From: Jo-Philipp Wich <jow@openwrt.org>
Date: Sat, 13 Nov 2010 13:52:34 +0000 (+0000)
Subject: luci-0.9: merge r6420
X-Git-Url: http://git.lede-project.org./?a=commitdiff_plain;h=0e2071753fc2966af4da90f135fe4a0274d434bf;p=project%2Fluci.git

luci-0.9: merge r6420
---

diff --git a/libs/web/luasrc/dispatcher.lua b/libs/web/luasrc/dispatcher.lua
index 711e4a443c..83ce52cbfe 100644
--- a/libs/web/luasrc/dispatcher.lua
+++ b/libs/web/luasrc/dispatcher.lua
@@ -49,11 +49,25 @@ local fi
 -- @return 		Relative URL
 function build_url(...)
 	local path = {...}
-	local sn = http.getenv("SCRIPT_NAME") or ""
+	local url = { http.getenv("SCRIPT_NAME") or "" }
+
+	local k, v
 	for k, v in pairs(context.urltoken) do
-		sn = sn .. "/;" .. k .. "=" .. http.urlencode(v)
+		url[#url+1] = "/;"
+		url[#url+1] = http.urlencode(k)
+		url[#url+1] = "="
+		url[#url+1] = http.urlencode(v)
 	end
-	return sn .. ((#path > 0) and "/" .. table.concat(path, "/") or "")
+
+	local p
+	for _, p in ipairs(path) do
+		if p:match("^[a-zA-Z0-9_%-%./,;]+$") then
+			url[#url+1] = "/"
+			url[#url+1] = p
+		end
+	end
+
+	return table.concat(url, "")
 end
 
 --- Send a 404 error code and render the "error404" template if available.
@@ -178,7 +192,7 @@ function dispatch(request)
 	for i, s in ipairs(request) do
 		local tkey, tval
 		if t then
-			tkey, tval = s:match(";(%w+)=(.*)")
+			tkey, tval = s:match(";(%w+)=([a-fA-F0-9]*)")
 		end
 
 		if tkey then