===================================================================
RCS file: /cvsrepo/anoncvs/cvs/src/usr.bin/bgplg/bgplg.c,v
retrieving revision 1.6
retrieving revision 1.7
diff -c -r1.6 -r1.7
*** src/usr.bin/bgplg/bgplg.c	2007/09/13 23:32:39	1.6
--- src/usr.bin/bgplg/bgplg.c	2007/10/10 13:23:40	1.7
***************
*** 1,4 ****
! /*	$OpenBSD: bgplg.c,v 1.6 2007/09/13 23:32:39 cloder Exp $	*/
  
  /*
   * Copyright (c) 2005, 2006 Reyk Floeter <reyk@vantronix.net>
--- 1,4 ----
! /*	$OpenBSD: bgplg.c,v 1.7 2007/10/10 13:23:40 claudio Exp $	*/
  
  /*
   * Copyright (c) 2005, 2006 Reyk Floeter <reyk@vantronix.net>
***************
*** 109,124 ****
  		*lenp = len;
  
  #define allowed_in_string(_x)                                           \
! 	((isalnum(_x) || isprint(_x)) &&				\
! 	(_x != '%' && _x != '\\' && _x != ';' && _x != '|'))
  
  	for (i = 0; i < len; i++) {
  		if (!allowed_in_string(ptr[i])) {
  			printf("invalid character in input\n");
  			return (NULL);
  		}
- 		if (ptr[i] == '&')
- 			ptr[i] = '\0';
  	}
  
  	return (ptr);
--- 109,123 ----
  		*lenp = len;
  
  #define allowed_in_string(_x)                                           \
! 	(isalnum(_x) || strchr("-_.:/= ", _x))
  
  	for (i = 0; i < len; i++) {
+ 		if (ptr[i] == '&')
+ 			ptr[i] = '\0';
  		if (!allowed_in_string(ptr[i])) {
  			printf("invalid character in input\n");
  			return (NULL);
  		}
  	}
  
  	return (ptr);