From 43c4dfc5dfeb282f71bf832c149e42b1392662ac Mon Sep 17 00:00:00 2001
From: strawberry <strawberry@puppygock.gay>
Date: Sun, 5 May 2024 15:06:11 -0400
Subject: [PATCH] set content-disposition to attachment instead of inline

Signed-off-by: strawberry <strawberry@puppygock.gay>
---
 src/api/client_server/media.rs | 13 +++++++------
 src/service/media/mod.rs       |  1 +
 2 files changed, 8 insertions(+), 6 deletions(-)

diff --git a/src/api/client_server/media.rs b/src/api/client_server/media.rs
index 1ba1c6be..b2355138 100644
--- a/src/api/client_server/media.rs
+++ b/src/api/client_server/media.rs
@@ -130,7 +130,7 @@ pub(crate) async fn create_content_route(
 			mxc.clone(),
 			body.filename
 				.as_ref()
-				.map(|filename| "inline; filename=".to_owned() + filename)
+				.map(|filename| format!("attachment; filename={filename}"))
 				.as_deref(),
 			body.content_type.as_deref(),
 			&body.file,
@@ -173,15 +173,16 @@ pub(crate) async fn get_content_route(body: Ruma<get_content::v3::Request>) -> R
 	let mxc = format!("mxc://{}/{}", body.server_name, body.media_id);
 
 	if let Some(FileMeta {
-		content_disposition,
 		content_type,
 		file,
+		..
 	}) = services().media.get(mxc.clone()).await?
 	{
+		// TODO: safely sanitise filename to be included in the content-disposition
 		Ok(get_content::v3::Response {
 			file,
 			content_type,
-			content_disposition,
+			content_disposition: Some("attachment".to_owned()),
 			cross_origin_resource_policy: Some(CORP_CROSS_ORIGIN.to_owned()),
 			cache_control: Some(CACHE_CONTROL_IMMUTABLE.into()),
 		})
@@ -243,7 +244,7 @@ pub(crate) async fn get_content_as_filename_route(
 		Ok(get_content_as_filename::v3::Response {
 			file,
 			content_type,
-			content_disposition: Some(format!("inline; filename={}", body.filename)),
+			content_disposition: Some("attachment".to_owned()),
 			cross_origin_resource_policy: Some(CORP_CROSS_ORIGIN.to_owned()),
 			cache_control: Some(CACHE_CONTROL_IMMUTABLE.into()),
 		})
@@ -258,7 +259,7 @@ pub(crate) async fn get_content_as_filename_route(
 		.await
 		{
 			Ok(remote_content_response) => Ok(get_content_as_filename::v3::Response {
-				content_disposition: Some(format!("inline: filename={}", body.filename)),
+				content_disposition: Some("attachment".to_owned()),
 				content_type: remote_content_response.content_type,
 				file: remote_content_response.file,
 				cross_origin_resource_policy: Some(CORP_CROSS_ORIGIN.to_owned()),
@@ -434,7 +435,7 @@ async fn get_remote_content(
 		.create(
 			None,
 			mxc.to_owned(),
-			content_response.content_disposition.as_deref(),
+			Some("attachment"),
 			content_response.content_type.as_deref(),
 			&content_response.file,
 		)
diff --git a/src/service/media/mod.rs b/src/service/media/mod.rs
index e87889d3..4b52ff9c 100644
--- a/src/service/media/mod.rs
+++ b/src/service/media/mod.rs
@@ -16,6 +16,7 @@ use crate::{services, utils, Error, Result};
 
 #[derive(Debug)]
 pub(crate) struct FileMeta {
+	#[allow(dead_code)]
 	pub(crate) content_disposition: Option<String>,
 	pub(crate) content_type: Option<String>,
 	pub(crate) file: Vec<u8>,