From ea8659f141fd14165af05bd9cd06bf95919447f2 Mon Sep 17 00:00:00 2001
From: Erich Eckner <git@eckner.net>
Date: Wed, 20 Mar 2019 15:52:50 +0100
Subject: init.php: do not try to decode %## - it should never appear in valid
 queries - simply delete it

---
 init.php | 37 +++++++++++++++++++------------------
 1 file changed, 19 insertions(+), 18 deletions(-)

diff --git a/init.php b/init.php
index 993723e..3ea1c4d 100644
--- a/init.php
+++ b/init.php
@@ -1,31 +1,32 @@
 <?php
 define("BASE", __DIR__);
 
-$old = '';
-while ($old != $_SERVER['QUERY_STRING']) {
-  $old = $_SERVER['QUERY_STRING'];
-  $_SERVER['QUERY_STRING'] = urldecode($_SERVER['QUERY_STRING']);
-}
 $_SERVER['QUERY_STRING'] =
   str_replace('&amp;', '&',
-    htmlspecialchars($_SERVER['QUERY_STRING'])
+    htmlspecialchars(
+      preg_replace(
+        '/%.?.?/', '',
+        $_SERVER['QUERY_STRING']
+      )
+    )
   );
 
-$old = '';
-while ($old != $_SERVER['REQUEST_URI']) {
-  $old = $_SERVER['REQUEST_URI'];
-  $_SERVER['REQUEST_URI'] = urldecode($_SERVER['REQUEST_URI']);
-}
 $_SERVER['REQUEST_URI'] =
   str_replace('&amp;', '&',
-    htmlspecialchars($_SERVER['REQUEST_URI'])
+    htmlspecialchars(
+      preg_replace(
+        '/%.?.?/', '',
+        $_SERVER['REQUEST_URI']
+      )
+    )
   );
 
 foreach ($_GET as $key => $val) {
-  $old = '';
-  while ($old != $_GET[$key]) {
-    $old = $_GET[$key];
-    $_GET[$key] = urldecode($_GET[$key]);
-  }
-  $_GET[$key] = htmlspecialchars($_GET[$key]);
+  $_GET[$key] =
+    htmlspecialchars(
+      preg_replace(
+        '/%.?.?/', '',
+        $_GET[$key]
+      )
+    );
 }
-- 
cgit v1.2.3