From 0e2071753fc2966af4da90f135fe4a0274d434bf Mon Sep 17 00:00:00 2001 From: Jo-Philipp Wich Date: Sat, 13 Nov 2010 13:52:34 +0000 Subject: [PATCH] luci-0.9: merge r6420 --- libs/web/luasrc/dispatcher.lua | 22 ++++++++++++++++++---- 1 file changed, 18 insertions(+), 4 deletions(-) diff --git a/libs/web/luasrc/dispatcher.lua b/libs/web/luasrc/dispatcher.lua index 711e4a443c..83ce52cbfe 100644 --- a/libs/web/luasrc/dispatcher.lua +++ b/libs/web/luasrc/dispatcher.lua @@ -49,11 +49,25 @@ local fi -- @return Relative URL function build_url(...) local path = {...} - local sn = http.getenv("SCRIPT_NAME") or "" + local url = { http.getenv("SCRIPT_NAME") or "" } + + local k, v for k, v in pairs(context.urltoken) do - sn = sn .. "/;" .. k .. "=" .. http.urlencode(v) + url[#url+1] = "/;" + url[#url+1] = http.urlencode(k) + url[#url+1] = "=" + url[#url+1] = http.urlencode(v) end - return sn .. ((#path > 0) and "/" .. table.concat(path, "/") or "") + + local p + for _, p in ipairs(path) do + if p:match("^[a-zA-Z0-9_%-%./,;]+$") then + url[#url+1] = "/" + url[#url+1] = p + end + end + + return table.concat(url, "") end --- Send a 404 error code and render the "error404" template if available. @@ -178,7 +192,7 @@ function dispatch(request) for i, s in ipairs(request) do local tkey, tval if t then - tkey, tval = s:match(";(%w+)=(.*)") + tkey, tval = s:match(";(%w+)=([a-fA-F0-9]*)") end if tkey then -- 2.30.2