From bbaf0d141feeeee92f168cf2ae6a54ee56eff782 Mon Sep 17 00:00:00 2001
From: Jeff Parsons <Jeff@pcjs.org>
Date: Mon, 12 Sep 2016 16:38:55 -0700
Subject: [PATCH] Fixed the encoding of URIs containing escape sequences (eg,
 "%20")

---
 modules/shared/lib/netlib.js | 14 ++++++++++----
 pubs/README.md               |  1 +
 2 files changed, 11 insertions(+), 4 deletions(-)

diff --git a/modules/shared/lib/netlib.js b/modules/shared/lib/netlib.js
index 7c64af090..560c3a747 100644
--- a/modules/shared/lib/netlib.js
+++ b/modules/shared/lib/netlib.js
@@ -136,12 +136,13 @@ net.propagateParms = function(sURL, req)
 /**
  * encodeURL(sURL, req, fDebug)
  *
- * Used to encodes any URLs presented on the current page, using this 3-step (um, 4-step) process:
+ * Used to encodes any URLs presented on the current page, using this, um, simple 5-step process:
  *
  *  1) Replace any backslashes with slashes, in case the URL was derived from a file system path
  *  2) Remap links that begin with "archive/" to the corresponding URL at "http://archive.pcjs.org/"
- *  3) Transform any "htmlspecialchars" into the corresponding entities, using encodeURI()
- *  4) Massage the result with net.propagateParms(), so that any special parameters are passed along
+ *  3) Use decodeURI() to eliminate escape sequences (like "%20") so that encodeURI() won't re-encode the "%"
+ *  4) Use encodeURI() to transform all "htmlspecialchars" and reserved characters into the appropriate sequences
+ *  5) Massage the result with net.propagateParms(), so that any special parameters are passed along
  *
  * @param {string} sURL
  * @param {Object} req is the web server's (ie, Express) request object, if any
@@ -158,7 +159,12 @@ net.encodeURL = function(sURL, req, fDebug)
                 sURL = "http://archive.pcjs.org" + sURL.replace("/archive/", "/");
             }
         }
-        return net.propagateParms(encodeURI(sURL), req);
+        /*
+         * If the incoming URL already contains URI-style escape sequences (eg, "%20" instead of spaces),
+         * calling decodeURI() first will eliminate them, preventing encodeURI() from converting leading
+         * "%" into "%25" and corrupting sequences like "%20" by turning them into "%2520".
+         */
+        return net.propagateParms(encodeURI(decodeURI(sURL)), req);
     }
     return sURL;
 };
diff --git a/pubs/README.md b/pubs/README.md
index 90bbcf3fe..5478ffc11 100644
--- a/pubs/README.md
+++ b/pubs/README.md
@@ -24,6 +24,7 @@ Ohio Scientific's 6502-based [Challenger 1P Publications](/pubs/c1p/):
 
 [Digital Equipment Corporation (DEC) Publications](/pubs/dec/):
 
+* [PDP-11](/pubs/dec/pdp11/)
 * [VT100](/pubs/dec/vt100/)
 
 [<img src="http://archive.pcjs.org/pubs/pc/datasheets/thumbs/8088-CPU.jpg" width="200" height="260" alt= "8088 CPU"/>](pc/datasheets/)