From 41f19dc714ef2d4aa2fe25306ea6b1a21fb033bd Mon Sep 17 00:00:00 2001
From: bergware <bergware@users.noreply.github.com>
Date: Fri, 24 Dec 2021 11:37:11 +0100
Subject: [PATCH] Fix URL encoding

---
 plugins/dynamix/Browse.page        |  2 +-
 plugins/dynamix/include/Browse.php | 16 +++++++++-------
 2 files changed, 10 insertions(+), 8 deletions(-)

diff --git a/plugins/dynamix/Browse.page b/plugins/dynamix/Browse.page
index 4dadbd6fe..47e4d226e 100644
--- a/plugins/dynamix/Browse.page
+++ b/plugins/dynamix/Browse.page
@@ -25,7 +25,7 @@ $user = ($root=='mnt' && ($main=='user'|| $main=='user0')) ? 1 : 0;
 <script>
 $(function(){
   timers.browse = setTimeout(function(){$('div.spinner.fixed').show('slow');},500);
-  $.get('/webGui/include/Browse.php',{dir:"<?=addslashes(urlencode($dir))?>",path:"<?=$path?>",user:<?=$user?>},function(data){
+  $.get('/webGui/include/Browse.php',{dir:encodeURIComponent("<?=$dir?>"),path:"<?=$path?>",user:<?=$user?>},function(data){
     clearTimeout(timers.browse);
     var table = $('table.indexer');
     var col = $.cookie('col')||1;
diff --git a/plugins/dynamix/include/Browse.php b/plugins/dynamix/include/Browse.php
index 1500cdd2f..ede38c0c5 100644
--- a/plugins/dynamix/include/Browse.php
+++ b/plugins/dynamix/include/Browse.php
@@ -20,7 +20,7 @@ require_once "$docroot/webGui/include/Helpers.php";
 
 function parent_link() {
   global $dir,$path;
-  return ($dir && dirname($dir)!='/' && dirname($dir)!='/mnt' && dirname($dir)!='/mnt/user') ? "<a href=\"/$path?dir=".htmlspecialchars(urlencode_path(dirname($dir)))."\">Parent Directory</a>" : "";
+  return ($dir && dirname($dir)!='/' && dirname($dir)!='/mnt' && dirname($dir)!='/mnt/user') ? "<a href=\"/$path?dir=".rawurlencode(dirname($dir))."\">Parent Directory</a>" : "";
 }
 function trim_slash($url){
   return preg_replace('://+:','/',$url);
@@ -67,13 +67,14 @@ if ($link = parent_link()) echo "<tbody class='tablesorter-infoOnly'><tr><td><di
 
 echo "<tbody>";
 foreach ($dirs as $row) {
-  [$type,$name,$size,$time,$set] = my_explode('|',$row,5);
-  $file = pathinfo($name);
+  [$type,$full,$size,$time,$set] = my_explode('|',$row,5);
+  $file = pathinfo($full);
+  $full = str_replace($docroot,'',$full);
   $name = $file['basename'];
   $devs = explode(',',$set);
   echo "<tr>";
   echo "<td data=''><div class='icon-dir'></div></td>";
-  echo "<td><a href=\"/$path?dir=".htmlspecialchars(urlencode_path(trim_slash("$dir/$name")))."\">".htmlspecialchars($name)."</a></td>";
+  echo "<td><a href=\"/$path?dir=".rawurlencode($full)."\">".htmlspecialchars($name)."</a></td>";
   echo "<td data='0'>&lt;FOLDER&gt;</td>";
   echo "<td data='$time'>".my_time($time,$fmt)."</td>";
   echo "<td class='loc'>".my_devs($devs)."</td>";
@@ -81,15 +82,16 @@ foreach ($dirs as $row) {
 }
 if (count($dirs)) echo "</tbody><tbody>";
 foreach ($files as $row) {
-  [$type,$name,$size,$time,$set] = my_explode('|',$row,5);
-  $file = pathinfo($name);
+  [$type,$full,$size,$time,$set] = my_explode('|',$row,5);
+  $file = pathinfo($full);
+  $full = str_replace($docroot,'',$full);
   $name = $file['basename'];
   $ext  = strtolower($file['extension']);
   $devs = explode(',',$set);
   $tag  = strpos($set,',')===false ? '' : 'warning';
   echo "<tr>";
   echo "<td data='$ext'><div class='icon-file icon-$ext'></div></td>";
-  echo "<td><a href=\"".htmlspecialchars(trim_slash("$dir/$name"))."\" download target=\"_blank\" class=\"".($tag?:'none')."\">".htmlspecialchars($name)."</a></td>";
+  echo "<td><a href=\"".htmlspecialchars($full)."\" download target=\"_blank\" class=\"".($tag?:'none')."\">".htmlspecialchars($name)."</a></td>";
   echo "<td data='$size' class='$tag'>".my_scale($size,$unit)." $unit</td>";
   echo "<td data='$time' class='$tag'>".my_time($time,$fmt)."</td>";
   echo "<td class='loc $tag'>".my_devs($devs)."</td>";