Merge pull request #1353 from siyuwj/master

Escape file names in attachment headers
This commit is contained in:
Min RK 2016-04-15 10:02:29 +02:00
commit 32011e3bad

View File

@ -7,7 +7,7 @@ import io
import os
import zipfile
from tornado import web
from tornado import web, escape
from ..base.handlers import (
IPythonHandler, FilesRedirectHandler,
@ -38,7 +38,7 @@ def respond_zip(handler, name, output, resources):
# Headers
zip_filename = os.path.splitext(name)[0] + '.zip'
handler.set_header('Content-Disposition',
'attachment; filename="%s"' % zip_filename)
'attachment; filename="%s"' % escape.url_escape(zip_filename))
handler.set_header('Content-Type', 'application/zip')
# Prepare the zip file
@ -112,7 +112,7 @@ class NbconvertFileHandler(IPythonHandler):
if self.get_argument('download', 'false').lower() == 'true':
filename = os.path.splitext(name)[0] + resources['output_extension']
self.set_header('Content-Disposition',
'attachment; filename="%s"' % filename)
'attachment; filename="%s"' % escape.url_escape(filename))
# MIME type
if exporter.output_mimetype: