X-Git-Url: http://git.squeep.com/?a=blobdiff_plain;f=lib%2Fpleroma%2Fweb%2Fplugs%2Fuploaded_media.ex;h=72f20e8de16a332c5efda0ae8c9cbe59340c49a8;hb=de64c6c54aaacc4123031f2e3d5bfb9fc9c517fe;hp=7b87d8f178defd9515ed9421aa68e0b753730633;hpb=364b6969eb7c79e57ed02345ddff4f48519e6b0a;p=akkoma

diff --git a/lib/pleroma/web/plugs/uploaded_media.ex b/lib/pleroma/web/plugs/uploaded_media.ex
index 7b87d8f17..72f20e8de 100644
--- a/lib/pleroma/web/plugs/uploaded_media.ex
+++ b/lib/pleroma/web/plugs/uploaded_media.ex
@@ -35,7 +35,7 @@ defmodule Pleroma.Web.Plugs.UploadedMedia do
     conn =
       case fetch_query_params(conn) do
         %{query_params: %{"name" => name}} = conn ->
-          name = String.replace(name, "\"", "\\\"")
+          name = escape_header_value(name)
 
           put_resp_header(conn, "content-disposition", "filename=\"#{name}\"")
 
@@ -98,4 +98,11 @@ defmodule Pleroma.Web.Plugs.UploadedMedia do
     |> send_resp(:internal_server_error, dgettext("errors", "Internal Error"))
     |> halt()
   end
+
+  defp escape_header_value(value) do
+    value
+    |> String.replace("\"", "\\\"")
+    |> String.replace("\\r", "")
+    |> String.replace("\\n", "")
+  end
 end