1 files changed, 17 insertions, 4 deletions

diff --git a/modules/dav/fs/repos.c b/modules/dav/fs/repos.c
index cf17e22a08..ae6f5c0ea1 100644
--- a/modules/dav/fs/repos.c
+++ b/modules/dav/fs/repos.c
@@ -1482,6 +1482,18 @@ static dav_error * dav_fs_remove_resource(dav_resource *resource,
     return dav_fs_deleteset(info->pool, resource);
 }
 
+/* Take an unescaped path component and escape it and append it onto a
+ * dav_buffer for a URI */
+static apr_size_t dav_fs_append_uri(apr_pool_t *p, dav_buffer *pbuf,
+                                    const char *path, apr_size_t pad)
+{
+    const char *epath = ap_escape_uri(p, path);
+    apr_size_t epath_len = strlen(epath);
+
+    dav_buffer_place_mem(p, pbuf, epath, epath_len + 1, pad);
+    return epath_len;
+}
+
 /* ### move this to dav_util? */
 /* Walk recursively down through directories, *
  * including lock-null resources as we go.    */
@@ -1537,6 +1549,7 @@ static dav_error * dav_fs_walker(dav_fs_walker_context *fsctx, int depth)
     }
     while ((apr_dir_read(&dirent, APR_FINFO_DIRENT, dirp)) == APR_SUCCESS) {
         apr_size_t len;
+        apr_size_t escaped_len;
 
         len = strlen(dirent.name);
 
@@ -1579,7 +1592,7 @@ static dav_error * dav_fs_walker(dav_fs_walker_context *fsctx, int depth)
 
         /* copy the file to the URI, too. NOTE: we will pad an extra byte
            for the trailing slash later. */
-        dav_buffer_place_mem(pool, &fsctx->uri_buf, dirent.name, len + 1, 1);
+        escaped_len = dav_fs_append_uri(pool, &fsctx->uri_buf, dirent.name, 1);
 
         /* if there is a secondary path, then do that, too */
         if (fsctx->path2.buf != NULL) {
@@ -1612,7 +1625,7 @@ static dav_error * dav_fs_walker(dav_fs_walker_context *fsctx, int depth)
             fsctx->path2.cur_len += len;
 
             /* adjust URI length to incorporate subdir and a slash */
-            fsctx->uri_buf.cur_len += len + 1;
+            fsctx->uri_buf.cur_len += escaped_len + 1;
             fsctx->uri_buf.buf[fsctx->uri_buf.cur_len - 1] = '/';
             fsctx->uri_buf.buf[fsctx->uri_buf.cur_len] = '\0';
 
@@ -1678,8 +1691,8 @@ static dav_error * dav_fs_walker(dav_fs_walker_context *fsctx, int depth)
             */
             dav_buffer_place_mem(pool, &fsctx->path1,
                                  fsctx->locknull_buf.buf + offset, len + 1, 0);
-            dav_buffer_place_mem(pool, &fsctx->uri_buf,
-                                 fsctx->locknull_buf.buf + offset, len + 1, 0);
+            dav_fs_append_uri(pool, &fsctx->uri_buf,
+                              fsctx->locknull_buf.buf + offset, 0);
             if (fsctx->path2.buf != NULL) {
                 dav_buffer_place_mem(pool, &fsctx->path2,
                                      fsctx->locknull_buf.buf + offset,