Merge r407265 from trunk:

* modules/generators/mod_autoindex.c (output_directories): Escape
filename in non-FancyIndexing case.

PR: 38910
Submitted by: Robby Griffin <rmg terc.edu>
Reviewed by: jorton, rpluem, trawick

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x@410830 13f79535-47bb-0310-9956-ffa450edef68

diff --git a/CHANGES b/CHANGES
index e91fea3f4548c04bf33e0fd0c63e09d25144bf55..6d98d00862eb163c844593661e4f619262ff3f0a 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -1,6 +1,9 @@
                                                         -*- coding: utf-8 -*-
 Changes with Apache 2.2.3
 
+  *) mod_autoindex: Fix filename escaping with FancyIndexing disabled.
+     PR 38910.  [Robby Griffin <rmg terc.edu>]
+
   *) mod_charset_lite: Bypass translation when the source and dest charsets
      are the same. [Jeff Trawick]
 

diff --git a/modules/generators/mod_autoindex.c b/modules/generators/mod_autoindex.c
index 431d57d22e2d1b965b8c006062283df2949937eb..5c0d891060ae8fbd0af5a350a6f58d9b2ca163d8 100644 (file)
--- a/modules/generators/mod_autoindex.c
+++ b/modules/generators/mod_autoindex.c
@@ -1819,8 +1819,9 @@ static void output_directories(struct ent **ar, int n,
             ap_rputc('\n', r);
         }
         else {
-            ap_rvputs(r, "<li><a href=\"", anchor, "\"> ", t2,
-                         "</a></li>\n", NULL);
+            ap_rvputs(r, "<li><a href=\"", anchor, "\"> ",
+                      ap_escape_html(scratch, t2),
+                      "</a></li>\n", NULL);
         }
     }
     if (autoindex_opts & TABLE_INDEXING) {