--- loncom/cgi/plot.gif	2001/12/21 14:43:50	1.6
+++ loncom/cgi/plot.gif	2002/03/01 14:03:50	1.9
@@ -1,6 +1,6 @@
 #!/usr/bin/perl
 #
-# $Id: plot.gif,v 1.6 2001/12/21 14:43:50 matthew Exp $
+# $Id: plot.gif,v 1.9 2002/03/01 14:03:50 matthew Exp $
 #
 # Copyright Michigan State University Board of Trustees
 #
@@ -29,9 +29,21 @@ use strict;
 $|=1;
 
 my $tmpdir = '/home/httpd/perl/tmp/';
-my $filename = $tmpdir . $ENV{'QUERY_STRING'};
+my %data;
+foreach (split/&/,$ENV{'QUERY_STRING'}) {
+    my ($name,$value)=split/=/;
+    $data{$name}=$value;
+}
+my $filename = $data{'file'};
+# unescape filename
+$filename =~ s/%([a-fA-F0-9][a-fA-F0-9])/pack("C",hex($1))/eg;
+
+die if ($filename =~ /\// || $filename !~ /_plot.data$/);
+$filename = $tmpdir . $filename;
+die "$data{'file'} does not exist\n" if (! -e $filename);
 
-if (-e $filename) {
+my $output = $data{'output'};
+if ($output eq 'gif') {
     open PLOT, "gnuplot $filename |";
     print <<"END";
 Content-type: image/gif
@@ -40,5 +52,11 @@ END
     while ($_=<PLOT>) {
 	print;
     }
+} elsif ($output eq 'eps') {
+    system ("gnuplot $filename");
+} else {
+    die "output $output is not a recognized value or has no value\n";
 }
 
+
+