Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

===================================================================
RCS file: /ftp/cvs/cvsroot/src/libexec/httpd/dir-index-bozo.c,v
rcsdiff: /ftp/cvs/cvsroot/src/libexec/httpd/dir-index-bozo.c,v: warning: Unknown phrases like `commitid ...;' are present.
retrieving revision 1.12
retrieving revision 1.12.4.2
diff -u -p -r1.12 -r1.12.4.2
--- src/libexec/httpd/dir-index-bozo.c	2011/03/10 14:39:40	1.12
+++ src/libexec/httpd/dir-index-bozo.c	2012/10/30 18:59:22	1.12.4.2
@@ -1,9 +1,9 @@
-/*	$NetBSD: dir-index-bozo.c,v 1.12 2011/03/10 14:39:40 reed Exp $	*/
+/*	$NetBSD: dir-index-bozo.c,v 1.12.4.2 2012/10/30 18:59:22 yamt Exp $	*/
 
-/*	$eterna: dir-index-bozo.c,v 1.18 2010/09/20 22:26:29 mrg Exp $	*/
+/*	$eterna: dir-index-bozo.c,v 1.20 2011/11/18 09:21:15 mrg Exp $	*/
 
 /*
- * Copyright (c) 1997-2010 Matthew R. Green
+ * Copyright (c) 1997-2011 Matthew R. Green
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -127,6 +127,7 @@ bozo_dir_index(bozo_httpreq_t *request, 
 	    j--; de++) {
 		int nostat = 0;
 		char *name = (*de)->d_name;
+		char *urlname;
 
 		if (strcmp(name, ".") == 0 ||
 		    (strcmp(name, "..") != 0 &&
@@ -139,18 +140,19 @@ bozo_dir_index(bozo_httpreq_t *request, 
 
 		l = 0;
 
+		urlname = escape_rfc3986(httpd, name);
 		if (strcmp(name, "..") == 0) {
 			bozo_printf(httpd, "<a href=\"../\">");
 			l += bozo_printf(httpd, "Parent Directory");
 		} else if (S_ISDIR(sb.st_mode)) {
-			bozo_printf(httpd, "<a href=\"%s/\">", name);
+			bozo_printf(httpd, "<a href=\"%s/\">", urlname);
 			l += bozo_printf(httpd, "%s/", name);
 		} else if (strchr(name, ':') != NULL) {
 			/* RFC 3986 4.2 */
-			bozo_printf(httpd, "<a href=\"./%s\">", name);
+			bozo_printf(httpd, "<a href=\"./%s\">", urlname);
 			l += bozo_printf(httpd, "%s", name);
 		} else {
-			bozo_printf(httpd, "<a href=\"%s\">", name);
+			bozo_printf(httpd, "<a href=\"%s\">", urlname);
 			l += bozo_printf(httpd, "%s", name);
 		}
 		bozo_printf(httpd, "</a>");
@@ -162,7 +164,7 @@ bozo_dir_index(bozo_httpreq_t *request, 
 		i++;
 		memset(spacebuf, ' ', (size_t)i);
 		spacebuf[i] = '\0';
-		bozo_printf(httpd, spacebuf);
+		bozo_printf(httpd, "%s", spacebuf);
 		l += i;
 
 		if (nostat)
@@ -180,7 +182,7 @@ bozo_dir_index(bozo_httpreq_t *request, 
 			i++;
 			memset(spacebuf, ' ', (size_t)i);
 			spacebuf[i] = '\0';
-			bozo_printf(httpd, spacebuf);
+			bozo_printf(httpd, "%s", spacebuf);
 
 			bozo_printf(httpd, "%7ukB",
 			    ((unsigned)((unsigned)(sb.st_size) >> 10)));