From a299a08e07fb699815d4cad4115d4dc4c4cbe39d Mon Sep 17 00:00:00 2001 From: Katelyn Dickey Date: Fri, 19 Jun 2026 14:56:04 -0400 Subject: [PATCH] fix(share): safer construction of Content-Disposition --- server/public/handle_streams.go | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/server/public/handle_streams.go b/server/public/handle_streams.go index 01552464e..0051c783e 100644 --- a/server/public/handle_streams.go +++ b/server/public/handle_streams.go @@ -3,6 +3,7 @@ package public import ( "errors" "fmt" + "mime" "net/http" "strconv" "strings" @@ -76,7 +77,9 @@ func (pub *Router) handleStream(w http.ResponseWriter, r *http.Request) { w.Header().Set("X-Content-Duration", strconv.FormatFloat(float64(stream.Duration()), 'G', -1, 32)) if conf.Server.EnableDownloads && p.BoolOr("download", false) { - w.Header().Set("Content-Disposition", "attachment; filename=\""+downloadFilename(mf, info.format)+"\"") + w.Header().Set("Content-Disposition", mime.FormatMediaType( + "attachment", map[string]string{"filename": downloadFilename(mf, info.format)}, + )) } n, err := stream.Serve(ctx, w, r)