commands: URL escape filenames in multipart files, resolves #654
Matt Bell committed
Feb 2, 2015 at 17:17 UTC
a7de81b818f61b7c02a477c8e3577ec1a0423c9d
2 files changed
+11
-3
commands/files/multipartfile.go
+7
-1
@@ -4,6 +4,7 @@ import (
4
"mime"
5
"mime/multipart"
6
"net/http"
7
+ "net/url"
8
)
9
10
const (
@@ -67,7 +68,12 @@ func (f *MultipartFile) NextFile() (File, error) {
68
}
69
70
func (f *MultipartFile) FileName() string {
70
- return f.Part.FileName()
71
+ filename, err := url.QueryUnescape(f.Part.FileName())
72
+ if err != nil {
73
+ // if there is a unescape error, just treat the name as unescaped
74
+ return f.Part.FileName()
75
+ }
76
+ return filename
77
}
78
79
func (f *MultipartFile) Read(p []byte) (int, error) {
commands/http/multifilereader.go
+4
-2
@@ -6,6 +6,7 @@ import (
6
"io"
7
"mime/multipart"
8
"net/textproto"
9
+ "net/url"
10
"sync"
11
12
files "github.com/jbenet/go-ipfs/commands/files"
@@ -74,11 +75,12 @@ func (mfr *MultiFileReader) Read(buf []byte) (written int, err error) {
75
76
// write the boundary and headers
77
header := make(textproto.MIMEHeader)
78
+ filename := url.QueryEscape(file.FileName())
79
if mfr.form {
78
- contentDisposition := fmt.Sprintf("form-data; name=\"file\"; filename=\"%s\"", file.FileName())
80
+ contentDisposition := fmt.Sprintf("form-data; name=\"file\"; filename=\"%s\"", filename)
81
header.Set("Content-Disposition", contentDisposition)
82
} else {
81
- header.Set("Content-Disposition", fmt.Sprintf("file; filename=\"%s\"", file.FileName()))
83
+ header.Set("Content-Disposition", fmt.Sprintf("file; filename=\"%s\"", filename))
84
}
85
86
if file.IsDirectory() {