kodev-org
/
vikunja
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

fix: escape attachment download filename

This commit is contained in:
kolaente 2026-02-21 23:52:31 +01:00
parent c6370bb739
commit d222d4502a
1 changed files with 3 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
pkg/routes/api/v1/task_attachment.go
View File

@ -210,7 +210,9 @@ func GetTaskAttachment(c *echo.Context) error {
mimeToReturn = "application/octet-stream"
}
c.Response().Header().Set("Content-Disposition", "attachment; filename=\""+taskAttachment.File.Name+"\"")
filename := strings.ReplaceAll(taskAttachment.File.Name, `"`, `\"`)
c.Response().Header().Set("Content-Disposition", "attachment; filename=\""+filename+"\"")
c.Response().Header().Set("Content-Type", mimeToReturn)
c.Response().Header().Set("Content-Length", strconv.FormatUint(taskAttachment.File.Size, 10))
c.Response().Header().Set("Last-Modified", taskAttachment.File.Created.UTC().Format(http.TimeFormat))