From 5ca8eeeaa7da438eae14c8dbdbf129d80961bc24 Mon Sep 17 00:00:00 2001
From: Stefan Koelle <stefan.koelle@gmail.com>
Date: Wed, 5 Aug 2026 20:27:38 +0200
Subject: [PATCH] web custom links urlquote

---
 src/api/main.py                | 2 ++
 src/api/templates/contact.html | 2 +-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/src/api/main.py b/src/api/main.py
index 2842cc4..54706dd 100644
--- a/src/api/main.py
+++ b/src/api/main.py
@@ -11,6 +11,7 @@ import json
 import logging
 import secrets
 from datetime import date
+from urllib.parse import quote_plus
 
 from fastapi import Depends, FastAPI, Query, Request
 from fastapi.responses import HTMLResponse, RedirectResponse
@@ -30,6 +31,7 @@ app = FastAPI(title="iCloud Contacts Sync – Interne API", version="1.0.0")
 app.add_middleware(SessionMiddleware, secret_key=secrets.token_hex(32), session_cookie="ics_session")
 app.mount("/static", StaticFiles(directory="api/static"), name="static")
 templates = Jinja2Templates(directory="api/templates")
+templates.env.filters["urlquote"] = lambda s: quote_plus(s or "")
 
 
 def _row_to_contact_out(row: dict) -> dict:
diff --git a/src/api/templates/contact.html b/src/api/templates/contact.html
index 28dec30..85c139b 100644
--- a/src/api/templates/contact.html
+++ b/src/api/templates/contact.html
@@ -410,7 +410,7 @@
                 <div class="section-title">Schnelllinks</div>
                 <div class="section-list">
                     {% for link in custom_links %}
-                    <a href="{{ link.url | replace('[fullname]', contact.full_name or '') }}" target="_blank" class="quicklink-item">
+                    <a href="{{ link.url | replace('[fullname]', contact.full_name | urlquote) }}" target="_blank" class="quicklink-item">
                         {{ link.label }}
                     </a>
                     {% endfor %}