[Gnump3d-users] Single quotes in file names

[Matti Somppi]

Hi,

Thanks for the great work on gnump3d. It makes my day every day at work. ;)

However, I noticed that if the directory name or the file name
contains a single quote ( ' ), the server just sends an empty file. At
least in my setup (the latest CVS version) the server responds with
200, but does not serve the file (or actually serves an empty file it
seems).

I'm not that familiar with Perl (I usually code with C), but I tried
to review the code a bit and noticed I get this problem fixed by
changing the line 1737 in gnump3d to

      $safeFile    = "\"" . $file . "\"";.

instead of

      $safeFile    = "'" . $file . "'";

I also noticed that the links in most recent tracks were broken if the
file names contained single quotes. I managed to fix this by changing
the line 154 in recent.pm to

    $text .= "<tr><td>$host</td><td><a
href=\"/$2$suffix\">$disp</a></td></tr>\n";

instead of

    $text .= "<tr><td>$host</td><td><a href='/$2$suffix'>$disp</a></td></tr>\n";

After some quick testing I did not find anything that was broken after
these fixes. Maybe somebody more familiar with the code could verify
that this is okay to do (or find another way to fix this thing) and
get the problem fixed in the next release.

Thanks,
-- 
//matti