bugfix #13757 - passing query string on command line when run from shell

1 files changed, 25 insertions, 25 deletions

diff --git a/sapi/cgi/cgi_main.c b/sapi/cgi/cgi_main.c
index adbcd1deff..3125a46f2b 100644
--- a/sapi/cgi/cgi_main.c
+++ b/sapi/cgi/cgi_main.c
@@ -1404,46 +1404,46 @@ consult the installation file that came with this distribution, or visit \n\
 				}
 			}
 
+			if (script_file) {
+				/* override path_translated if -f on command line */
+				SG(request_info).path_translated = script_file;
+			}
+
+			if (no_headers) {
+				SG(headers_sent) = 1;
+				SG(request_info).no_headers = 1;
+			}
+
+			if (!SG(request_info).path_translated && argc > optind) {
+				/* file is on command line, but not in -f opt */
+				SG(request_info).path_translated = estrdup(argv[optind++]);
+			}
+
+			/* all remaining arguments are part of the query string
+			   this section of code concatenates all remaining arguments
+			   into a single string, seperating args with a &
+			   this allows command lines like:
+
+			   test.php v1=test v2=hello+world!
+			   test.php "v1=test&v2=hello world!"
+			   test.php v1=test "v2=hello world!"
+			*/
 			if (!SG(request_info).query_string) {
 				len = 0;
-				if (script_file) {
-					len += strlen(script_file) + 1;
-				}
 				for (i = optind; i < argc; i++) {
 					len += strlen(argv[i]) + 1;
 				}
 
 				s = malloc(len + 1);	/* leak - but only for command line version, so ok */
 				*s = '\0';			/* we are pretending it came from the environment  */
-				if (script_file) {
-					strcpy(s, script_file);
-					if (optind<argc) {
-						strcat(s, "+");
-					}
-				}
 				for (i = optind, len = 0; i < argc; i++) {
 					strcat(s, argv[i]);
 					if (i < (argc - 1)) {
-						strcat(s, "+");
+						strcat(s, "&");
 					}
 				}
 				SG(request_info).query_string = s;
 			}
-
-			if (script_file) {
-				/* override path_translated if -f on command line */
-				SG(request_info).path_translated = script_file;
-			}
-
-			if (no_headers) {
-				SG(headers_sent) = 1;
-				SG(request_info).no_headers = 1;
-			}
-
-			if (!SG(request_info).path_translated && argc > optind) {
-				/* file is on command line, but not in -f opt */
-				SG(request_info).path_translated = estrdup(argv[optind]);
-			}
 		} /* end !cgi && !fastcgi */
 
 		/*