/routes/ajax.mjs | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/src/inc/routes/ajax.mjs b/src/inc/routes/ajax.mjs
index 90cacae..7448588 100644
--- a/src/inc/routes/ajax.mjs
+++ b/src/inc/routes/ajax.mjs
@@ -13,11 +13,11 @@ export default (router, tpl) => {
         }
 
         let contextUrl = `/${req.params.itemid}`;
-        if (query.tag) contextUrl = `/tag/${query.tag}/${req.params.itemid}`;
+        if (query.tag) contextUrl = `/tag/${encodeURIComponent(query.tag)}/${req.params.itemid}`;
         if (query.user) {
             contextUrl = query.fav === 'true'
-                ? `/user/${query.user}/favs/${req.params.itemid}`
-                : `/user/${query.user}/${req.params.itemid}`;
+                ? `/user/${encodeURIComponent(query.user)}/favs/${req.params.itemid}`
+                : `/user/${encodeURIComponent(query.user)}/${req.params.itemid}`;
         }
 
         console.log('[AJAX DEBUG] Params:', { itemid: req.params.itemid, user: query.user, fav: query.fav, contextUrl });
@@ -54,7 +54,7 @@ export default (router, tpl) => {
         }
 
         // Inject missing variables normally provided by req or middleware
-        data.url = { pathname: `/${req.params.itemid}` }; // Template expects url.pathname
+        data.url = { pathname: contextUrl }; // Template expects url.pathname
         data.fullscreen = req.cookies.fullscreen || 0; // Index.mjs uses req.cookies.fullscreen
         data.hidePagination = true;