CGI escape the session cookie.

git-svn-id: http://svn-commit.rubyonrails.org/rails/trunk@6200 5ecf4fe2-1ee6-0310-87b1-e25e094e27de

1 files changed, 2 insertions, 2 deletions

diff --git a/actionpack/lib/action_controller/session/cookie_store.rb b/actionpack/lib/action_controller/session/cookie_store.rb
index 25717cc5e7..8763a4933a 100644
--- a/actionpack/lib/action_controller/session/cookie_store.rb
+++ b/actionpack/lib/action_controller/session/cookie_store.rb
@@ -81,13 +81,13 @@ class CGI::Session::CookieStore
     # Marshal a session hash into safe cookie data. Include an integrity hash.
     def marshal(session)
       data = Base64.encode64(Marshal.dump(session)).chop
-      "#{data}--#{generate_digest(data)}"
+      CGI.escape "#{data}--#{generate_digest(data)}"
     end
 
     # Unmarshal cookie data to a hash and verify its integrity.
     def unmarshal(cookie)
       if cookie
-        data, digest = cookie.split('--')
+        data, digest = CGI.unescape(cookie).split('--')
         raise TamperedWithCookie unless digest == generate_digest(data)
         Marshal.load(Base64.decode64(data))
       end