[libmicrohttpd] Escaped "&" in CGI parameter

[Josef Möllers]

Hi,

I have a small-ish client-server setup:

* a plug-in for tvbrowser which schedules a recording by sending CGI
parameters to a remote recorder and

* a scheduler program on the recorder which ... ahem ... schedules the
requested recording.

The plug-in uses libcurl and (explicitly) encodes "&" characters in the
show's title as "%26". This also happens when I just "wget" the URL
handed over to libcurl.

The scheduler uses libmicrohttpd (0.9.62-1 on Debian Buster) to retrieve
the CGI parameters and values and schedule the recording.

The problem is that when I call MHD_get_connection_values(connection,
MHD_GET_ARGUMENT_KIND, ...), an embedded "%26" has been converted into
"&" before the CGI parameter string is parsed and this confuses the parser.

Eg the request sent is

/add?date=9.2.2021&time=23:45&channel=Das+Erste&title=Cagney+%26+Lacey&duration=10

(strace shows this as the data recv'ed) so the value of the
"title"-field *should* be "Cagney & Lacey", but when the string is
parsed into parameters, the "%26" had already been translated back into
an "&" and I get "Cagney " as the value of the "title" parameter
followed by an extra parameter " Lacey" without a value.

What am I doing wrong?

Thanks for helping and ... stay safe!

Josef