Randy Syring  committed a546224

refs #458 - full paths as file name when IE7 sends UNC path

made a change to unquote_header_value() to prevent the leading double slash in a UNC path from getting unquoted.

  • Participants
  • Parent commits cd9f1b6
  • Branches default

Comments (0)

Files changed (2)

File tests/

         assert == repr(text)
-def test_ie7_full_path():
+def test_ie7_unc_path():
     client = Client(form_data_consumer, Response)
     data_file = join(dirname(__file__), 'multipart', 'ie7_full_path_request.txt')
     data = get_contents(data_file)
     boundary = '---------------------------7da36d1b4a0164'
     response ='/?object=cb_file_upload_multiple', data=data, content_type=
                                'multipart/form-data; boundary="%s"' % boundary, content_length=len(data))
-    lines ='\n', 3)[0:3]
-    assert lines[0] == "'Sellersburg Town Council Meeting 02-22-2010doc.doc'", lines[0]
+    lines ='\n', 3)
+    assert lines[0] == repr(u'Sellersburg Town Council Meeting 02-22-2010doc.doc'), lines[0]
 def test_end_of_file_multipart():
     """Test for multipart files ending unexpectedly"""

File werkzeug/

     return '"%s"' % value.replace('\\', '\\\\').replace('"', '\\"')
-def unquote_header_value(value):
+def unquote_header_value(value, is_filename = False):
     r"""Unquotes a header value.  (Reversal of :func:`quote_header_value`).
     This does not use the real unquoting but what browsers are actually
     using for quoting.
         # RFC is met will result in bugs with internet explorer and
         # probably some other browsers as well.  IE for example is
         # uploading files with "C:\foo\bar.txt" as filename
-        value = value[1:-1].replace('\\\\', '\\').replace('\\"', '"')
+        value = value[1:-1]
+        # if this is a filename and the starting characters look like
+        # a UNC path, then just return the value without quotes.  Using the
+        # replace sequence below on a UNC path has the effect of turning
+        # the leading double slash into a single slash and then
+        # _fix_ie_filename() doesn't work correctly.  See #458.
+        if not is_filename or value[:2] != '\\\\':
+            return value.replace('\\\\', '\\').replace('\\"', '"')
     return value
             key, value = match.groups()
             key = unquote_header_value(key)
             if value is not None:
-                value = unquote_header_value(value)
+                value = unquote_header_value(value, key == 'filename')
             yield key, value
     if not value: