diff options
author | Lukas Reschke <lukas@statuscode.ch> | 2021-06-02 19:59:43 +0300 |
---|---|---|
committer | backportbot[bot] <backportbot[bot]@users.noreply.github.com> | 2021-06-02 22:17:38 +0300 |
commit | d838108deaa90a2f2d78af4e608452fb105fcd15 (patch) | |
tree | 5fe512574eaf54ab3c11aef668c38cfa19fadbf1 /lib/public/AppFramework | |
parent | 6a29b60260d81e104fc4cb55995b7c578ecd1e41 (diff) |
Escape filename in Content-Disposition
We should escape all occurences of ' and \ in here.
Signed-off-by: Lukas Reschke <lukas@statuscode.ch>
Diffstat (limited to 'lib/public/AppFramework')
-rw-r--r-- | lib/public/AppFramework/Http/DownloadResponse.php | 8 |
1 files changed, 2 insertions, 6 deletions
diff --git a/lib/public/AppFramework/Http/DownloadResponse.php b/lib/public/AppFramework/Http/DownloadResponse.php index 78381f0f08f..a7516fc6b85 100644 --- a/lib/public/AppFramework/Http/DownloadResponse.php +++ b/lib/public/AppFramework/Http/DownloadResponse.php @@ -30,20 +30,16 @@ namespace OCP\AppFramework\Http; * @since 7.0.0 */ class DownloadResponse extends Response { - private $filename; - private $contentType; - /** * Creates a response that prompts the user to download the file * @param string $filename the name that the downloaded file should have * @param string $contentType the mimetype that the downloaded file should have * @since 7.0.0 */ - public function __construct($filename, $contentType) { + public function __construct(string $filename, string $contentType) { parent::__construct(); - $this->filename = $filename; - $this->contentType = $contentType; + $filename = strtr($filename, ['"' => '\\"', '\\' => '\\\\']); $this->addHeader('Content-Disposition', 'attachment; filename="' . $filename . '"'); $this->addHeader('Content-Type', $contentType); |