===================================================================
RCS file: /cvs/cvsweb/cvsweb.cgi,v
retrieving revision 1.1.1.18
retrieving revision 1.1.1.25
diff -u -p -r1.1.1.18 -r1.1.1.25
--- cvsweb/cvsweb.cgi	2001/01/01 23:55:44	1.1.1.18
+++ cvsweb/cvsweb.cgi	2001/05/07 17:19:27	1.1.1.25
@@ -1,4 +1,4 @@
-#!/usr/bin/perl5 -ws
+#!/usr/bin/perl -wT
 #
 # cvsweb - a CGI interface to CVS trees.
 #
@@ -18,7 +18,7 @@
 # Copyright (c) 1996-1998 Bill Fenner
 #           (c) 1998-1999 Henner Zeller
 #	    (c) 1999      Henrik Nordstrom
-#	    (c) 2000      Akinori MUSHA
+#	    (c) 2000-2001 Akinori MUSHA
 # All rights reserved.
 #
 # Redistribution and use in source and binary forms, with or without
@@ -42,16 +42,20 @@
 # OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 # SUCH DAMAGE.
 #
-# $zId: cvsweb.cgi,v 1.104 2000/11/01 22:05:12 hnordstrom Exp $
-# $kId: cvsweb.cgi,v 1.54 2001/01/01 23:15:02 knu Exp $
+# $zId: cvsweb.cgi,v 1.106 2001/03/10 01:16:27 hnordstrom Exp $
+# $Idaemons: /home/cvs/cvsweb/cvsweb.cgi,v 1.71 2001/05/07 17:13:42 knu Exp $
 #
 ###
 
+require 5.000;
+
 use strict;
 
 use vars qw (
-    $config $allow_version_select $verbose
-    %CVSROOT %CVSROOTdescr %MIRRORS %DEFAULTVALUE %ICONS %MTYPES
+    $cvsweb_revision
+    $mydir $uname $config $allow_version_select $verbose
+    @CVSrepositories @CVSROOT %CVSROOT %CVSROOTdescr
+    %MIRRORS %DEFAULTVALUE %ICONS %MTYPES
     @DIFFTYPES %DIFFTYPES @LOGSORTKEYS %LOGSORTKEYS
     %alltags @tabcolors %fileinfo %tags @branchnames %nameprinted
     %symrev %revsym @allrevisions %date %author @revdisplayorder
@@ -64,7 +68,8 @@ use vars qw (
     %input $query $barequery $sortby $bydate $byrev $byauthor
     $bylog $byfile $defaultDiffType $logsort $cvstree $cvsroot
     $mimetype $charset $defaultTextPlain $defaultViewable
-    $allow_compress $GZIPBIN $backicon $diricon $fileicon
+    $command_path %CMD $allow_compress
+    $backicon $diricon $fileicon
     $fullname $newname $cvstreedefault
     $body_tag $body_tag_for_src $logo $defaulttitle $address
     $long_intro $short_instruction $shortLogLen
@@ -79,7 +84,8 @@ use vars qw (
     $navigationHeaderColor $tableBorderColor $markupLogColor
     $tabstop $state $annTable $sel $curbranch @HideModules
     $module $use_descriptions %descriptions @mytz $dwhere $moddate
-    $use_moddate $has_zlib $gzip_open $allow_tar @tar_options @cvs_options
+    $use_moddate $has_zlib $gzip_open
+    $allow_tar @tar_options @gzip_options @cvs_options
     $LOG_FILESEPARATOR $LOG_REVSEPARATOR
 );
 
@@ -95,6 +101,7 @@ sub revcmp($$);
 sub fatal($$);
 sub redirect($);
 sub safeglob($);
+sub search_path($);
 sub getMimeTypeFromSuffix($);
 sub head($;$);
 sub scan_directives(@);
@@ -130,16 +137,26 @@ sub link_tags($);
 sub forbidden_module($);
 
 ##### Start of Configuration Area ########
-use Cwd;
+delete $ENV{PATH};
 
+$cvsweb_revision = '1.106' . '.' . (split(/ /,
+ q$Idaemons: /home/cvs/cvsweb/cvsweb.cgi,v 1.71 2001/05/07 17:13:42 knu Exp $
+))[2];
+
+use File::Basename;
+
+($mydir) = (dirname($0) =~ /(.*)/); # untaint
+
 # == EDIT this ==
 # Locations to search for user configuration, in order:
 for (
-     $ENV{CVSWEB_CONFIG},
-     '/usr/local/etc/cvsweb.conf',
-     getcwd() . '/cvsweb.conf'
+     "$mydir/cvsweb.conf",
+     '/usr/local/etc/cvsweb/cvsweb.conf'
     ) {
-    $config = $_ if defined($_) && -r $_;
+    if (defined($_) && -r $_) {
+	$config = $_;
+	last;
+    }
 }
 
 # == Configuration defaults ==
@@ -151,7 +168,8 @@ $allow_version_select = 1;
 
 ######## Configuration variables #########
 # These are defined to allow checking with perl -cw
-%CVSROOT = %MIRRORS = %DEFAULTVALUE = %ICONS = %MTYPES =
+@CVSrepositories = @CVSROOT = %CVSROOT =
+%MIRRORS = %DEFAULTVALUE = %ICONS = %MTYPES =
 %tags = %alltags = @tabcolors = ();
 $cvstreedefault = $body_tag = $body_tag_for_src =
 $logo = $defaulttitle = $address =
@@ -229,18 +247,23 @@ $verbose = $v;
 $checkoutMagic = "~checkout~";
 $pathinfo = defined($ENV{PATH_INFO}) ? $ENV{PATH_INFO} : '';
 $where = $pathinfo;
-$where =~ tr|/|/|s;
-$doCheckout = ($where =~ /^\/$checkoutMagic/);
-$where =~ s|^/($checkoutMagic)?||;
-$where =~ s|/$||;
+$doCheckout = ($where =~ m|^/$checkoutMagic/|);
+$where =~ s|^/$checkoutMagic/|/|;
+$where =~ s|^/||;
 $scriptname = defined($ENV{SCRIPT_NAME}) ? $ENV{SCRIPT_NAME} : '';
-$scriptname =~ s|^/?|/|;
-$scriptname =~ s|/+$||;
-$scriptwhere = $scriptname;
-if ($where) {
-    $scriptwhere .= '/' . urlencode($where);
+$scriptname =~ s|^/*|/|;
+
+# Let's workaround thttpd's stupidity..
+if ($scriptname =~ m|/$|) {
+    $pathinfo .= '/';
+    my $re = quotemeta $pathinfo;
+    $scriptname =~ s/$re$//;
 }
 
+$scriptwhere = $scriptname;
+$scriptwhere .= '/' . urlencode($where);
+$where = '/' if ($where eq '');
+
 $is_mod_perl = defined($ENV{MOD_PERL});
 
 # in lynx, it it very annoying to have two links
@@ -286,9 +309,7 @@ if (-f $config) {
 } else {
    &fatal("500 Internal Error",
 	  'Configuration not found.  Set the variable <code>$config</code> '
-          . 'in cvsweb.cgi, or the environment variable '
-          . '<code>CVSWEB_CONFIG</code>, to your <b>cvsweb.conf</b> '
-          . 'configuration file first.');
+          . 'in cvsweb.cgi to your <b>cvsweb.conf</b> configuration file first.');
 }
 
 undef %input;
@@ -355,6 +376,10 @@ else {
 }
 undef @barequery;
 
+if (defined($input{path})) {
+    redirect("$scriptname/$input{path}$query");
+}
+
 # get actual parameters
 $sortby = $input{"sortby"};
 $bydate = 0;
@@ -382,7 +407,22 @@ $defaultDiffType = $input{'f'};
 
 $logsort = $input{'logsort'};
 
+my @tmp = @CVSrepositories;
+my @pair;
 
+while (@pair = splice(@tmp, 0, 2)) {
+    my($key, $val) = @pair;
+    my($descr, $cvsroot) = @$val;
+
+    next if !-d $cvsroot;
+
+    $CVSROOTdescr{$key} = $descr;
+    $CVSROOT{$key} = $cvsroot;
+    push @CVSROOT, $key;
+}
+undef @tmp;
+undef @pair;
+
 ## Default CVS-Tree
 if (!defined($CVSROOT{$cvstreedefault})) {
    &fatal("500 Internal Error",
@@ -435,34 +475,29 @@ $mimetype = &getMimeTypeFromSuffix ($fullname);
 $defaultTextPlain = ($mimetype eq "text/plain");
 $defaultViewable = $allow_markup && viewable($mimetype);
 
-# search for GZIP if compression allowed
-# We've to find out if the GZIP-binary exists .. otherwise
-# ge get an Internal Server Error if we try to pipe the
-# output through the nonexistent gzip ..
-# any more elegant ways to prevent this are welcome!
-if ($allow_compress && $maycompress && !$has_zlib) {
-    foreach (split(/:/, $ENV{PATH})) {
-	if (-x "$_/gzip") {
-	    $GZIPBIN = "$_/gzip";
-	    last;
-	}
-    }
+my $rewrite = 0;
+
+if ($pathinfo =~ m|//|) {
+    $pathinfo =~ y|/|/|s;
+    $rewrite = 1;
 }
 
-if (-d $fullname) {
-    #
-    # ensure, that directories always end with (exactly) one '/'
-    # to allow relative URL's. If they're not, make a redirect.
-    ##
-    if (!($pathinfo =~ m|/$|) || ($pathinfo =~ m |/{2,}$|)) {
-	redirect ($scriptwhere . '/' . $query);
-    }
-    else {
-	$where .= '/';
-	$scriptwhere .= '/';
-    }
+if (-d $fullname && $pathinfo !~ m|/$|) {
+    $pathinfo .= '/';
+    $rewrite = 1;
 }
 
+if (!-d $fullname && $pathinfo =~ m|/$|) {
+    chop $pathinfo;
+    $rewrite = 1;
+}
+
+if ($rewrite) {
+    redirect($scriptname . urlencode($pathinfo) . $query);
+}
+
+undef $rewrite;
+
 if (!-d $cvsroot) {
     &fatal("500 Internal Error",'$CVSROOT not found!<P>The server on which the CVS tree lives is probably down.  Please try again in a few minutes.');
 }
@@ -482,11 +517,11 @@ if ($module && &forbidden_module($module)) {
 if ($input{tarball}) {
     &fatal("403 Forbidden", "Downloading tarballs is prohibited.")
       unless $allow_tar;
-    $where =~ s,/[^/]*$,,;
-    $where =~ s,^/,,;
-    my($basedir) = ($where =~ m,([^/]+)$,);
+    my($module) = ($where =~ m,^/?(.*),);	# untaint
+    $module =~ s,/[^/]*$,,;
+    my($basedir) = ($module =~ m,([^/]+)$,);
 
-    if ($basedir eq '' || $where eq '') {
+    if ($basedir eq '' || $module eq '') {
 	&fatal("500 Internal Error", "You cannot download the top level directory.");
     }
 
@@ -497,36 +532,26 @@ if ($input{tarball}) {
 
     my $fatal = '';
 
-    do {
-	chdir $tmpdir
-	  or $fatal = "500 Internal Error", "Unable to cd to temporary directory: $!"
-	    && last;
-
+    while (1) {
 	my $tag = (exists $input{only_with_tag} && length $input{only_with_tag})
 	  ? $input{only_with_tag} : "HEAD";
 
-	system "cvs", @cvs_options, "-Qd", $cvsroot, "export", "-r", $tag, $where
-	  and $fatal = "500 Internal Error","cvs co failure: $!: $where"
+	system $CMD{cvs}, @cvs_options, '-Qd', $cvsroot, 'export', '-r', $tag, '-d', "$tmpdir/$basedir", $module
+	  and $fatal = "500 Internal Error","cvs co failure: $!: $module"
 	    && last;
 
-	chdir "$where/.."
-	  or $fatal = "500 Internal Error","Cannot find expected directory in checkout"
-	    && last;
-
 	$| = 1; # Essential to get the buffering right.
 
 	print "Content-type: application/x-gzip\r\n\r\n";
 
-	system "tar", "-zcf", "-", $basedir, @tar_options
+	system "$CMD{tar} @tar_options -cf - -C $tmpdir $basedir | $CMD{gzip} @gzip_options -c"
 	  and $fatal = "500 Internal Error","tar zc failure: $!: $basedir"
 	    && last;
 
-	chdir $tmpdir
-	  or $fatal = "500 Internal Error","Unable to cd to temporary directory: $!"
-	    && last;
-    } while (0);
+	last;
+    }
 
-    system "rm", "-rf", $tmpdir if -d $tmpdir;
+    system $CMD{rm}, '-rf', $tmpdir if -d $tmpdir;
 
     &fatal($fatal) if $fatal;
 
@@ -711,7 +736,8 @@ if (-d $fullname) {
 
 	    if ($_ eq '..' || -d "$fullname/$_") {
 		next if ($_ eq '..' && $where eq '/');
-		my ($rev,$date,$log,$author,$filename) = @{$fileinfo{$_}}
+		my ($rev,$date,$log,$author,$filename);
+		($rev,$date,$log,$author,$filename) = @{$fileinfo{$_}}
 		    if (defined($fileinfo{$_}));
 		printf '<tr bgcolor="%s"><td>', $tabcolors[$dirrow % 2] if $dirtable;
 		if ($_ eq '..') {
@@ -725,7 +751,7 @@ if (-d $fullname) {
 		    print " ", &link("Previous Directory", $url);
 		}
 		else {
-		    $url = urlencode($_) . "/$query";
+		    $url = './' . urlencode($_) . "/$query";
 		    print "<A NAME=\"$_\"></A>";
 		    if ($nofilelinks) {
 			print $diricon;
@@ -788,7 +814,7 @@ if (-d $fullname) {
 	    }
 	    elsif (s/,v$//) {
 		$fileurl = ($attic ? "Attic/" : "") . urlencode($_);
-		$url = $fileurl . $query;
+		$url = './' . $fileurl . $query;
 		my $rev = '';
 		my $date = '';
 		my $log = '';
@@ -871,6 +897,8 @@ if (-d $fullname) {
 		       ">$tag\n";
 	    }
 	    print "</SELECT>\n";
+	    print " Module path or alias:\n";
+	    printf "<INPUT TYPE=TEXT NAME=\"path\" VALUE=\"%s\" SIZE=15>\n", htmlquote($where);
 	    print "<INPUT TYPE=SUBMIT VALUE=\"Go\">\n";
 	    print "</FORM>\n";
 	}
@@ -878,13 +906,13 @@ if (-d $fullname) {
 	if ($allow_tar) {
 	    my($basefile) = ($where =~ m,(?:.*/)?([^/]+),);
 
-	    if ($basefile ne '') {
+	    if (defined($basefile) && $basefile ne '') {
 		print "<HR NOSHADE>\n",
 		  "<DIV align=center>",
 		    &link("Download this directory in tarball",
 			  # Mangle the filename so browsers show a reasonable
 			  # filename to download.
-			  "$basefile.tar.gz$query".
+			  "./$basefile.tar.gz$query".
 			  ($query ? "&" : "?")."tarball=1"),
 			    "</DIV>";
 	    }
@@ -973,7 +1001,7 @@ if (-d $fullname) {
 	# The file has been removed and is in the Attic.
 	# Send a redirect pointing to the file in the Attic.
 	(my $newplace = $scriptwhere) =~ s|/([^/]+)$|/Attic/$1|;
-	&redirect($newplace);
+	redirect("$newplace$query");
 	exit;
     }
     elsif (0 && (my @files = &safeglob($fullname . ",v"))) {
@@ -989,11 +1017,11 @@ if (-d $fullname) {
 	# Assume it's a module name with a potential path following it.
 	$xtra = (($module = $where) =~ s|/.*||) ? $& : '';
 	# Is there an indexed version of modules?
-	if (open($fh, "$cvsroot/CVSROOT/modules")) {
+	if (open($fh, "< $cvsroot/CVSROOT/modules")) {
 	    while (<$fh>) {
 		if (/^(\S+)\s+(\S+)/o && $module eq $1
 		    && -d "$cvsroot/$2" && $module ne $2) {
-		    &redirect("$scriptname/$2$xtra");
+		    redirect("$scriptname/$2$xtra$query");
 		}
 	    }
 	}
@@ -1196,9 +1224,11 @@ sub spacedHtmlText($;$) {
 }
 
 sub link($$) {
-	my($name, $where) = @_;
+	my($name, $url) = @_;
 
-	sprintf '<A HREF="%s">%s</A>', hrefquote($where), $name;
+	$url =~ s/:/sprintf("%%%02x", ord($&))/eg if $url =~ /^[^a-z]/;	# relative
+
+	sprintf '<A HREF="%s">%s</A>', hrefquote($url), $name;
 }
 
 sub revcmp($$) {
@@ -1275,11 +1305,23 @@ sub safeglob($) {
 				push(@results, "$dirname/" .$_);
 			}
 		}
+ 		closedir($dh);
 	}
 
 	@results;
 }
 
+sub search_path($) {
+    my($command) = @_;
+    my $d;
+
+    for $d (split(/:/, $command_path)) {
+	return "$d/$command" if -x "$d/$command";
+    }
+
+    $command;
+}
+
 sub getMimeTypeFromSuffix($) {
     my ($fullname) = @_;
     my ($mimetype, $suffix);
@@ -1353,7 +1395,7 @@ sub doAnnotate($$) {
     my $reader = do {local(*FH);};
     my $writer = do {local(*FH);};
 
-    # make sure the revisions a wellformed, for security
+    # make sure the revisions are wellformed, for security
     # reasons ..
     if ($rev =~ /[^\w.]/) {
 	&fatal("404 Not Found",
@@ -1372,8 +1414,8 @@ sub doAnnotate($$) {
     # the public domain.
     # we could abandon the use of rlog, rcsdiff and co using
     # the cvsserver in a similiar way one day (..after rewrite)
-    $pid = open2($reader, $writer, "cvs @cvs_options -l server") || fatal ("500 Internal Error",
-							       "Fatal Error - unable to open cvs for annotation");
+    $pid = open2($reader, $writer, $CMD{cvs}, @cvs_options, "server")
+      || fatal ("500 Internal Error", "Fatal Error - unable to open cvs for annotation");
 
     # OK, first send the request to the server.  A simplified example is:
     #     Root /home/kingdon/zwork/cvsroot
@@ -1564,8 +1606,8 @@ sub doCheckout($$) {
     #
     # Safely for a child process to read from.
     if (! open($fh, "-|")) { # child
-      open(STDERR, ">&STDOUT"); # Redirect stderr to stdout
-      exec("cvs", @cvs_options, "-d", $cvsroot, "co", "-p", $revopt, $where);
+	open(STDERR, ">&STDOUT"); # Redirect stderr to stdout
+	exec($CMD{cvs}, @cvs_options, '-d', $cvsroot, 'co', '-p', $revopt, $where);
     }
 
     if (eof($fh)) {
@@ -1663,7 +1705,11 @@ sub cvswebMarkup($$$) {
 	print "</PRE>";
     }
     else {
-	print "<PLAINTEXT>\n", <$filehandle>;
+	print "<PRE>";
+	while (<$filehandle>) {
+	    print htmlquote($_);
+	}
+	print "</PRE>";
     }
 }
 
@@ -1730,7 +1776,7 @@ sub doDiff($$$$$$) {
 
 	    while (($re1, $re2) = each %funcline_regexp) {
 		if ($fullname =~ /$re1/) {
-		    push @difftype, '-F', '$re2';
+		    push @difftype, '-F', $re2;
 		    last;
 		}
 	    }
@@ -1745,7 +1791,7 @@ sub doDiff($$$$$$) {
 	}
 	if (! open($fh, "-|")) { # child
 	    open(STDERR, ">&STDOUT"); # Redirect stderr to stdout
-	    exec("rcsdiff",@difftype,"-r$rev1","-r$rev2",$fullname);
+	    exec($CMD{rcsdiff}, @difftype, "-r$rev1", "-r$rev2", $fullname);
 	}
 	if ($human_readable) {
 	    http_header();
@@ -1829,15 +1875,14 @@ sub getDirLogs($$@) {
     if (defined($tag)) {
 	#can't use -r<tag> as - is allowed in tagnames, but misinterpreated by rlog..
 	if (! open($fh, "-|")) {
-		open(STDERR, '>/dev/null'); # rlog may complain; ignore.
-		exec('rlog', @files);
+	    open(STDERR, '>/dev/null'); # rlog may complain; ignore.
+	    exec($CMD{rlog}, @files);
 	}
     }
     else {
-    	my $kidpid = open($fh, "-|");
-	if (! $kidpid) {
-		open(STDERR, '>/dev/null'); # rlog may complain; ignore.
-		exec('rlog', '-r', @files);
+	if (! open($fh, "-|")) {
+	    open(STDERR, '>/dev/null'); # rlog may complain; ignore.
+	    exec($CMD{rlog}, '-r', @files);
 	}
     }
     $state = "start";
@@ -1967,7 +2012,7 @@ again:
     }
     if ($. == 0) {
 	fatal("500 Internal Error",
-	      "Failed to spawn GNU rlog on <em>'".join(", ", @files)."'</em><p>did you set the <b>\$ENV{PATH}</b> in your configuration file correctly ?");
+	      "Failed to spawn GNU rlog on <em>'".join(", ", @files)."'</em><p>Did you set the <b>\$command_path</b> in your configuration file correctly ? (Currently '$command_path'");
     }
     close($fh);
 }
@@ -1995,12 +2040,12 @@ sub readLog($;$) {
 
 	print("Going to rlog '$fullname'\n") if ($verbose);
 	if (! open($fh, "-|")) { # child
-		if ($revision ne '') {
-			exec("rlog",$revision,$fullname);
-		}
-		else {
-			exec("rlog",$fullname);
-		}
+	    if ($revision ne '') {
+		exec($CMD{rlog}, $revision, $fullname);
+	    }
+	    else {
+		exec($CMD{rlog}, $fullname);
+	    }
 	}
 	while (<$fh>) {
 	    print if ($verbose);
@@ -2600,8 +2645,8 @@ sub human_readable_diff($){
   print "<br>Tag: $sym2\n" if ($sym1);
   print "</th>\n";
 
-  my $fs = "<font face=\"$difffontface\" size=\"$difffontsize\">";
-  my $fe = "</font>";
+  my $fs = "<font face=\"$difffontface\" size=\"$difffontsize\"><tt>";
+  my $fe = "</tt></font>";
 
   my $leftRow = 0;
   my $rightRow = 0;
@@ -2717,17 +2762,22 @@ sub human_readable_diff($){
 sub navigateHeader($$$$$) {
     my ($swhere,$path,$filename,$rev,$title) = @_;
     $swhere = "" if ($swhere eq $scriptwhere);
-    $swhere = urlencode($filename) if ($swhere eq "");
-    print qq`<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">`;
-    print "<HTML>\n<HEAD>\n";
-    print qq`<META name="robots" content="nofollow">\n`;
-    print '<!-- CVSweb $zRevision: 1.104 $  $kRevision: 1.54 $ -->';
-    print "\n<TITLE>$path$filename - $title - $rev</TITLE></HEAD>\n";
-    print  "$body_tag_for_src\n";
-    print "<table width=\"100%\" border=0 cellspacing=0 cellpadding=1 bgcolor=\"$navigationHeaderColor\">";
-    print "<tr valign=bottom><td>";
+    $swhere = './', urlencode($filename) if ($swhere eq "");
+
+    print <<EOF;
+<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
+<HTML>
+<HEAD>
+<META name="robots" content="nofollow">
+<!-- knu-cvsweb $cvsweb_revision -->
+<TITLE>$path$filename - $title - $rev</TITLE></HEAD>
+$body_tag_for_src
+<table width="100%" border=0 cellspacing=0 cellpadding=1 bgcolor="$navigationHeaderColor">
+<tr valign=bottom><td>
+EOF
+
     print &link($backicon, "$swhere$query#rev$rev");
-    print "</a> <b>Return to ", &link("$filename","$swhere$query#rev$rev")," CVS log";
+    print "<b>Return to ", &link($filename,"$swhere$query#rev$rev")," CVS log";
     print "</b> $fileicon</td>";
 
     print "<td align=right>$diricon <b>Up to ", &clickablePath($path, 1), "</b></td>";
@@ -2835,13 +2885,7 @@ sub clickablePath($$) {
 }
 
 sub chooseCVSRoot() {
-    my @foo;
-    foreach (sort keys %CVSROOT) {
-	if (-d $CVSROOT{$_}) {
-	    push(@foo, $_);
-	}
-    }
-    if (@foo > 1) {
+    if (2 <= @CVSROOT) {
 	my ($k);
 	print "<form method=\"GET\" action=\"${scriptwhere}\">\n";
 	foreach $k (keys %input) {
@@ -2856,19 +2900,26 @@ sub chooseCVSRoot() {
 	print "<td>\n<select name=\"cvsroot\"";
 	print " onchange=\"submit()\"" if ($use_java_script);
 	print ">\n";
-	foreach $k (@foo) {
+	foreach $k (@CVSROOT) {
 	    print "<option value=\"$k\"";
 	    print " selected" if ($k eq $cvstree);
 	    print ">", ($CVSROOTdescr{$k} ? $CVSROOTdescr{$k} : $k), "</option>\n";
 	}
 	print "</select>\n</td>";
-	print "<td><input type=submit value=\"Go\"></td>";
-	print "</tr></table></form>";
+	print "<td>";
     }
     else {
 	# no choice ..
 	print "CVS Root: <b>[$cvstree]</b>";
     }
+
+    print " Module path or alias:\n";
+    print "<INPUT TYPE=TEXT NAME=\"path\" VALUE=\"\" SIZE=15>\n";
+    print "<input type=submit value=\"Go\">";
+
+    if (2 <= @CVSROOT) {
+	print "</td></tr></table></form>";
+    }
 }
 
 sub chooseMirror() {
@@ -2944,6 +2995,8 @@ sub download_link($$$;$) {
     my ($url, $revision, $textlink, $mimetype) = @_;
     my ($fullurl) = download_url($url, $revision, $mimetype);
 
+    $fullurl =~ s/:/sprintf("%%%02x", ord($&))/eg;
+
     printf '<A HREF="%s"', hrefquote("$fullurl$barequery");
 
     if ($open_extern_window && (!defined($mimetype) || $mimetype ne "text/x-cvsweb-markup")) {
@@ -3074,7 +3127,7 @@ sub http_header(;$) {
 	    print "Content-type: $content_type\r\n";
     }
     if ($allow_compress && $maycompress) {
-	if ($has_zlib || (defined($GZIPBIN) && open(GZIP, "|$GZIPBIN -1 -c"))) {
+	if ($has_zlib || (defined($CMD{gzip}) && open(GZIP, "| $CMD{gzip} -1 -c"))) {
 	    if ($is_mod_perl) {
 		    Apache->request->content_encoding("x-gzip");
 		    Apache->request->header_out(Vary => "Accept-Encoding");
@@ -3100,7 +3153,7 @@ sub http_header(;$) {
 	    else {
 		    print "\r\n"; # Close headers
 	    }
-	    print "<font size=-1>Unable to find gzip binary in the \$PATH to compress output</font><br>";
+	    print "<font size=-1>Unable to find gzip binary in the <b>\$command_path</b> ($command_path) to compress output</font><br>";
 	}
     }
     else {
@@ -3115,7 +3168,6 @@ sub http_header(;$) {
 
 sub html_header($) {
     my ($title) = @_;
-    my $version = '$zRevision: 1.104 $  $kRevision: 1.54 $'; #'
     http_header("text/html");
     print <<EOH;
 <!doctype html public "-//W3C//DTD HTML 4.0 Transitional//EN"
@@ -3124,7 +3176,7 @@ sub html_header($) {
 <head>
 <meta name="robots" content="nofollow">
 <title>$title</title>
-<!-- CVSweb $version -->
+<!-- knu-cvsweb $cvsweb_revision -->
 </head>
 $body_tag
 $logo <h1 align="center">$title</h1>
@@ -3141,7 +3193,7 @@ sub link_tags($) {
     my ($fileurl,$filename);
 
     ($filename = $where) =~ s/^.*\///;
-    $fileurl = urlencode($filename);
+    $fileurl = './' . urlencode($filename);
 
     foreach my $sym (split(", ", $tags)) {
 	$ret .= ",\n" if ($ret ne "");