content-disposition filename bugfix

rauwebieten · Sep 13, 2017 · 866f378 · 866f378
1 parent 9785bac
commit 866f378
Showing 1 changed file with 5 additions and 1 deletion.
diff --git a/src/Psr7PartialDownload.php b/src/Psr7PartialDownload.php
@@ -25,8 +25,12 @@ public function sendFile(ServerRequestInterface $request, ResponseInterface $res
         $byteOffset = 0;
         $byteLength = $fileSize = filesize($filePath);
 
+        // clean up filename
+        $invalidChars = array('<', '>', '?', '"', ':', '|', '\\', '/', '*', '&');
+        $fileName = str_replace($invalidChars, '', $fileName);
+
         $response = $response->withHeader('Accept-Ranges', 'bytes');
-        $response = $response->withHeader('Content-Disposition', "attachment; filename=$fileName");
+        $response = $response->withHeader('Content-Disposition', "attachment; filename=\"{$fileName}\"");
 
         $server = $request->getServerParams();