From 62f8f8d36cbd6957b41fb9d67843c07e6054f4ca Mon Sep 17 00:00:00 2001 From: Miroslav Stampar Date: Thu, 10 Nov 2011 10:22:35 +0000 Subject: [PATCH] bug fix (thanks to zhen zhou) --- lib/request/connect.py | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/lib/request/connect.py b/lib/request/connect.py index 2c91ec4b3..ac98d854c 100644 --- a/lib/request/connect.py +++ b/lib/request/connect.py @@ -539,13 +539,14 @@ class Connect: value = urlEncodeCookieValues(value) elif place: - if place in (PLACE.GET, PLACE.POST): + if place in (PLACE.GET, PLACE.POST, PLACE.URI): # payloads in GET and/or POST need to be urlencoded # throughly without safe chars (especially & and =) # addendum: as we support url encoding in tampering # functions therefore we need to use % as a safe char - payload = urlencode(payload, "%", False, True) - value = agent.replacePayload(value, payload) + if place != PLACE.URI or ('?' in value and value.find('?') < value.find(payload)): + payload = urlencode(payload, "%", False, True) + value = agent.replacePayload(value, payload) elif place == PLACE.SOAP: # payloads in SOAP should have chars > and < replaced # with their HTML encoded counterparts