Github-Mirror/pocketbase
1
0
Fork 0
mirror of https://github.com/pocketbase/pocketbase.git synced 2026-09-08 15:41:18 +02:00
Code Issues Packages Projects Releases Wiki Activity

added quotes for the default Content-Disposition serving filename in case custom name with special characters is provided

Browse Source
This commit is contained in:
Gani Georgiev
2026-08-02 20:18:02 +03:00
parent 4c6c166603
commit b259534df7
3 changed files with 13 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tools/filesystem/filesystem.go
+1 -1
View File
@@ -464,7 +464,7 @@ func (s *System) Serve(res http.ResponseWriter, req *http.Request, fileKey strin
extContentType = ct
}
setHeaderIfMissing(res, "Content-Disposition", disposition+"; filename="+name)
setHeaderIfMissing(res, "Content-Disposition", disposition+"; filename="+strconv.Quote(name))
setHeaderIfMissing(res, "Content-Type", extContentType)
setHeaderIfMissing(res, "Content-Security-Policy", "default-src 'none'; media-src 'self'; style-src 'unsafe-inline'; sandbox")
tools/filesystem/filesystem_test.go
+10 -10
View File
@@ -365,7 +365,7 @@ func TestFileSystemServe(t *testing.T) {
nil,
false,
map[string]string{
"Content-Disposition": "attachment; filename=test_name.txt",
"Content-Disposition": `attachment; filename="test_name.txt"`,
"Content-Type": "application/octet-stream",
"Content-Length": "4",
"Content-Security-Policy": csp,
@@ -380,7 +380,7 @@ func TestFileSystemServe(t *testing.T) {
nil,
false,
map[string]string{
"Content-Disposition": "inline; filename=test_name.png",
"Content-Disposition": `inline; filename="test_name.png"`,
"Content-Type": "image/png",
"Content-Length": "73",
"Content-Security-Policy": csp,
@@ -395,7 +395,7 @@ func TestFileSystemServe(t *testing.T) {
nil,
false,
map[string]string{
"Content-Disposition": "attachment; filename=test_name_download.png",
"Content-Disposition": `attachment; filename="test_name_download.png"`,
"Content-Type": "image/png",
"Content-Length": "73",
"Content-Security-Policy": csp,
@@ -410,7 +410,7 @@ func TestFileSystemServe(t *testing.T) {
nil,
false,
map[string]string{
"Content-Disposition": "attachment; filename=test_name.abc",
"Content-Disposition": `attachment; filename="test_name.abc"`,
"Content-Type": "image/svg+xml",
"Content-Length": "0",
"Content-Security-Policy": csp,
@@ -425,7 +425,7 @@ func TestFileSystemServe(t *testing.T) {
nil,
false,
map[string]string{
"Content-Disposition": "attachment; filename=test_name",
"Content-Disposition": `attachment; filename="test_name"`,
"Content-Type": "text/css",
"Content-Length": "0",
"Content-Security-Policy": csp,
@@ -440,7 +440,7 @@ func TestFileSystemServe(t *testing.T) {
nil,
false,
map[string]string{
"Content-Disposition": "attachment; filename=test_name.abc",
"Content-Disposition": `attachment; filename="test_name.abc"`,
"Content-Type": "text/javascript",
"Content-Length": "0",
"Content-Security-Policy": csp,
@@ -455,7 +455,7 @@ func TestFileSystemServe(t *testing.T) {
nil,
false,
map[string]string{
"Content-Disposition": "attachment; filename=test_name.abc",
"Content-Disposition": `attachment; filename="test_name.abc"`,
"Content-Type": "text/javascript",
"Content-Length": "0",
"Content-Security-Policy": csp,
@@ -470,7 +470,7 @@ func TestFileSystemServe(t *testing.T) {
nil,
false,
map[string]string{
"Content-Disposition": "attachment; filename=test_name.abc",
"Content-Disposition": `attachment; filename="test_name.abc"`,
"Content-Type": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",
"Content-Length": "0",
"Content-Security-Policy": csp,
@@ -485,7 +485,7 @@ func TestFileSystemServe(t *testing.T) {
nil,
false,
map[string]string{
"Content-Disposition": "attachment; filename=test_name.abc",
"Content-Disposition": `attachment; filename="test_name.abc"`,
"Content-Type": "application/vnd.openxmlformats-officedocument.wordprocessingml.document",
"Content-Length": "0",
"Content-Security-Policy": csp,
@@ -500,7 +500,7 @@ func TestFileSystemServe(t *testing.T) {
nil,
false,
map[string]string{
"Content-Disposition": "attachment; filename=test_name.abc",
"Content-Disposition": `attachment; filename="test_name.abc"`,
"Content-Type": "application/vnd.openxmlformats-officedocument.presentationml.presentation",
"Content-Length": "0",
"Content-Security-Policy": csp,