Re: OWA 2003 Weirdness and suspected bug

  • From: "Michael B. Smith" <michael@xxxxxxxxxx>
  • To: "MS-Exchange Admin Issues" <exchangelist@xxxxxxxxxxxxxxxxxxxxxxxxxx>, "[ExchangeList]" <exchangelist@xxxxxxxxxxxxx>
  • Date: Tue, 29 Jun 2004 11:39:38 -0400

It was a bug. It's fixed in Exchange 2003 sp1. redir.asp has been
significantly rewritten for sp1.
 
(I've actually placed the redir.asp from sp1 in my RTM installation.
It's standalone and I see no harm, but it's probably completely
unsupported.)
 
 
----- Original Message -----
 
 
Exchange 2003 RTM.
 
OWA 2003, when it displays an email, redirects links in that email (this
is so you don't get an email with links that contains an OWA command in
it - such as deleting your calendar).
 
Well, that redirection process is breaking one of my applications.
 
For a hyperlink like this (from regular Outlook's "View Source"):
 
<A
HREF="http://gateway.brnets.com/quarantine/release.asp?id=jaeIlWVBwBZH73
o%2FEkRig%2FtCiMkq1BCL%2Fwoy5%2BqQfE%2BbBHKFyMgXrBOQvvlZ6uXW7s3xycpR0Ymk
MZmFQxTCIg%3D%3D&amp;domain=brnets.com&amp;mailfrom=scott@xxxxxxxxxxxxxx
om">Click Here</A>
 
It turns it into (from OWA's "View Source"):
 
<A
HREF="/exchweb/bin/redir.asp?URL=http://gateway.brnets.com/quarantine/re
lease.asp?id=jaeIlWVBwBZH73o%252FEkRig%252FtCiMkq1BCL%252Fwoy5%252BqQfE%
252BbBHKFyMgXrBOQvvlZ6uXW7s3xycpR0YmkMZmFQxTCIg%253D%253D%26domain=brnet
s.com%26mailfrom=scott@xxxxxxxxxxxxxxxx" target=_blank>Click Here</A>
 
But when it processes the through redir.asp, it turns:
 
id=jaeIlWVBwBZH73o/EkRig/tCiMkq1BCL/woy5+qQfE+bBHKFyMgXrBOQvvlZ6uXW7s3xy
cpR0YmkMZmFQxTCIg==
 
into:
 
id=jaeIlWVBwBZH73o/EkRig/tCiMkq1BCL/woy5 qQfE
bBHKFyMgXrBOQvvlZ6uXW7s3xycpR0YmkMZmFQxTCIg==
 
which are obviously different. And the second one fails.
 
The PROBLEM is that redir.asp uses Request.QueryString(). That is
specifically documented to do a URL decode. But the first time, that's
OK  -- the '+'s are %2B and they get converted.
 
THEN it calls unescape(). That does a SECOND URL decode. That includes
converting "+" into " ". 
 
This looks like a bug to me.
 
1) Comments? (All are welcome - except for telling me to get the "+"s
out of the application - that isn't an option.)
 
2) Anyone have Exchange 2003 sp1 handy? Has redir.asp changed?
 
3) Any idea why redir.asp would be calling unescape() the second time?

Other related posts: