github-starred/vikunja
2
0
Fork 0
mirror of https://github.com/go-vikunja/vikunja.git synced 2026-03-11 17:48:44 -05:00
Code Issues 219 Packages Projects Releases 2 Wiki Activity

fix: escape attachment download filename

Browse Source
This commit is contained in:
kolaente
2026-02-21 23:52:31 +01:00
parent c6370bb739
commit d222d4502a
1 changed files with 3 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
pkg/routes/api/v1/task_attachment.go
View File

@@ -210,7 +210,9 @@ func GetTaskAttachment(c *echo.Context) error {
mimeToReturn = "application/octet-stream"
}
c.Response().Header().Set("Content-Disposition", "attachment; filename=\""+taskAttachment.File.Name+"\"")
filename := strings.ReplaceAll(taskAttachment.File.Name, `"`, `\"`)
c.Response().Header().Set("Content-Disposition", "attachment; filename=\""+filename+"\"")
c.Response().Header().Set("Content-Type", mimeToReturn)
c.Response().Header().Set("Content-Length", strconv.FormatUint(taskAttachment.File.Size, 10))
c.Response().Header().Set("Last-Modified", taskAttachment.File.Created.UTC().Format(http.TimeFormat))