From b419a6025f94f7e6262633ce1ff5b4c3e37e8483 Mon Sep 17 00:00:00 2001
From: Abhinav Adduri <abhinadduri@gmail.com>
Date: Thu, 13 Jul 2017 12:53:15 -0700
Subject: [PATCH] fixes issues 195 and 192

---
 frontend/src/download.js   | 6 +++---
 frontend/src/fileSender.js | 2 +-
 server/server.js           | 6 +++---
 3 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/frontend/src/download.js b/frontend/src/download.js
index f16adf40..4100996a 100644
--- a/frontend/src/download.js
+++ b/frontend/src/download.js
@@ -65,7 +65,7 @@ $(document).ready(function() {
         return;
       })
       .then(([decrypted, fname]) => {
-        name.innerText = fname;
+        name.innerText = decodeURIComponent(fname);
         const dataView = new DataView(decrypted);
         const blob = new Blob([dataView]);
         const downloadUrl = URL.createObjectURL(blob);
@@ -74,10 +74,10 @@ $(document).ready(function() {
         a.href = downloadUrl;
         if (window.navigator.msSaveBlob) {
           // if we are in microsoft edge or IE
-          window.navigator.msSaveBlob(blob, fname);
+          window.navigator.msSaveBlob(blob, decodeURIComponent(fname));
           return;
         }
-        a.download = fname;
+        a.download = decodeURIComponent(fname);
         document.body.appendChild(a);
         a.click();
       })
diff --git a/frontend/src/fileSender.js b/frontend/src/fileSender.js
index 888e1de4..0e1b32ba 100644
--- a/frontend/src/fileSender.js
+++ b/frontend/src/fileSender.js
@@ -131,7 +131,7 @@ class FileSender extends EventEmitter {
             JSON.stringify({
               aad: arrayToHex(hash),
               id: fileId,
-              filename: file.name
+              filename: encodeURIComponent(file.name)
             })
           );
           xhr.send(fd);
diff --git a/server/server.js b/server/server.js
index e3c838a0..0508f092 100644
--- a/server/server.js
+++ b/server/server.js
@@ -94,7 +94,7 @@ app.get('/download/:id', (req, res) => {
       .length(id)
       .then(contentLength => {
         res.render('download', {
-          filename: filename,
+          filename: decodeURI(filename),
           filesize: bytes(contentLength),
           trackerId: conf.analytics_id,
           dsn: conf.sentry_id
@@ -189,10 +189,10 @@ app.post('/upload', (req, res, next) => {
   }
 
   if (
-    !validateIV(meta.id) ||
     !meta.hasOwnProperty('aad') ||
     !meta.hasOwnProperty('id') ||
-    !meta.hasOwnProperty('filename')
+    !meta.hasOwnProperty('filename' ||
+    !validateIV(meta.id))
   ) {
     res.sendStatus(404);
     return;