fix: Skip setting existing context values

When setting up a context with user provided variables,
we should not override any existing values previously set.

Signed-off-by: moson <moson@archlinux.org>

aurweb/templates.py

@@ -112,7 +112,7 @@ async def make_variable_context(request: Request, title: str, next: str = None):
     for k, v in to_copy.items():
         if k == "timezone":
             context[k] = v if v in time.SUPPORTED_TIMEZONES else DEFAULT_TIMEZONE
-        else:
+        elif k not in context:
             context[k] = v
     context["q"] = dict(request.query_params)
 

test/test_templates.py

@@ -368,3 +368,13 @@ async def test_make_variable_context_timezone(user: User, package: Package):
         request, "Test Details", next="/packages/test"
     )
     assert context["timezone"] in time.SUPPORTED_TIMEZONES
+
+
+@pytest.mark.asyncio
+async def test_make_variable_context_params():
+    request = Request(url="/test", query_params={"request": "test", "x": "test"})
+    context = await make_variable_context(request, "Test")
+
+    # make sure we can't override our Request object with a query parameter
+    assert context["request"] != "test"
+    assert context["x"] == "test"