1 files changed, 9 insertions, 2 deletions

diff --git a/rrd.php b/rrd.php
index b4c7f68..d4f29ee 100644
--- a/rrd.php
+++ b/rrd.php
@@ -4,7 +4,13 @@ require_once 'conf/common.inc.php';
 require_once 'inc/functions.inc.php';
 require_once 'inc/html.inc.php';
 
-if ( $file = validateRRDPath($CONFIG['datadir'], urldecode($_SERVER["QUERY_STRING"])) ) {
+$path = filter_input(INPUT_GET, 'path');
+if (!$path) {
+        // legacy option: rrd.php?some.host/load/load.rrd
+        $path = urldecode(filter_input(INPUT_SERVER, 'QUERY_STRING'));
+}
+
+if ( $file = validateRRDPath($CONFIG['datadir'], $path) ) {
         header('Content-Type: application/octet-stream');
         header('Content-Disposition: attachment; filename='.basename($file));
         header("Expires: " .date(DATE_RFC822,strtotime($CONFIG['cache']." seconds")));
@@ -15,10 +21,11 @@ if ( $file = validateRRDPath($CONFIG['datadir'], urldecode($_SERVER["QUERY_STRIN
         header('HTTP/1.0 403 Forbidden');
 
         html_start();
+        $html_weburl = htmlentities($CONFIG['weburl']);
         echo <<<EOT
 <fieldset id="forbidden">
 <legend>forbidden</legend>
-<p><a href="{$CONFIG['weburl']}">Return home...</a></p>
+<p><a href="{$html_weburl}">Return home...</a></p>
 </fieldset>
 
 EOT;