From 5e413a00ba15ec7c961de64d140e136bf221edf2 Mon Sep 17 00:00:00 2001
From: chrislu <chris.lu@gmail.com>
Date: Fri, 5 Dec 2025 15:39:13 -0800
Subject: [PATCH] fix: Use mime.FormatMediaType for RFC 6266 compliant
 Content-Disposition

Updated Content-Disposition header generation to use mime.FormatMediaType
from the standard library, which properly handles non-ASCII characters
and special characters per RFC 6266.

Changes:
- weed/server/common.go: Updated adjustHeaderContentDisposition to use
  mime.FormatMediaType instead of manual escaping with fileNameEscaper
- weed/operation/upload_content.go: Updated multipart form Content-Disposition
  to use mime.FormatMediaType
- weed/server/volume_server_handlers_read.go: Removed unused fileNameEscaper

This ensures correct filename display for international users across
filer downloads and file uploads.

Fixes #7634
---
 weed/operation/upload_content.go           | 12 ++++++------
 weed/server/common.go                      | 11 ++++++-----
 weed/server/volume_server_handlers_read.go |  2 --
 3 files changed, 12 insertions(+), 13 deletions(-)

diff --git a/weed/operation/upload_content.go b/weed/operation/upload_content.go
index 90f90c87d..a2fff4792 100644
--- a/weed/operation/upload_content.go
+++ b/weed/operation/upload_content.go
@@ -90,10 +90,9 @@ func (uploadResult *UploadResult) ToPbFileChunkWithSSE(fileId string, offset int
 }
 
 var (
-	fileNameEscaper = strings.NewReplacer(`\`, `\\`, `"`, `\"`, "\n", "")
-	uploader        *Uploader
-	uploaderErr     error
-	once            sync.Once
+	uploader    *Uploader
+	uploaderErr error
+	once        sync.Once
 )
 
 // HTTPClient interface for testing
@@ -336,8 +335,9 @@ func (uploader *Uploader) upload_content(ctx context.Context, fillBufferFunction
 		body_writer = multipart.NewWriter(option.BytesBuffer)
 	}
 	h := make(textproto.MIMEHeader)
-	filename := fileNameEscaper.Replace(option.Filename)
-	h.Set("Content-Disposition", fmt.Sprintf(`form-data; name="file"; filename="%s"`, filename))
+	// Use mime.FormatMediaType for RFC 6266 compliant Content-Disposition,
+	// properly handling non-ASCII characters and special characters
+	h.Set("Content-Disposition", mime.FormatMediaType("form-data", map[string]string{"name": "file", "filename": option.Filename}))
 	h.Set("Idempotency-Key", option.UploadUrl)
 	if option.MimeType == "" {
 		option.MimeType = mime.TypeByExtension(strings.ToLower(filepath.Ext(option.Filename)))
diff --git a/weed/server/common.go b/weed/server/common.go
index 930695f4b..dfed891b4 100644
--- a/weed/server/common.go
+++ b/weed/server/common.go
@@ -9,9 +9,9 @@ import (
 	"fmt"
 	"io"
 	"io/fs"
+	"mime"
 	"mime/multipart"
 	"net/http"
-	"net/url"
 	"path/filepath"
 	"strconv"
 	"strings"
@@ -286,14 +286,15 @@ func adjustHeaderContentDisposition(w http.ResponseWriter, r *http.Request, file
 		return
 	}
 	if filename != "" {
-		filename = url.QueryEscape(filename)
-		contentDisposition := "inline"
+		dispositionType := "inline"
 		if r.FormValue("dl") != "" {
 			if dl, _ := strconv.ParseBool(r.FormValue("dl")); dl {
-				contentDisposition = "attachment"
+				dispositionType = "attachment"
 			}
 		}
-		w.Header().Set("Content-Disposition", contentDisposition+`; filename="`+fileNameEscaper.Replace(filename)+`"`)
+		// Use mime.FormatMediaType for RFC 6266 compliant Content-Disposition,
+		// properly handling non-ASCII characters and special characters
+		w.Header().Set("Content-Disposition", mime.FormatMediaType(dispositionType, map[string]string{"filename": filename}))
 	}
 }
 
diff --git a/weed/server/volume_server_handlers_read.go b/weed/server/volume_server_handlers_read.go
index a29ebd183..1fad742db 100644
--- a/weed/server/volume_server_handlers_read.go
+++ b/weed/server/volume_server_handlers_read.go
@@ -34,8 +34,6 @@ import (
 
 const reqIsProxied = "proxied"
 
-var fileNameEscaper = strings.NewReplacer(`\`, `\\`, `"`, `\"`)
-
 func NotFound(w http.ResponseWriter) {
 	stats.VolumeServerHandlerCounter.WithLabelValues(stats.ErrorGetNotFound).Inc()
 	w.WriteHeader(http.StatusNotFound)