Merge pull request #27354 from nextcloud/escape-download-response

Escape filename in Content-Disposition

1 files changed, 2 insertions, 6 deletions

diff --git a/lib/public/AppFramework/Http/DownloadResponse.php b/lib/public/AppFramework/Http/DownloadResponse.php
index 78381f0f08f..a7516fc6b85 100644
--- a/lib/public/AppFramework/Http/DownloadResponse.php
+++ b/lib/public/AppFramework/Http/DownloadResponse.php
@@ -30,20 +30,16 @@ namespace OCP\AppFramework\Http;
  * @since 7.0.0
  */
 class DownloadResponse extends Response {
-	private $filename;
-	private $contentType;
-
 	/**
 	 * Creates a response that prompts the user to download the file
 	 * @param string $filename the name that the downloaded file should have
 	 * @param string $contentType the mimetype that the downloaded file should have
 	 * @since 7.0.0
 	 */
-	public function __construct($filename, $contentType) {
+	public function __construct(string $filename, string $contentType) {
 		parent::__construct();
 
-		$this->filename = $filename;
-		$this->contentType = $contentType;
+		$filename = strtr($filename, ['"' => '\\"', '\\' => '\\\\']);
 
 		$this->addHeader('Content-Disposition', 'attachment; filename="' . $filename . '"');
 		$this->addHeader('Content-Type', $contentType);