diff options
| -rw-r--r-- | weed/operation/upload_content.go | 12 | ||||
| -rw-r--r-- | weed/server/common.go | 11 | ||||
| -rw-r--r-- | weed/server/volume_server_handlers_read.go | 2 |
3 files changed, 12 insertions, 13 deletions
diff --git a/weed/operation/upload_content.go b/weed/operation/upload_content.go index 90f90c87d..a2fff4792 100644 --- a/weed/operation/upload_content.go +++ b/weed/operation/upload_content.go @@ -90,10 +90,9 @@ func (uploadResult *UploadResult) ToPbFileChunkWithSSE(fileId string, offset int } var ( - fileNameEscaper = strings.NewReplacer(`\`, `\\`, `"`, `\"`, "\n", "") - uploader *Uploader - uploaderErr error - once sync.Once + uploader *Uploader + uploaderErr error + once sync.Once ) // HTTPClient interface for testing @@ -336,8 +335,9 @@ func (uploader *Uploader) upload_content(ctx context.Context, fillBufferFunction body_writer = multipart.NewWriter(option.BytesBuffer) } h := make(textproto.MIMEHeader) - filename := fileNameEscaper.Replace(option.Filename) - h.Set("Content-Disposition", fmt.Sprintf(`form-data; name="file"; filename="%s"`, filename)) + // Use mime.FormatMediaType for RFC 6266 compliant Content-Disposition, + // properly handling non-ASCII characters and special characters + h.Set("Content-Disposition", mime.FormatMediaType("form-data", map[string]string{"name": "file", "filename": option.Filename})) h.Set("Idempotency-Key", option.UploadUrl) if option.MimeType == "" { option.MimeType = mime.TypeByExtension(strings.ToLower(filepath.Ext(option.Filename))) diff --git a/weed/server/common.go b/weed/server/common.go index 930695f4b..dfed891b4 100644 --- a/weed/server/common.go +++ b/weed/server/common.go @@ -9,9 +9,9 @@ import ( "fmt" "io" "io/fs" + "mime" "mime/multipart" "net/http" - "net/url" "path/filepath" "strconv" "strings" @@ -286,14 +286,15 @@ func adjustHeaderContentDisposition(w http.ResponseWriter, r *http.Request, file return } if filename != "" { - filename = url.QueryEscape(filename) - contentDisposition := "inline" + dispositionType := "inline" if r.FormValue("dl") != "" { if dl, _ := strconv.ParseBool(r.FormValue("dl")); dl { - contentDisposition = "attachment" + dispositionType = "attachment" } } - w.Header().Set("Content-Disposition", contentDisposition+`; filename="`+fileNameEscaper.Replace(filename)+`"`) + // Use mime.FormatMediaType for RFC 6266 compliant Content-Disposition, + // properly handling non-ASCII characters and special characters + w.Header().Set("Content-Disposition", mime.FormatMediaType(dispositionType, map[string]string{"filename": filename})) } } diff --git a/weed/server/volume_server_handlers_read.go b/weed/server/volume_server_handlers_read.go index a29ebd183..1fad742db 100644 --- a/weed/server/volume_server_handlers_read.go +++ b/weed/server/volume_server_handlers_read.go @@ -34,8 +34,6 @@ import ( const reqIsProxied = "proxied" -var fileNameEscaper = strings.NewReplacer(`\`, `\\`, `"`, `\"`) - func NotFound(w http.ResponseWriter) { stats.VolumeServerHandlerCounter.WithLabelValues(stats.ErrorGetNotFound).Inc() w.WriteHeader(http.StatusNotFound) |