Quote SCRIPT_NAME and PATH_INFO in construct_url and when forwarding the request via the proxy

2 files changed, 10 insertions, 6 deletions

diff --git a/paste/proxy.py b/paste/proxy.py
index 9148159..1fa38c3 100644
--- a/paste/proxy.py
+++ b/paste/proxy.py
@@ -31,6 +31,7 @@ TODO:
 
 import httplib
 import urlparse
+import urllib
 
 from paste import httpexceptions
 from paste.util.converters import aslist
@@ -87,14 +88,15 @@ class Proxy(object):
         else:
             body = ''
             
+        path_info = urllib.quote(environ['PATH_INFO'])
         if self.path:            
-            request_path = environ['PATH_INFO']
+            request_path = path_info
             if request_path[0] == '/':
                 request_path = request_path[1:]
                 
             path = urlparse.urljoin(self.path, request_path)
         else:
-            path = environ['PATH_INFO']
+            path = path_info
             
         conn.request(environ['REQUEST_METHOD'],
                      path,
@@ -213,6 +215,7 @@ class TransparentProxy(object):
         
         path = (environ.get('SCRIPT_NAME', '')
                 + environ.get('PATH_INFO', ''))
+        path = urllib.quote(path)
         if 'QUERY_STRING' in environ:
             path += '?' + environ['QUERY_STRING']
         conn.request(environ['REQUEST_METHOD'],
diff --git a/paste/request.py b/paste/request.py
index 30b209c..3bbca44 100644
--- a/paste/request.py
+++ b/paste/request.py
@@ -21,6 +21,7 @@ import cgi
 from Cookie import SimpleCookie
 from StringIO import StringIO
 import urlparse
+import urllib
 try:
     from UserDict import DictMixin
 except ImportError:
@@ -213,14 +214,14 @@ def construct_url(environ, with_query_string=True, with_path_info=True,
             url += ':' + environ['SERVER_PORT']
 
     if script_name is None:
-        url += environ.get('SCRIPT_NAME','')
+        url += urllib.quote(environ.get('SCRIPT_NAME',''))
     else:
-        url += script_name
+        url += urllib.quote(script_name)
     if with_path_info:
         if path_info is None:
-            url += environ.get('PATH_INFO','')
+            url += urllib.quote(environ.get('PATH_INFO',''))
         else:
-            url += path_info
+            url += urllib.quote(path_info)
     if with_query_string:
         if querystring is None:
             if environ.get('QUERY_STRING'):