Decode url

1 files changed, 9 insertions, 1 deletions

diff --git a/cgi/command.cgi b/cgi/command.cgi
index 041d6ca..4406aea 100755
--- a/cgi/command.cgi
+++ b/cgi/command.cgi
@@ -5,9 +5,17 @@ io.flush()
 os.execute("env")
 print "\n"
 
+function url_decode(str)
+  str = string.gsub (str, "+", " ")
+  str = string.gsub (str, "%%(%x%x)",
+      function(h) return string.char(tonumber(h,16)) end)
+  str = string.gsub (str, "\r\n", "\n")
+  return str
+end
+
 local function run_command(user)
    -- we may need to do some kind of input validation on the query string
-   local query_string = os.getenv("QUERY_STRING")
+   local query_string = url_decode(os.getenv("QUERY_STRING"))
 
    --local cmdline = query_string