-
Notifications
You must be signed in to change notification settings - Fork 25
fix: archive download on password protected links #1523
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Conversation
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Pull Request Overview
This PR adds support for password-protected public links when downloading archives. The implementation allows archives to be downloaded from public links that require authentication by adding a publicLinkPassword parameter and handling the authentication via Basic Auth.
Key changes:
- Added
publicLinkPasswordparameter to archive download options - Implemented client-side fetch with Basic Auth for password-protected archives
- Integrated password retrieval from auth store in the download archive action
Reviewed Changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 4 comments.
| File | Description |
|---|---|
| packages/web-pkg/src/services/archiver.ts | Added publicLinkPassword parameter and conditional fetch logic with Basic Auth for password-protected archives |
| packages/web-pkg/src/composables/actions/files/useFileActionsDownloadArchive.ts | Integrated authStore to pass publicLinkPassword to archiver service for public space resources |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
|
|
||
| const blob = await response.blob() | ||
| url = URL.createObjectURL(blob) | ||
| fileName = decodeURI(response.headers.get('content-disposition')?.split('"')[1]) |
Copilot
AI
Nov 5, 2025
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This line will throw a TypeError if content-disposition header is missing or doesn't contain quotes. The optional chaining stops at get(), but split('"')[1] will fail if the header is null/undefined or doesn't have the expected format. Consider adding proper null checks: const contentDisposition = response.headers.get('content-disposition'); fileName = contentDisposition?.split('\"')[1] ? decodeURI(contentDisposition.split('\"')[1]) : 'archive';
| fileName = decodeURI(response.headers.get('content-disposition')?.split('"')[1]) | |
| { | |
| const contentDisposition = response.headers.get('content-disposition'); | |
| // Try to extract filename from header (handles quoted and unquoted) | |
| const match = contentDisposition && contentDisposition.match(/filename\*?=(?:UTF-8'')?("?)([^";]+)\1/); | |
| fileName = match ? decodeURI(match[2]) : 'archive'; | |
| } |
61253ff to
532562d
Compare
532562d to
3cf16ce
Compare
kulmann
left a comment
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I'm 🥲 that we need it, but thank you for the fix either way!
…er-2 fix: archive download on password protected links
💚 All backports created successfully
Questions ?Please refer to the Backport tool documentation |
Undo the change from c7072a7 for password protected links for now, until we ditch client-side signing.
refs opencloud-eu/opencloud#1712