From d2f77f2bd213d64effb079cfcdcf6ab264cbbccf Mon Sep 17 00:00:00 2001
From: Paul Richards <paul@mantisforge.org>
Date: Sat, 23 May 2009 16:23:54 +0100
Subject: [PATCH] Fix: 0010421: Default filename corrupted if project name
 contains special chars

---
 core/excel_api.php   | 1 +
 core/file_api.php    | 2 +-
 csv_export.php       | 4 ++--
 excel_xml_export.php | 3 +--
 4 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/core/excel_api.php b/core/excel_api.php
index 8035d2b5ef..b9989cf63c 100644
--- a/core/excel_api.php
+++ b/core/excel_api.php
@@ -30,6 +30,7 @@
  * @returns the header Xml.
  */
 function excel_get_header( $p_worksheet_title ) {
+	$p_worksheet_title = preg_replace( '/[\/:*?"<>|]/', '', $p_worksheet_title );
 	return "<?xml version=\"1.0\" encoding=\"UTF-8\"?><?mso-application progid=\"Excel.Sheet\"?>
  <Workbook xmlns=\"urn:schemas-microsoft-com:office:spreadsheet\"
  xmlns:x=\"urn:schemas-microsoft-com:office:excel\"
diff --git a/core/file_api.php b/core/file_api.php
index bfe6f67010..6849e846d2 100644
--- a/core/file_api.php
+++ b/core/file_api.php
@@ -557,7 +557,7 @@ function file_type_check( $p_file_name ) {
 
 # clean file name by removing sensitive characters and replacing them with underscores
 function file_clean_name( $p_filename ) {
-	return preg_replace( "/[\/\\ :&]/", "_", $p_filename );
+	return preg_replace( '/[\/*?"<>|\\ :&]/', "_", $p_filename );
 }
 
 # Generate a string to use as the identifier for the file
diff --git a/csv_export.php b/csv_export.php
index d2ed07b4e6..a1f7165d1d 100644
--- a/csv_export.php
+++ b/csv_export.php
@@ -56,11 +56,11 @@
 	# Make sure that IE can download the attachments under https.
 	header( 'Pragma: public' );
 
-	header( 'Content-Type: text/plain; name=' . urlencode( $t_filename ) );
+	header( 'Content-Type: text/plain; name=' . urlencode( file_clean_name( $t_filename ) ) );
 	header( 'Content-Transfer-Encoding: BASE64;' );
 
 	# Added Quotes (") around file name.
-	header( 'Content-Disposition: attachment; filename="' . urlencode( $t_filename ) . '"' );
+	header( 'Content-Disposition: attachment; filename="' . urlencode( file_clean_name( $t_filename ) ) . '"' );
 
 	# Get columns to be exported
 	$t_columns = csv_get_columns();
diff --git a/excel_xml_export.php b/excel_xml_export.php
index 94eef5280c..51e5ce03c2 100644
--- a/excel_xml_export.php
+++ b/excel_xml_export.php
@@ -44,7 +44,6 @@
 	helper_begin_long_process();
 
 	$t_export_title = excel_get_default_filename();
-	$t_export_title = preg_replace( '/[\/:*?"<>|]/', '', $t_export_title );
 
 	$t_short_date_format = config_get( 'short_date_format' );
 
@@ -62,7 +61,7 @@
 	header( 'Content-Type: application/vnd.ms-excel; charset=UTF-8' );
 	header( 'Pragma: public' );
 	header( 'Content-Type: application/vnd.ms-excel' );
-	header( 'Content-Disposition: attachment; filename="' . urlencode( $t_export_title ) . '.xml"' ) ;
+	header( 'Content-Disposition: attachment; filename="' . urlencode( file_clean_name( $t_export_title ) ) . '.xml"' ) ;
 
 	echo excel_get_header( $t_export_title );
 	echo excel_get_titles_row();