escape quotation marks in Content-Disposition header

2019-03-12 09:21:13 +03:00 · 2019-03-12 09:21:13 +03:00 · 92a69bddce
parent 5a73cae2be
commit 92a69bddce
1 changed files with 2 additions and 0 deletions
--- a/lib/pleroma/plugs/uploaded_media.ex
+++ b/lib/pleroma/plugs/uploaded_media.ex
@ -27,6 +27,8 @@ defmodule Pleroma.Plugs.UploadedMedia do
    conn =
      case fetch_query_params(conn) do
        %{query_params: %{"name" => name}} = conn ->
+          name = String.replace(name, "\"", "\\\"")
+
          conn
          |> put_resp_header("Content-Disposition", "filename=\"#{name}\"")