From: Joe Orton <jorton@apache.org>
Date: Thu, 1 Jun 2006 10:54:59 +0000 (+0000)
Subject: Merge r407265 from trunk:
X-Git-Tag: 2.2.3~73
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=95284e0ebfb4d24daf1f92938f0c7f30383df8fb;p=thirdparty%2Fapache%2Fhttpd.git

Merge r407265 from trunk:

* modules/generators/mod_autoindex.c (output_directories): Escape
filename in non-FancyIndexing case.

PR: 38910
Submitted by: Robby Griffin <rmg terc.edu>
Reviewed by: jorton, rpluem, trawick


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x@410830 13f79535-47bb-0310-9956-ffa450edef68
---

diff --git a/CHANGES b/CHANGES
index e91fea3f454..6d98d00862e 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,6 +1,9 @@
                                                         -*- coding: utf-8 -*-
 Changes with Apache 2.2.3
 
+  *) mod_autoindex: Fix filename escaping with FancyIndexing disabled.
+     PR 38910.  [Robby Griffin <rmg terc.edu>]
+
   *) mod_charset_lite: Bypass translation when the source and dest charsets
      are the same. [Jeff Trawick]
 
diff --git a/modules/generators/mod_autoindex.c b/modules/generators/mod_autoindex.c
index 431d57d22e2..5c0d891060a 100644
--- a/modules/generators/mod_autoindex.c
+++ b/modules/generators/mod_autoindex.c
@@ -1819,8 +1819,9 @@ static void output_directories(struct ent **ar, int n,
             ap_rputc('\n', r);
         }
         else {
-            ap_rvputs(r, "<li><a href=\"", anchor, "\"> ", t2,
-                         "</a></li>\n", NULL);
+            ap_rvputs(r, "<li><a href=\"", anchor, "\"> ",
+                      ap_escape_html(scratch, t2),
+                      "</a></li>\n", NULL);
         }
     }
     if (autoindex_opts & TABLE_INDEXING) {