diff --git a/weed/admin/handlers/file_browser_handlers.go b/weed/admin/handlers/file_browser_handlers.go index aec013e1a..e964b05c4 100644 --- a/weed/admin/handlers/file_browser_handlers.go +++ b/weed/admin/handlers/file_browser_handlers.go @@ -585,7 +585,10 @@ func (h *FileBrowserHandlers) DownloadFile(c *gin.Context) { // Set headers for file download fileName := filepath.Base(cleanFilePath) - c.Header("Content-Disposition", fmt.Sprintf("attachment; filename=\"%s\"", fileName)) + // Escape quotes and backslashes in filename per RFC 2616 + escapedFileName := strings.ReplaceAll(fileName, "\\", "\\\\") + escapedFileName = strings.ReplaceAll(escapedFileName, "\"", "\\\"") + c.Header("Content-Disposition", fmt.Sprintf("attachment; filename=\"%s\"", escapedFileName)) // Use content type from filer response, or default to octet-stream contentType := resp.Header.Get("Content-Type")