Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Original file line number Diff line number Diff line change
Expand Up @@ -32,7 +32,6 @@ export const download = (
}

var req = new XMLHttpRequest();

req.open("GET", path, true);
req.addEventListener(
"progress",
Expand All @@ -52,9 +51,9 @@ export const download = (
const rspHeader = req.getResponseHeader("Content-Disposition");

let filename = "download";

if (rspHeader) {
filename = rspHeader.split('"')[1];
let rspHeaderDecoded = decodeURIComponent(rspHeader);
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
let rspHeaderDecoded = decodeURIComponent(rspHeader);
let rspHeaderDecoded = decodeFileName(rspHeader);

Please use the decodeFileName function located at portal-ui/src/common/utils.ts, that function will handle the error when a string cannot be decoded

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Tried that that doesn't work

filename = rspHeaderDecoded.split('"')[1];
}

if (completeCallback) {
Expand Down
11 changes: 7 additions & 4 deletions restapi/user_objects.go
Original file line number Diff line number Diff line change
Expand Up @@ -24,6 +24,7 @@ import (
"fmt"
"io"
"net/http"
"net/url"
"path"
"path/filepath"
"regexp"
Expand Down Expand Up @@ -395,6 +396,7 @@ func getDownloadObjectResponse(session *models.Principal, params user_api.Downlo
filename = prefixElements[len(prefixElements)-1]
}
}
escapedName := url.PathEscape(filename)

// indicate object size & content type
stat, err := resp.Stat()
Expand All @@ -411,11 +413,11 @@ func getDownloadObjectResponse(session *models.Principal, params user_api.Downlo
}

if isPreview {
rw.Header().Set("Content-Disposition", fmt.Sprintf("inline; filename=\"%s\"", filename))
rw.Header().Set("Content-Disposition", fmt.Sprintf("inline; filename=\"%s\"", escapedName))
rw.Header().Set("X-Frame-Options", "SAMEORIGIN")
rw.Header().Set("X-XSS-Protection", "1")
} else {
rw.Header().Set("Content-Disposition", fmt.Sprintf("attachment; filename=\"%s\"", filename))
rw.Header().Set("Content-Disposition", fmt.Sprintf("attachment; filename=\"%s\"", escapedName))
}

rw.Header().Set("Last-Modified", stat.LastModified.UTC().Format(http.TimeFormat))
Expand All @@ -424,7 +426,7 @@ func getDownloadObjectResponse(session *models.Principal, params user_api.Downlo
if isPreview {
// In case content type was uploaded as octet-stream, we double verify content type
if stat.ContentType == "application/octet-stream" {
contentType = mimedb.TypeByExtension(filepath.Ext(filename))
contentType = mimedb.TypeByExtension(filepath.Ext(escapedName))
}
}
rw.Header().Set("Content-Type", contentType)
Expand Down Expand Up @@ -523,8 +525,9 @@ func getDownloadFolderResponse(session *models.Principal, params user_api.Downlo
filename = prefixElements[len(prefixElements)-1]
}
}
escapedName := url.PathEscape(filename)

rw.Header().Set("Content-Disposition", fmt.Sprintf("attachment; filename=\"%s.zip\"", filename))
rw.Header().Set("Content-Disposition", fmt.Sprintf("attachment; filename=\"%s.zip\"", escapedName))
rw.Header().Set("Content-Type", "application/zip")

// Copy the stream
Expand Down