Safe net against http header injection in email reports as the string can contain user submitted content

(likely it's been escaped upstream but we rather ensure security)

also fixes #7358

1 files changed, 3 insertions, 3 deletions

diff --git a/core/ReportRenderer/Pdf.php b/core/ReportRenderer/Pdf.php
index 3843cd942c..bc82cd85ce 100644
--- a/core/ReportRenderer/Pdf.php
+++ b/core/ReportRenderer/Pdf.php
@@ -123,7 +123,7 @@ class Pdf extends ReportRenderer
 
     public function sendToDisk($filename)
     {
-        $filename = ReportRenderer::appendExtension($filename, self::PDF_CONTENT_TYPE);
+        $filename = ReportRenderer::makeFilenameWithExtension($filename, self::PDF_CONTENT_TYPE);
         $outputFilename = ReportRenderer::getOutputPath($filename);
 
         $this->TCPDF->Output($outputFilename, 'F');
@@ -133,13 +133,13 @@ class Pdf extends ReportRenderer
 
     public function sendToBrowserDownload($filename)
     {
-        $filename = ReportRenderer::appendExtension($filename, self::PDF_CONTENT_TYPE);
+        $filename = ReportRenderer::makeFilenameWithExtension($filename, self::PDF_CONTENT_TYPE);
         $this->TCPDF->Output($filename, 'D');
     }
 
     public function sendToBrowserInline($filename)
     {
-        $filename = ReportRenderer::appendExtension($filename, self::PDF_CONTENT_TYPE);
+        $filename = ReportRenderer::makeFilenameWithExtension($filename, self::PDF_CONTENT_TYPE);
         $this->TCPDF->Output($filename, 'I');
     }