Patch #1011123: Use urllib.quote() instead of cgi.escape() for encoding the

href attribute in list_directory(). This fixes the links for legal Unix
filenames such as 'a"b'.

1 files changed, 3 insertions, 2 deletions

diff --git a/Lib/SimpleHTTPServer.py b/Lib/SimpleHTTPServer.py
index d58f52f..93662ab 100644
--- a/Lib/SimpleHTTPServer.py
+++ b/Lib/SimpleHTTPServer.py
@@ -105,7 +105,7 @@ class SimpleHTTPRequestHandler(BaseHTTPServer.BaseHTTPRequestHandler):
         f.write("<hr>\n<ul>\n")
         for name in list:
             fullname = os.path.join(path, name)
-            displayname = linkname = name = cgi.escape(name)
+            displayname = linkname = name
             # Append / for directories or @ for symbolic links
             if os.path.isdir(fullname):
                 displayname = name + "/"
@@ -113,7 +113,8 @@ class SimpleHTTPRequestHandler(BaseHTTPServer.BaseHTTPRequestHandler):
             if os.path.islink(fullname):
                 displayname = name + "@"
                 # Note: a link to a directory displays with @ and links with /
-            f.write('<li><a href="%s">%s</a>\n' % (linkname, displayname))
+            f.write('<li><a href="%s">%s</a>\n'
+                    % (urllib.quote(linkname), cgi.escape(displayname)))
         f.write("</ul>\n<hr>\n")
         length = f.tell()
         f.seek(0)