prosody
88958c0ecab3
plugins/mod_http_file_share.lua

Find changesets by keywords by author, files, the commit message, revision number or hash, or revset expression.

Software / code / prosody

Comparison

plugins/mod_http_file_share.lua @ 12227:88958c0ecab3

mod_http_file_share: Use alternate syntax for filename in Content-Disposition The Lua string.format %q doesn't behave correctly for all characters that should be escaped in a quoted-string. And who knows what effects higher Unicode might have here. Applying percent-encoding of filenames seems like the safest way to deal with filenames, as well as being easier than implementing the actual quoted-string transform, which seems complicated and I'm not even sure it covers every possible character. Filenames can safely be assumed to be UTF-8 since they are passed in an attribute in the query without any escaping.
author Kim Alvefur <zash@zash.se>
date Sat, 29 Jan 2022 16:11:38 +0100
parent 12179:5e68635cdc2c
child 12444:b33558969b3e
comparison
equal deleted inserted replaced
12226:7db81c9cbbbf 12227:88958c0ecab3
13 local url = require "socket.url"; 13 local url = require "socket.url";
14 local dm = require "core.storagemanager".olddm; 14 local dm = require "core.storagemanager".olddm;
15 local jwt = require "util.jwt"; 15 local jwt = require "util.jwt";
16 local errors = require "util.error"; 16 local errors = require "util.error";
17 local dataform = require "util.dataforms".new; 17 local dataform = require "util.dataforms".new;
18 local urlencode = require "util.http".urlencode;
18 local dt = require "util.datetime"; 19 local dt = require "util.datetime";
19 local hi = require "util.human.units"; 20 local hi = require "util.human.units";
20 local cache = require "util.cache"; 21 local cache = require "util.cache";
21 local lfs = require "lfs"; 22 local lfs = require "lfs";
22 23
429 end 430 end
430 431
431 response.headers.last_modified = last_modified; 432 response.headers.last_modified = last_modified;
432 response.headers.content_length = filesize; 433 response.headers.content_length = filesize;
433 response.headers.content_type = filetype; 434 response.headers.content_type = filetype;
434 response.headers.content_disposition = string.format("%s; filename=%q", disposition, basename); 435 response.headers.content_disposition = string.format("%s; filename*=UTF-8''%s", disposition, urlencode(basename));
435 436
436 if response_range then 437 if response_range then
437 response.status_code = 206; 438 response.status_code = 206;
438 response.headers.content_range = response_range; 439 response.headers.content_range = response_range;
439 end 440 end