Patch #1011123: Use urllib.quote() instead of cgi.escape() for encoding the

href attribute in list_directory(). This fixes the links for legal Unix
filenames such as 'a"b'.

diff --git a/Lib/SimpleHTTPServer.py b/Lib/SimpleHTTPServer.py
index d58f52fda0dd25868344f3834b2ca24dc62316f8..93662ab1948ae312a2d8dda743bab6748f183740 100644 (file)
--- a/Lib/SimpleHTTPServer.py
+++ b/Lib/SimpleHTTPServer.py
@@ -105,7 +105,7 @@ class SimpleHTTPRequestHandler(BaseHTTPServer.BaseHTTPRequestHandler):
         f.write("<hr>\n<ul>\n")
         for name in list:
             fullname = os.path.join(path, name)
-            displayname = linkname = name = cgi.escape(name)
+            displayname = linkname = name
             # Append / for directories or @ for symbolic links
             if os.path.isdir(fullname):
                 displayname = name + "/"
@@ -113,7 +113,8 @@ class SimpleHTTPRequestHandler(BaseHTTPServer.BaseHTTPRequestHandler):
             if os.path.islink(fullname):
                 displayname = name + "@"
                 # Note: a link to a directory displays with @ and links with /
-            f.write('<li><a href="%s">%s</a>\n' % (linkname, displayname))
+            f.write('<li><a href="%s">%s</a>\n'
+                    % (urllib.quote(linkname), cgi.escape(displayname)))
         f.write("</ul>\n<hr>\n")
         length = f.tell()
         f.seek(0)