luci-0.9: merge r6420

[project/luci.git] / libs / web / luasrc / dispatcher.lua

diff --git a/libs/web/luasrc/dispatcher.lua b/libs/web/luasrc/dispatcher.lua
index 711e4a4..83ce52c 100644 (file)
--- a/libs/web/luasrc/dispatcher.lua
+++ b/libs/web/luasrc/dispatcher.lua
@@ -49,11 +49,25 @@ local fi
 -- @return             Relative URL
 function build_url(...)
        local path = {...}
-       local sn = http.getenv("SCRIPT_NAME") or ""
+       local url = { http.getenv("SCRIPT_NAME") or "" }
+
+       local k, v
        for k, v in pairs(context.urltoken) do
-               sn = sn .. "/;" .. k .. "=" .. http.urlencode(v)
+               url[#url+1] = "/;"
+               url[#url+1] = http.urlencode(k)
+               url[#url+1] = "="
+               url[#url+1] = http.urlencode(v)
        end
-       return sn .. ((#path > 0) and "/" .. table.concat(path, "/") or "")
+
+       local p
+       for _, p in ipairs(path) do
+               if p:match("^[a-zA-Z0-9_%-%./,;]+$") then
+                       url[#url+1] = "/"
+                       url[#url+1] = p
+               end
+       end
+
+       return table.concat(url, "")
 end
 
 --- Send a 404 error code and render the "error404" template if available.
@@ -178,7 +192,7 @@ function dispatch(request)
        for i, s in ipairs(request) do
                local tkey, tval
                if t then
-                       tkey, tval = s:match(";(%w+)=(.*)")
+                       tkey, tval = s:match(";(%w+)=([a-fA-F0-9]*)")
                end
 
                if tkey then