From e3eb75bd234c8e21ff937d4f9b2a4a1328007e32 Mon Sep 17 00:00:00 2001
From: "Haelwenn (lanodan) Monnier" <contact@hacktivis.me>
Date: Tue, 15 Jan 2019 07:40:00 +0100
Subject: [PATCH 1/2] Upload: Fix uploading with a ? in the filename

---
 lib/pleroma/upload.ex |  7 ++++++-
 test/upload_test.exs  | 15 +++++++++++++++
 2 files changed, 21 insertions(+), 1 deletion(-)

diff --git a/lib/pleroma/upload.ex b/lib/pleroma/upload.ex
index 185ba25fa..1d8b073af 100644
--- a/lib/pleroma/upload.ex
+++ b/lib/pleroma/upload.ex
@@ -215,7 +215,12 @@ defp tempfile_for_image(data) do
   end
 
   defp url_from_spec(base_url, {:file, path}) do
-    [base_url, "media", URI.encode(path)]
+    path =
+      path
+      |> URI.encode()
+      |> String.replace("?", "%3F")
+
+    [base_url, "media", path]
     |> Path.join()
   end
 
diff --git a/test/upload_test.exs b/test/upload_test.exs
index bda503361..ffef74270 100644
--- a/test/upload_test.exs
+++ b/test/upload_test.exs
@@ -152,5 +152,20 @@ test "escapes invalid characters in url" do
 
       assert Path.basename(attachment_url["href"]) == "an%E2%80%A6%20image.jpg"
     end
+
+    test "replaces ? (question-mark) to %3f" do
+      File.cp!("test/fixtures/image.jpg", "test/fixtures/image_tmp.jpg")
+
+      file = %Plug.Upload{
+        content_type: "image/jpg",
+        path: Path.absname("test/fixtures/image_tmp.jpg"),
+        filename: "an?image.jpg"
+      }
+
+      {:ok, data} = Upload.store(file)
+      [attachment_url | _] = data["url"]
+
+      assert Path.basename(attachment_url["href"]) == "an%3Fimage.jpg"
+    end
   end
 end

From 9fcdca1bdca04bdb52b7ac9a0d69e0886b12cb87 Mon Sep 17 00:00:00 2001
From: "Haelwenn (lanodan) Monnier" <contact@hacktivis.me>
Date: Tue, 15 Jan 2019 07:57:48 +0100
Subject: [PATCH 2/2] Upload: Fix uploading with a : in the filename

---
 lib/pleroma/upload.ex | 1 +
 test/upload_test.exs  | 6 +++---
 2 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/lib/pleroma/upload.ex b/lib/pleroma/upload.ex
index 1d8b073af..b19920dff 100644
--- a/lib/pleroma/upload.ex
+++ b/lib/pleroma/upload.ex
@@ -219,6 +219,7 @@ defp url_from_spec(base_url, {:file, path}) do
       path
       |> URI.encode()
       |> String.replace("?", "%3F")
+      |> String.replace(":", "%3A")
 
     [base_url, "media", path]
     |> Path.join()
diff --git a/test/upload_test.exs b/test/upload_test.exs
index ffef74270..b2d9eca38 100644
--- a/test/upload_test.exs
+++ b/test/upload_test.exs
@@ -153,19 +153,19 @@ test "escapes invalid characters in url" do
       assert Path.basename(attachment_url["href"]) == "an%E2%80%A6%20image.jpg"
     end
 
-    test "replaces ? (question-mark) to %3f" do
+    test "replaces : (colon) and ? (question-mark) to %3A and %3F (respectively)" do
       File.cp!("test/fixtures/image.jpg", "test/fixtures/image_tmp.jpg")
 
       file = %Plug.Upload{
         content_type: "image/jpg",
         path: Path.absname("test/fixtures/image_tmp.jpg"),
-        filename: "an?image.jpg"
+        filename: "is:an?image.jpg"
       }
 
       {:ok, data} = Upload.store(file)
       [attachment_url | _] = data["url"]
 
-      assert Path.basename(attachment_url["href"]) == "an%3Fimage.jpg"
+      assert Path.basename(attachment_url["href"]) == "is%3Aan%3Fimage.jpg"
     end
   end
 end