Re: [PyCS-devel] bug in medusa that creates problems for both pycs and pyds (functionality bug, not security bug!)

[Phillip P. <pp...@my...>]

> > IMHO this should become:
> >
> >             if '%' in uri:
> >                 path, qs = urllib.splitquery(uri)
> >                 url = unquote(path) + qs
> 
> Hmm. It's in line 469ff - there is actually "request" in the code, nur
> "uri" - are you using an older/newer version than 0.5.3?

I'm running the latest CVS version:

http://cvs.sourceforge.net/cgi-bin/viewcvs.cgi/oedipus/medusa/http_server.py?rev=1.10&content-type=text/vnd.viewcvs-markup

Looks like request is 'GET /foo/bar/... HTTP/1.1' and uri is just the
URI part of that.  The latest change (2 months old) was to move the
unquoting down a bit in the code so it only unquoted uri, not request,
fixing part of the problem (URLs with spaces ended up decoding totally
wrongly) but not all of it (thus our difficulty now).

> path, qs = urllib.splitquery(request)
> if '%' in path:
>    request = unquote(path) + qs
> 
> So we don't unquote if there is only quoting in the query? This should fix
> the problem, I think. If Id idn't overlook some problem, that is ...

Yeah.  Not that it makes much of a difference; if s doesn't have any
'%'s, unquote(s) should IMHO equal s anyway ...

Shall we forward this to AMK?

Cheers,
Phil :)