diff --git a/CHANGES.rst b/CHANGES.rst index 92e11e2a..73b5eb98 100644 --- a/CHANGES.rst +++ b/CHANGES.rst @@ -92,6 +92,8 @@ Unreleased - The key information for ``BadRequestKeyError`` is no longer cleared outside debug mode, so error handlers can still access it. This requires upgrading to Werkzeug 0.15.5. :issue:`3249` +- ``send_file`` url quotes the ":" and "/" characters for more + compatible UTF-8 filename support in some browsers. :issue:`3074` Version 1.0.3 diff --git a/README.rst b/README.rst index 29aa8a90..6e574323 100644 --- a/README.rst +++ b/README.rst @@ -71,7 +71,7 @@ Links * Releases: https://pypi.org/project/Flask/ * Code: https://github.com/pallets/flask * Issue tracker: https://github.com/pallets/flask/issues -* Test status: https://dev.azure.com/pallets/pallets/_build?definitionId=2 +* Test status: https://dev.azure.com/pallets/flask/_build * Official chat: https://discord.gg/t6rrQZH .. _WSGI: https://wsgi.readthedocs.io diff --git a/src/flask/helpers.py b/src/flask/helpers.py index 1ae54816..b121d040 100644 --- a/src/flask/helpers.py +++ b/src/flask/helpers.py @@ -610,7 +610,7 @@ def send_file( "filename": unicodedata.normalize("NFKD", attachment_filename).encode( "ascii", "ignore" ), - "filename*": "UTF-8''%s" % url_quote(attachment_filename), + 'filename*': "UTF-8''%s" % url_quote(attachment_filename, safe=b""), } else: filenames = {"filename": attachment_filename} diff --git a/tests/test_helpers.py b/tests/test_helpers.py index 01fb4c34..3d4b2782 100644 --- a/tests/test_helpers.py +++ b/tests/test_helpers.py @@ -697,6 +697,8 @@ class TestSendfile(object): (u"Vögel.txt", "Vogel.txt", "V%C3%B6gel.txt"), # Native string not marked as Unicode on Python 2 ("tést.txt", "test.txt", "t%C3%A9st.txt"), + # ":/" are not safe in filename* value + (u"те:/ст", '":/"', "%D1%82%D0%B5%3A%2F%D1%81%D1%82"), ), ) def test_attachment_filename_encoding(self, filename, ascii, utf8):