Properly escape filename when downloading files

2019-03-04 13:07:14 -08:00
parent 8d39faddc9
commit aa19cbbfc7
2 changed files with 2 additions and 1 deletions
--- a/src/routes/apps.js
+++ b/src/routes/apps.js
@@ -598,7 +598,7 @@ function downloadFile(req, res, next) {

        var headers = {
            'Content-Type': 'application/octet-stream',
-            'Content-Disposition': 'attachment; filename="' + info.filename + '"'
+            'Content-Disposition': `attachment; filename*=utf-8''${encodeURIComponent(info.filename)}` // RFC 2184 section 4
        };
        if (info.size) headers['Content-Length'] = info.size;