Merge commit '2c93f9b5dc502e6bc4b7050a5676dc5d8e16f8f2'

1 files changed, 16 insertions, 6 deletions

diff --git a/httpd/server_http.c b/httpd/server_http.c
index 32b9e7d..c37e8d5 100644
--- a/httpd/server_http.c
+++ b/httpd/server_http.c
@@ -881,7 +881,7 @@ server_expand_http(struct client *clt, const char *val, char *buf,
 {
 	struct http_descriptor	*desc = clt->clt_descreq;
 	struct server_config	*srv_conf = clt->clt_srv_conf;
-	char			 ibuf[128], *str, *path;
+	char			 ibuf[128], *str, *path, *query;
 	int			 ret;
 
 	if (strlcpy(buf, val, len) >= len)
@@ -896,9 +896,15 @@ server_expand_http(struct client *clt, const char *val, char *buf,
 			return (NULL);
 	}
 	if (strstr(val, "$QUERY_STRING") != NULL) {
-		if (expand_string(buf, len, "$QUERY_STRING",
-		    desc->http_query == NULL ? "" :
-		    desc->http_query) != 0)
+		if (desc->http_query == NULL) {
+			ret = expand_string(buf, len, "$QUERY_STRING", "");
+		} else {
+			if ((query = url_encode(desc->http_query)) == NULL)
+				return (NULL);
+			ret = expand_string(buf, len, "$QUERY_STRING", query);
+			free(query);
+		}
+		if (ret != 0)
 			return (NULL);
 	}
 	if (strstr(val, "$REMOTE_") != NULL) {
@@ -934,9 +940,13 @@ server_expand_http(struct client *clt, const char *val, char *buf,
 		if (desc->http_query == NULL) {
 			str = path;
 		} else {
-			ret = asprintf(&str, "%s?%s",
-			    path, desc->http_query);
+			if ((query = url_encode(desc->http_query)) == NULL) {
+				free(path);
+				return (NULL);
+			}
+			ret = asprintf(&str, "%s?%s", path, query);
 			free(path);
+			free(query);
 			if (ret == -1)
 				return (NULL);
 		}