makary/phpbb
1
0
Fork 0
mirror of https://github.com/phpbb/phpbb.git synced 2025-06-08 04:18:52 +00:00
Code Issues Projects Releases Packages Wiki Activity

[ticket/14285] Add filename fallback

Browse source 
PHPBB3-14285
This commit is contained in:
rubencm 2019-06-22 01:29:10 +00:00
parent 6e345c37a9
commit 278d4d8318
1 changed files with 15 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

18
phpBB/phpbb/storage/controller/attachment.php
View file

@ -254,14 +254,16 @@ class attachment extends controller
{ {
$disposition = $this->response->headers->makeDisposition( $disposition = $this->response->headers->makeDisposition(
ResponseHeaderBag::DISPOSITION_INLINE, ResponseHeaderBag::DISPOSITION_INLINE,
rawurlencode(htmlspecialchars_decode($attachment['real_filename'])) $attachment['real_filename'],
$this->filenameFallback($attachment['real_filename'])
); );
} }
else else
{ {
$disposition = $this->response->headers->makeDisposition( $disposition = $this->response->headers->makeDisposition(
ResponseHeaderBag::DISPOSITION_ATTACHMENT, ResponseHeaderBag::DISPOSITION_ATTACHMENT,
rawurlencode(htmlspecialchars_decode($attachment['real_filename'])) $attachment['real_filename'],
$this->filenameFallback($attachment['real_filename'])
); );
} }
@ -274,12 +276,22 @@ class attachment extends controller
return parent::handle($attachment['physical_filename']); return parent::handle($attachment['physical_filename']);
} }
/**
* Remove non valid characters https://github.com/symfony/http-foundation/commit/c7df9082ee7205548a97031683bc6550b5dc9551
*/
protected function filenameFallback($filename)
{
$filename = preg_replace(['/[^\x20-\x7e]/', '/%/', '/\//', '/\\\/'], '', $filename);
return (!empty($filename)) ?: 'File';
}
/** /**
* {@inheritdoc} * {@inheritdoc}
*/ */
protected function prepare($file) protected function prepare($file)
{ {
$this->response->setPivate(); // But default should be private, but make sure of it $this->response->setPrivate(); // But default should be private, but make sure of it
parent::prepare($file); parent::prepare($file);
} }