MoinMoin: attachment:30460_content_disposition_encode.patch of MoinMoinBugs/Non-ASCII attachment names corrupted on download

   1 Download file may corrupt if filename not encode correctly in Content-Disposition header for some web browser;
   2 
   3 diff -r 6278b366fb32 MoinMoin/Page.py
   4 --- a/MoinMoin/Page.py	Wed Nov 19 10:25:26 2008 +0800
   5 +++ b/MoinMoin/Page.py	Wed Nov 19 10:25:28 2008 +0800
   6 @@ -1047,6 +1047,7 @@
   7                  # TODO: fix the encoding here, plain 8 bit is not allowed according to the RFCs
   8                  # There is no solution that is compatible to IE except stripping non-ascii chars
   9                  filename_enc = "%s.txt" % self.page_name.encode(config.charset)
  10 +                filename_enc = wikiutil.content_disposition_encode(filename_enc, request)
  11                  request.setHttpHeader('Content-Disposition: %s; filename="%s"' % (
  12                                        content_disposition, filename_enc))
  13          else:
  14 diff -r 6278b366fb32 MoinMoin/action/AttachFile.py
  15 --- a/MoinMoin/action/AttachFile.py	Wed Nov 19 10:25:26 2008 +0800
  16 +++ b/MoinMoin/action/AttachFile.py	Wed Nov 19 10:25:28 2008 +0800
  17 @@ -872,7 +872,7 @@
  18              'Content-Type: %s' % content_type,
  19              'Last-Modified: %s' % timestamp,
  20              'Content-Length: %d' % os.path.getsize(fpath),
  21 -            'Content-Disposition: %s; filename="%s"' % (content_dispo, filename_enc),
  22 +            'Content-Disposition: %s; filename="%s"' % (content_dispo, wikiutil.content_disposition_encode(filename_enc, request)),
  23          ])
  24  
  25          # send data
  26 diff -r 6278b366fb32 MoinMoin/action/backup.py
  27 --- a/MoinMoin/action/backup.py	Wed Nov 19 10:25:26 2008 +0800
  28 +++ b/MoinMoin/action/backup.py	Wed Nov 19 10:25:28 2008 +0800
  29 @@ -39,7 +39,7 @@
  30      filename = "%s-%s.tar.%s" % (request.cfg.siteid, dateStamp, request.cfg.backup_compression)
  31      request.emit_http_headers([
  32          'Content-Type: application/octet-stream',
  33 -        'Content-Disposition: inline; filename="%s"' % filename, ])
  34 +        'Content-Disposition: inline; filename="%s"' % wikiutil.content_disposition_encode(filename, request), ])
  35  
  36      tar = tarfile.open(fileobj=request, mode="w|%s" % request.cfg.backup_compression)
  37      # allow GNU tar's longer file/pathnames
  38 diff -r 6278b366fb32 MoinMoin/action/cache.py
  39 --- a/MoinMoin/action/cache.py	Wed Nov 19 10:25:26 2008 +0800
  40 +++ b/MoinMoin/action/cache.py	Wed Nov 19 10:25:28 2008 +0800
  41 @@ -154,7 +154,7 @@
  42          # TODO: fix the encoding here, plain 8 bit is not allowed according to the RFCs
  43          # There is no solution that is compatible to IE except stripping non-ascii chars
  44          filename = filename.encode(config.charset)
  45 -        headers.append('Content-Disposition: %s; filename="%s"' % (content_disposition, filename))
  46 +        headers.append('Content-Disposition: %s; filename="%s"' % (content_disposition, wikiutil.content_disposition_encode(filename, request)))
  47  
  48      meta_cache = caching.CacheEntry(request, cache_arena, key+'.meta', cache_scope, do_locking=do_locking, use_pickle=True)
  49      meta_cache.update({
  50 diff -r 6278b366fb32 MoinMoin/wikiutil.py
  51 --- a/MoinMoin/wikiutil.py	Wed Nov 19 10:25:26 2008 +0800
  52 +++ b/MoinMoin/wikiutil.py	Wed Nov 19 10:25:28 2008 +0800
  53 @@ -2624,3 +2624,46 @@
  54                            ( authtype == 'w' and user.may.write(pagename) ) ) ):
  55                  return "( " + _("Permission denied for macro: %s")% macro_name + " )";
  56      return None
  57 +
  58 +def content_disposition_encode(text,request=None):
  59 +    """
  60 +    UTF filename in Content-Disposition:
  61 +        IE: failed to download
  62 +        Chrome: wront filename
  63 +        FF: works. (Firefox,Epiphany,Iceweasel,Iceape,Galeon)
  64 +        Opera: works.
  65 +        Safari: wrong filename
  66 +    URL encode filename in Content-Disposition:
  67 +        IE: works.
  68 +        Chrome: works.
  69 +        FF: wrong filename. (Firefox,Epiphany,Iceweasel,Iceape,Galeon)
  70 +        Opera: wrong filename
  71 +        Safari: wrong filename
  72 +    """
  73 +    if isinstance(text, unicode):
  74 +        text = text.encode('utf-8')
  75 +    do_url_encode = None
  76 +    if request:
  77 +        ua = request.http_user_agent
  78 +        ## browsers shoud url encode: MSIE, Chrome
  79 +        for browser in ["MSIE",
  80 +                        "Chrome"]:
  81 +            if browser in ua:
  82 +                do_url_encode = True
  83 +        ## should NOT url encode: Firefox, Opera
  84 +        if do_url_encode is None:
  85 +            for browser in ["Opera",
  86 +                            "Firefox",
  87 +                            "Epiphany",
  88 +                            "Iceweasel",
  89 +                            "Iceape",
  90 +                            "Galeon",]:
  91 +                if browser in ua:
  92 +                    do_url_encode = False
  93 +        # should convert to OS's charset.
  94 +        if do_url_encode is None and "Safari" in ua:
  95 +            do_url_encode = False
  96 +
  97 +    if do_url_encode:
  98 +        text = urllib.quote(text)
  99 +    return text
 100