Properly escape the Content-Disposition filename

Fixes #23
hughsie · Oct 25, 2023 · dfa124a · dfa124a
1 parent 8c3e2a4
commit dfa124a
Showing 1 changed file with 3 additions and 2 deletions.
diff --git a/src/passim-server.c b/src/passim-server.c
@@ -630,10 +630,11 @@ passim_server_msg_send_item(PassimServer *self, SoupServerMessage *msg, PassimIt
 {
 	SoupMessageHeaders *hdrs = soup_server_message_get_response_headers(msg);
 	g_autofree gchar *content_disposition = NULL;
+	g_autofree gchar *filename = NULL;
 	g_autofree gchar *path = g_file_get_path(passim_item_get_file(item));
 
-	content_disposition =
-	    g_strdup_printf("attachment; filename=\"%s\"", passim_item_get_basename(item));
+	filename = g_uri_escape_string(passim_item_get_basename(item), NULL, TRUE);
+	content_disposition = g_strdup_printf("attachment; filename=\"%s\"", filename);
 	soup_message_headers_append(hdrs, "Content-Disposition", content_disposition);
 
 	passim_server_msg_send_file(self, msg, path);