From 7f66926c41f2a40b5aaedb05b71eef472630975b Mon Sep 17 00:00:00 2001
From: Simon Ser <contact@emersion.fr>
Date: Mon, 11 Mar 2024 11:46:26 +0100
Subject: [PATCH] fileupload: URL-escape output filename

If the source filename contains special characters like "%", we
would return them as-is in the final URL, and try to parse them as
a URL encoded escape sequence in the GET request.
---
 fileupload/fs.go | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/fileupload/fs.go b/fileupload/fs.go
index d0bff2b..557dcdd 100644
--- a/fileupload/fs.go
+++ b/fileupload/fs.go
@@ -4,6 +4,7 @@ import (
 	"fmt"
 	"io"
 	"mime"
+	"net/url"
 	"os"
 	"path/filepath"
 	"strings"
@@ -92,5 +93,5 @@ func (fs *fs) store(r io.Reader, username, mimeType, origBasename string) (outFi
 		return "", fmt.Errorf("failed to close file: %v", err)
 	}
 
-	return username + "/" + filepath.Base(f.Name()), nil
+	return url.PathEscape(username) + "/" + url.PathEscape(filepath.Base(f.Name())), nil
 }