Don't keep the % in the URL when converted into a file name

When a file name is manufactured from a URL, the percent sign is removed to
prevent the web server or the browser from requesting a file with a % in
it.

The server or the browser would decode the percent sign if the two
subsequent bytes happened to be a valid hexadecimal byte and would request
the wrong file.

diff --git a/util.c b/util.c
index 5e5b885f71f2fa52fe99982daa481fa9a1e2d977..0c0c2430625b641dd64e8706c525482a48514106 100644 (file)
--- a/util.c
+++ b/util.c
@@ -1849,7 +1849,7 @@ void url_to_file(const char *url,char *file,int filesize)
        filesize--;
        skip=0;
        for(i=0; i<filesize && *url; url++) {
-               if(isalnum(*url) || *url=='-' || *url=='_' || *url=='.' || *url=='%') {
+               if(isalnum(*url) || *url=='-' || *url=='_' || *url=='.') {
                        file[i++]=*url;
                        skip=0;
                } else {