===================================================================
RCS file: /cvs/mandoc/cgi.c,v
retrieving revision 1.117
retrieving revision 1.120
diff -u -p -r1.117 -r1.120
--- mandoc/cgi.c	2016/03/17 21:22:59	1.117
+++ mandoc/cgi.c	2016/04/13 15:38:45	1.120
@@ -1,7 +1,7 @@
-/*	$Id: cgi.c,v 1.117 2016/03/17 21:22:59 schwarze Exp $ */
+/*	$Id: cgi.c,v 1.120 2016/04/13 15:38:45 schwarze Exp $ */
 /*
  * Copyright (c) 2011, 2012 Kristaps Dzonsons <kristaps@bsd.lv>
- * Copyright (c) 2014, 2015 Ingo Schwarze <schwarze@usta.de>
+ * Copyright (c) 2014, 2015, 2016 Ingo Schwarze <schwarze@usta.de>
  *
  * Permission to use, copy, modify, and distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -84,7 +84,7 @@ static	int		 validate_filename(const char *);
 static	int		 validate_manpath(const struct req *, const char *);
 static	int		 validate_urifrag(const char *);
 
-static	const char	 *scriptname; /* CGI script name */
+static	const char	 *scriptname = SCRIPT_NAME;
 
 static	const int sec_prios[] = {1, 4, 5, 8, 6, 3, 7, 2, 9};
 static	const char *const sec_numbers[] = {
@@ -370,7 +370,7 @@ resp_searchform(const struct req *req)
 
 	puts("<!-- Begin search form. //-->");
 	printf("<DIV ID=\"mancgi\">\n"
-	       "<FORM ACTION=\"%s\" METHOD=\"get\">\n"
+	       "<FORM ACTION=\"/%s\" METHOD=\"get\">\n"
 	       "<FIELDSET>\n"
 	       "<LEGEND>Manual Page Search Parameters</LEGEND>\n",
 	       scriptname);
@@ -507,12 +507,13 @@ pg_index(const struct req *req)
 	resp_searchform(req);
 	printf("<P>\n"
 	       "This web interface is documented in the\n"
-	       "<A HREF=\"%s/mandoc/man8/man.cgi.8\">man.cgi</A>\n"
+	       "<A HREF=\"/%s%smandoc/man8/man.cgi.8\">man.cgi</A>\n"
 	       "manual, and the\n"
-	       "<A HREF=\"%s/mandoc/man1/apropos.1\">apropos</A>\n"
+	       "<A HREF=\"/%s%smandoc/man1/apropos.1\">apropos</A>\n"
 	       "manual explains the query syntax.\n"
 	       "</P>\n",
-	       scriptname, scriptname);
+	       scriptname, *scriptname == '\0' ? "" : "/",
+	       scriptname, *scriptname == '\0' ? "" : "/");
 	resp_end_html();
 }
 
@@ -536,7 +537,7 @@ pg_error_badrequest(const char *msg)
 	     "<P>\n");
 	puts(msg);
 	printf("Try again from the\n"
-	       "<A HREF=\"%s\">main page</A>.\n"
+	       "<A HREF=\"/%s\">main page</A>.\n"
 	       "</P>", scriptname);
 	resp_end_html();
 }
@@ -553,10 +554,10 @@ static void
 pg_searchres(const struct req *req, struct manpage *r, size_t sz)
 {
 	char		*arch, *archend;
-	size_t		 i, iuse, isec;
+	const char	*sec;
+	size_t		 i, iuse;
 	int		 archprio, archpriouse;
 	int		 prio, priouse;
-	char		 sec;
 
 	for (i = 0; i < sz; i++) {
 		if (validate_filename(r[i].file))
@@ -573,8 +574,10 @@ pg_searchres(const struct req *req, struct manpage *r,
 		 * without any delay.
 		 */
 		printf("Status: 303 See Other\r\n");
-		printf("Location: http://%s%s/%s/%s",
-		    HTTP_HOST, scriptname, req->q.manpath, r[0].file);
+		printf("Location: http://%s/%s%s%s/%s",
+		    HTTP_HOST, scriptname,
+		    *scriptname == '\0' ? "" : "/",
+		    req->q.manpath, r[0].file);
 		printf("\r\n"
 		     "Content-Type: text/html; charset=utf-8\r\n"
 		     "\r\n");
@@ -589,8 +592,9 @@ pg_searchres(const struct req *req, struct manpage *r,
 	for (i = 0; i < sz; i++) {
 		printf("<TR>\n"
 		       "<TD CLASS=\"title\">\n"
-		       "<A HREF=\"%s/%s/%s",
-		    scriptname, req->q.manpath, r[i].file);
+		       "<A HREF=\"/%s%s%s/%s",
+		    scriptname, *scriptname == '\0' ? "" : "/",
+		    req->q.manpath, r[i].file);
 		printf("\">");
 		html_print(r[i].names);
 		printf("</A>\n"
@@ -612,20 +616,22 @@ pg_searchres(const struct req *req, struct manpage *r,
 	if (req->q.equal) {
 		puts("<HR>");
 		iuse = 0;
-		priouse = 10;
+		priouse = 20;
 		archpriouse = 3;
 		for (i = 0; i < sz; i++) {
-			isec = strcspn(r[i].file, "123456789");
-			sec = r[i].file[isec];
-			if ('\0' == sec)
+			sec = r[i].file;
+			sec += strcspn(sec, "123456789");
+			if (sec[0] == '\0')
 				continue;
-			prio = sec_prios[sec - '1'];
-			if (NULL == req->q.arch) {
+			prio = sec_prios[sec[0] - '1'];
+			if (sec[1] != '/')
+				prio += 10;
+			if (req->q.arch == NULL) {
 				archprio =
-				    (NULL == (arch = strchr(
-					r[i].file + isec, '/'))) ? 3 :
-				    (NULL == (archend = strchr(
-					arch + 1, '/'))) ? 0 :
+				    ((arch = strchr(sec + 1, '/'))
+					== NULL) ? 3 :
+				    ((archend = strchr(arch + 1, '/'))
+					== NULL) ? 0 :
 				    strncmp(arch, "amd64/",
 					archend - arch) ? 2 : 1;
 				if (archprio < archpriouse) {
@@ -808,7 +814,7 @@ format(const struct req *req, const char *file)
 	memset(&conf, 0, sizeof(conf));
 	conf.fragment = 1;
 	usepath = strcmp(req->q.manpath, req->p[0]);
-	mandoc_asprintf(&conf.man, "%s?query=%%N&sec=%%S%s%s%s%s",
+	mandoc_asprintf(&conf.man, "/%s?query=%%N&sec=%%S%s%s%s%s",
 	    scriptname,
 	    req->q.arch	? "&arch="       : "",
 	    req->q.arch	? req->q.arch    : "",
@@ -1006,18 +1012,6 @@ main(void)
 		return EXIT_FAILURE;
 	}
 
-	/* Scan our run-time environment. */
-
-	if (NULL == (scriptname = getenv("SCRIPT_NAME")))
-		scriptname = "";
-
-	if ( ! validate_urifrag(scriptname)) {
-		fprintf(stderr, "unsafe SCRIPT_NAME \"%s\"\n",
-		    scriptname);
-		pg_error_internal();
-		return EXIT_FAILURE;
-	}
-
 	/*
 	 * First we change directory into the MAN_DIR so that
 	 * subsequent scanning for manpath directories is rooted
@@ -1032,6 +1026,7 @@ main(void)
 	}
 
 	memset(&req, 0, sizeof(struct req));
+	req.q.equal = 1;
 	pathgen(&req);
 
 	/* Parse the path info and the query string. */