From 02e7a134cccd3a7e12b2ebf2965de8bd406f4722 Mon Sep 17 00:00:00 2001
From: kolaente <k@knt.li>
Date: Wed, 17 Jun 2026 14:25:03 +0200
Subject: [PATCH] fix(api): close the user data export reader after download

DownloadUserDataExport obtained an open file reader from
GetUserDataExportFile but never closed it on either the s3 io.Copy or the
http.ServeContent branch, leaking a file descriptor on every download.
Defer the close right after the file is obtained so both branches and the
error paths cover it.
---
 pkg/routes/api/v1/user_export.go | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkg/routes/api/v1/user_export.go b/pkg/routes/api/v1/user_export.go
index 1c2fd4117..b01b1fdf3 100644
--- a/pkg/routes/api/v1/user_export.go
+++ b/pkg/routes/api/v1/user_export.go
@@ -131,6 +131,7 @@ func DownloadUserDataExport(c *echo.Context) error {
 		}
 		return err
 	}
+	defer func() { _ = exportFile.File.Close() }()
 
 	// Downloads must never be cached; no-cache overrides the global no-store
 	// directive while still allowing revalidation.