261518 - filenames with spaces truncated when using "Content-Disposition: attachment"

Status: VERIFIED DUPLICATE of bug 221028

(Toolkit :: Downloads API, defect)

Description

[Roger Rohrbach]

User-Agent:       Mozilla/5.0 (Windows; U; Win98; rv:1.7.3) Gecko/20040913 Firefox/0.10
Build Identifier: Mozilla/5.0 (Windows; U; Win98; rv:1.7.3) Gecko/20040913 Firefox/0.10

When a file is served for downloading using the "Content-Disposition:
attachment" MIME header, the filename parameter is truncated at the first space
character.

Reproducible: Always
Steps to Reproduce:
Invoke the following PHP script (or equivalent) via HTTP GET: 

    <?php
        $file = "Some Text.txt";

        Header("Content-Type: text/plain");
        Header("Content-Length: " . filesize($file));
        Header("Content-Disposition: attachment; filename=$file");

        readfile($file);
    ?>

Actual Results:  
Firefox offers to open or save a file entitled "Some".  URL-encoding the
filename in the Content-Disposition header does not improve matters much;
Firefox does not decode it, but saves the literal (encoded) name.

Expected Results:  
The filename ("Some Text.txt") should be preserved, not truncated at the first
space character.  This works in Netspace, Internet Explorer and Opera.

Comment 1

[Phil Ringnalda (:philor)]

RFC 2616 (the HTTP 1.1 spec), section 19.5.1, defines the filename part of the
header as:

 filename-parm = "filename" "=" quoted-string

and if you use Header("Content-Disposition: attachment; filename=\"$file\""); so
that your header has quotes around the filename, you'll find that IE, Opera, and
Moz all use the full filename.

Suggest INVALID.

Comment 2

[Roger Rohrbach]

(In reply to comment #1)

My error--I tested this with embedded single quotes, and didn't think to try
(escaped) double quotes.  A perusal of RFC 2616 makes it clear that only double
quotes are valid.

Comment 3

[Ali Ebrahim]

*** This bug has been marked as a duplicate of 221028 ***