Issue 53408: Encode field names in attachment download links (#6827)

Author: labkey-susanh

experiment/src/org/labkey/experiment/api/ExpDataClassDataTableImpl.java

@@ -537,7 +537,7 @@ private void configureAttachmentURL(MutableColumnInfo col)
     {
         ActionURL url = new ActionURL(ExperimentController.DataClassAttachmentDownloadAction.class, getUserSchema().getContainer())
                 .addParameter("lsid", "${LSID}")
-                .addParameter("name", "${" + col.getName() + "}");
+                .addParameter("name", "${" + PageFlowUtil.encode(col.getName()) + "}");
         if (FileLinkDisplayColumn.AS_ATTACHMENT_FORMAT.equalsIgnoreCase(col.getFormat()))
         {
             url.addParameter("inline", "false");
@@ -622,7 +622,7 @@ public void decorateColumn(MutableColumnInfo columnInfo, PropertyDescriptor pd)
                     columnInfo.setURL(StringExpressionFactory.createURL(
                             new ActionURL(ExperimentController.DataClassAttachmentDownloadAction.class, getContainer())
                                     .addParameter("lsid", "${LSID}")
-                                    .addParameter("name", "${" + columnInfo.getFieldKey() + "}")));
+                                    .addParameter("name", "${" + PageFlowUtil.encode(columnInfo.getName()) + "}")));
 
                 }
 

list/src/org/labkey/list/model/ListTable.java

@@ -70,6 +70,7 @@
 import org.labkey.api.security.permissions.UpdatePermission;
 import org.labkey.api.study.assay.FileLinkDisplayColumn;
 import org.labkey.api.util.ContainerContext;
+import org.labkey.api.util.PageFlowUtil;
 import org.labkey.api.util.StringExpressionFactory;
 import org.labkey.api.view.ActionURL;
 import org.labkey.data.xml.TableType;
@@ -366,7 +367,7 @@ public void overlayMetadata(Collection<TableType> metadata, UserSchema schema, C
 
     private void configureAttachmentURL(MutableColumnInfo col)
     {
-        ActionURL url = ListController.getDownloadURL(_list, "${EntityId}", "${" + col.getName() + "}");
+        ActionURL url = ListController.getDownloadURL(_list, "${EntityId}", "${" + PageFlowUtil.encode(col.getName()) + "}");
         if (FileLinkDisplayColumn.AS_ATTACHMENT_FORMAT.equalsIgnoreCase(col.getFormat()))
         {
             url.addParameter("inline", "false");