From c9340af8d045671ad3338c5d2d887c335ab92de4 Mon Sep 17 00:00:00 2001
From: Oleg Lobanov <oleg@lobanov.me>
Date: Tue, 28 Jul 2020 11:19:45 +0200
Subject: [PATCH] fix: escape special characters in preview url (closes #1002)

---
 frontend/src/components/files/Preview.vue | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/frontend/src/components/files/Preview.vue b/frontend/src/components/files/Preview.vue
index b065d185..f2c39092 100644
--- a/frontend/src/components/files/Preview.vue
+++ b/frontend/src/components/files/Preview.vue
@@ -99,13 +99,13 @@ export default {
       return (this.nextLink !== '')
     },
     download () {
-      return `${baseURL}/api/raw${this.req.path}?auth=${this.jwt}`
+      return `${baseURL}/api/raw${escape(this.req.path)}?auth=${this.jwt}`
     },
     previewUrl () {
       if (this.req.type === 'image') {
-        return `${baseURL}/api/preview/big${this.req.path}?auth=${this.jwt}`
+        return `${baseURL}/api/preview/big${escape(this.req.path)}?auth=${this.jwt}`
       }
-      return `${baseURL}/api/raw${this.req.path}?auth=${this.jwt}`
+      return `${baseURL}/api/raw${escape(this.req.path)}?auth=${this.jwt}`
     },
     raw () {
       return `${this.previewUrl}&inline=true`