235729 - vBulletin Content-disposition headers do not have quotes when filenames contain spaces

Status: RESOLVED FIXED

(Tech Evangelism Graveyard :: English US, defect)

Description

[MageMinds]

User-Agent:       
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.6) Gecko/20040206 Firefox/0.8

When I try to download any of attachments on a vBulletin forum and there are
spaces in the filenamr, FireFox keep asking me with wich program I want to open
the file "part1" of type unknown... the the file name is in fact "part1 of
5.zip" for example...

Reproducible: Always
Steps to Reproduce:
1. Log to a vBulletin
2. Find an Attachment with space in the name (hard to find cause link are
underlined)
3. Click on it ...

Actual Results:  
Mozzilla ask a program to open the type unknown file but I can still save it to
disk and after that rename the badly named file to make it usable.

Expected Results:  
Recognise the file name even if there is spaces in it and find the appropriate
program associated with.

Comment 1

[ikhnaton]

I give you a link to a vbulletin 2.3.4 thread containing an attachment with a
space in its name so that you may easily reproduce the bug :

http://www.ceruleanstudios.com/forums/showthread.php?s=3cb03661dceae3adf1021c0bde411fcb&threadid=16552

The attachment is at the bottom of the page and is named "delayexec v1.0.zip"

Comment 2

[logan]

Content-disposition: inline; filename=delayexec v1.0.zip

If quoted, this works fine. I don't believe the rfcs state that the filename
param MUST be quoted. The app (vbulletin) should probably test for a valid range
of characters and quote if it encounters one, quote everything, or encode
special characters.

Correct me if I'm wrong, but I think only ascii is allowed. Excluding spaces,
control characters, and a few others like @;<>, etc...

Comment 3

[timeless]

consider yourself corrected: bug 210147.

Comment 4

[Ali Ebrahim]

Over to Tech Evangelism so they can get vBulletin to fix (add quotes) to their
Content-disposition headers per bug 210147.

This is not a product bug.

Comment 5

[logan]

Attachment: quick patch for vbulletin

Comment 6

[logan]

Attachment: patch v2

avatar.php has the same problem

Comment 7

[logan]

taking

Comment 8

[logan]

"The latest versions of vB 3 and vB 2 have quotes around the filename in the
content-disposition header."

http://www.vbulletin.com/issue.php?issueid=128588&authcode=540596b9

I'll have to take them at their word, no way to verify...

Closing as FIXED.