Looks like the '+' -> ' ' transformation is only applied in the ?query part and not the rel-path.

git-svn-id: svn://svn.lighttpd.net/lighttpd/branches/lighttpd-1.3.x@366 152afb58-edef-0310-8abb-c4023f1b3aa9

src/buffer.c

@@ -784,7 +784,8 @@ int buffer_append_string_html_encoded(buffer *b, const char *s) {
 /* decodes url-special-chars inplace.
  * replaces non-printable characters with '_'
  */
-int buffer_urldecode(buffer *url) {
+
+static int buffer_urldecode_internal(buffer *url, int is_query) {
 	unsigned char high, low;
 	const char *src;
 	char *dst;
@@ -795,12 +796,9 @@ int buffer_urldecode(buffer *url) {
 	dst = (char*) url->ptr;
 
 	while ((*src) != '\0') {
-#if 1
-		if (*src == '+') {
+		if (is_query && *src == '+') {
 			*dst = ' ';
-		} else 
-#endif
-		if (*src == '%') {
+		} else if (*src == '%') {
 			*dst = '%';
 
 			high = hex2int(*(src + 1));
@@ -830,6 +828,14 @@ int buffer_urldecode(buffer *url) {
 	return 0;
 }
 
+int buffer_urldecode_path(buffer *url) {
+	return buffer_urldecode_internal(url, 0);
+}
+
+int buffer_urldecode_query(buffer *url) {
+	return buffer_urldecode_internal(url, 1);
+}
+
 /* Remove "/../", "//", "/./" parts from path.
  *
  * /blah/..         gets  /

src/buffer.h

@@ -85,7 +85,8 @@ int buffer_append_string_hex(buffer *b, const char *in, size_t in_len);
 int buffer_append_string_url_encoded(buffer *b, const char *s);
 int buffer_append_string_html_encoded(buffer *b, const char *s);
 
-int buffer_urldecode(buffer *url);
+int buffer_urldecode_path(buffer *url);
+int buffer_urldecode_query(buffer *url);
 int buffer_path_simplify(buffer *dest, buffer *src);
 
 /** deprecated */

src/mod_ssi.c

@@ -522,7 +522,7 @@ static int process_ssi_stmt(server *srv, connection *con, plugin_data *p,
 				buffer_append_string(p->stat_fn, virt_path);
 			}
 			
-			buffer_urldecode(p->stat_fn);
+			buffer_urldecode_path(p->stat_fn);
 			buffer_path_simplify(srv->tmp_buf, p->stat_fn);
 			
 			/* we have an uri */

src/request.c

@@ -264,7 +264,7 @@ int request_uri_is_valid_char(char c) {
 	
 	/* alphanum */
 	if (light_isalnum(c)) return 1;
-	
+	if (c < 0) return 1; /* no-ascii chars are ok */
 	
 	switch(c) {
 		/* reserved */
@@ -275,7 +275,7 @@ int request_uri_is_valid_char(char c) {
 	case '@':
 	case '&':
 	case '=':
-	case '+':
+	case '+': /* only in Query part it is rewritten to ' ' (space) */
 	case '$':
 	case ',':
 		

src/response.c

@@ -945,7 +945,7 @@ handler_t http_response_prepare(server *srv, connection *con) {
 		
 		
 		buffer_copy_string_buffer(srv->tmp_buf, con->uri.path_raw);
-		buffer_urldecode(srv->tmp_buf);
+		buffer_urldecode_path(srv->tmp_buf);
 		buffer_path_simplify(con->uri.path, srv->tmp_buf);
 
 		if (con->conf.log_request_handling) {