diff options
| author | Xavier Morel <xmo@odoo.com> | 2018-07-20 11:08:07 +0200 |
|---|---|---|
| committer | Xavier Morel <xmo@odoo.com> | 2018-07-20 11:36:31 +0200 |
| commit | b67209b001f17fb1928db7786a9ee43ac39f5abf (patch) | |
| tree | a8a7157c9396eeb03924e44adf3e0ee06b2b0a41 /odoo/http.py | |
| parent | 5ef8300cdd9f00dfd5d6eb186dffafb9be5c0e30 (diff) | |
[FIX] : and / are not safe in content-attachment filename
Browsers accept it as they are wont to do, but the Content-Disposition
lib (introduced in 35d452cffbb1554c70f0acba85dfc4ef472f544c) does
not. Simply don't mark them as safe when %-escaping the filename so
they do get %-escaped properly.
RFC5987 states
ext-parameter = parmname "*" LWSP "=" LWSP ext-value
ext-value = charset "'" [ language ] "'" value-chars
value-chars = *( pct-encoded / attr-char )
attr-char = ALPHA / DIGIT
/ "!" / "#" / "$" / "&" / "+" / "-" / "."
/ "^" / "_" / "`" / "|" / "~"
; token except ( "*" / "'" / "%" )
Neither : nor / are in attr-char. This is further confirmed by
checking out RFC2616:
CTL = <any US-ASCII control character (octets 0 - 31) and DEL (127)>
token = 1*<any CHAR except CTLs or separators>
separators = "(" | ")" | "<" | ">" | "@"
| "," | ";" | ":" | "\" | <">
| "/" | "[" | "]" | "?" | "="
| "{" | "}" | SP | HT
Here we can see "/" and ":" are both in "separators", which are
specifically *not* in token. attr-char restricts token further, so an
invalid token char can't be a valid attr-char.
Diffstat (limited to 'odoo/http.py')
| -rw-r--r-- | odoo/http.py | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/odoo/http.py b/odoo/http.py index 73098004cc4..c8604a87b20 100644 --- a/odoo/http.py +++ b/odoo/http.py @@ -1631,7 +1631,7 @@ def send_file(filepath_or_fp, mimetype=None, as_attachment=False, filename=None, def content_disposition(filename): filename = odoo.tools.ustr(filename) - escaped = urls.url_quote(filename) + escaped = urls.url_quote(filename, safe='') return "attachment; filename*=UTF-8''%s" % escaped |