hgweb: Quote filenames when downloading raw files.

mercurial/hgweb/request.py

@@ -85,8 +85,10 b' class wsgirequest(object):'
         if type is not None:
             headers.append(('Content-Type', type))
         if filename:
+            filename = (filename.split('/')[-1]
+                        .replace('\\', '\\\\').replace('"', '\\"'))
             headers.append(('Content-Disposition',
-                            'inline; filename=%s' % filename.split('/')[-1]))
+                            'inline; filename="%s"' % filename))
         if length:
             headers.append(('Content-Length', str(length)))
         self.header(headers)

tests/test-webraw

@@ -3,17 +3,17 b''
 hg init test
 cd test
 mkdir sub
-cat >sub/sometext.txt <<ENDSOME
+cat >'sub/some "text".txt' <<ENDSOME
 This is just some random text
 that will go inside the file and take a few lines.
 It is very boring to read, but computers don't
 care about things like that.
 ENDSOME
-hg add sub/sometext.txt
+hg add 'sub/some "text".txt'
 hg commit -d "1 0" -m "Just some text"
 hg serve -p $HGPORT -A access.log -E error.log -d --pid-file=hg.pid
 cat hg.pid >> $DAEMON_PIDS
-("$TESTDIR/get-with-headers.py" localhost:$HGPORT '/?f=37afcac6d393;file=sub/sometext.txt;style=raw' content-type content-length content-disposition) >getoutput.txt &
+("$TESTDIR/get-with-headers.py" localhost:$HGPORT '/?f=a23bf1310f6e;file=sub/some%20%22text%22.txt;style=raw' content-type content-length content-disposition) >getoutput.txt &
 
 sleep 5
 kill `cat hg.pid`

tests/test-webraw.out

@@ -1,10 +1,10 b''
 200 Script output follows
 content-type: text/plain
 content-length: 157
-content-disposition: inline; filename=sometext.txt
+content-disposition: inline; filename="some \"text\".txt"
 
 This is just some random text
 that will go inside the file and take a few lines.
 It is very boring to read, but computers don't
 care about things like that.
-host - - [date] "GET /?f=37afcac6d393;file=sub/sometext.txt;style=raw HTTP/1.1" 200 -
+host - - [date] "GET /?f=a23bf1310f6e;file=sub/some%20%22text%22.txt;style=raw HTTP/1.1" 200 -