Fix to escape specific param, not the whole string #107

webmin · Oct 17, 2023 · 449b0bf · 449b0bf
1 parent 20f0250
commit 449b0bf
Showing 1 changed file with 2 additions and 2 deletions.
diff --git a/index.cgi b/index.cgi
@@ -62,7 +62,7 @@ elsif ($gconfig{"notabs_${base_remote_user}"} == 2 ||
 		if ($pos % $cols == 0) { print "<tr>\n"; }
 		print "<td valign=top align=center width=$per\%>\n";
 		local $idx = $m->{'index_link'};
-		my $alink = &urlize("$gconfig{'webprefix'}/$m->{'dir'}/$idx");
+		my $alink = "$gconfig{'webprefix'}/@{[&urlize($m->{'dir'})]}/$idx";
 		print "<table border><tr><td><a href='$alink'>",
 		      "<img src=$m->{'dir'}/images/icon.gif border=0 ",
 		      "width=48 height=48></a></td></tr></table>\n";
@@ -148,7 +148,7 @@ else {
 
 		if ($pos % $cols == 0) { print "<tr>\n"; }
 		print "<td valign=top align=center width=$per\%>\n";
-		my $mlink = &urlize("$gconfig{'webprefix'}/$m->{'dir'}/");
+		my $mlink = "$gconfig{'webprefix'}/@{[&urlize($m->{'dir'})]}/";
 		print "<table border bgcolor=#ffffff><tr><td><a href='$mlink'>",
 		      "<img src=$m->{'dir'}/images/icon.gif alt=\"\" border=0></a>",
 		      "</td></tr></table>\n";