make sure to generate valid filenames (#2238)

src/Export/Base/PDFRenderer.php

@@ -13,6 +13,7 @@ use App\Export\ExportContext;
 use App\Export\ExportItemInterface;
 use App\Repository\ProjectRepository;
 use App\Repository\Query\TimesheetQuery;
+use App\Utils\FileHelper;
 use App\Utils\HtmlToPdfConverter;
 use Symfony\Component\HttpFoundation\Response;
 use Symfony\Component\HttpFoundation\ResponseHeaderBag;
@@ -94,7 +95,7 @@ class PDFRenderer
     public function render(array $timesheets, TimesheetQuery $query): Response
     {
         $context = new ExportContext();
-        $context->setOption('filename', 'kimai-export.pdf');
+        $context->setOption('filename', 'kimai-export');
 
         $summary = $this->calculateSummary($timesheets);
         $content = $this->twig->render($this->getTemplate(), array_merge([
@@ -116,10 +117,12 @@ class PDFRenderer
 
         $filename = $context->getOption('filename');
         if (empty($filename)) {
-            $filename = 'kimai-export.pdf';
+            $filename = 'kimai-export';
         }
 
-        $disposition = $response->headers->makeDisposition(ResponseHeaderBag::DISPOSITION_ATTACHMENT, $filename);
+        $filename = FileHelper::convertToAsciiFilename($filename);
+
+        $disposition = $response->headers->makeDisposition(ResponseHeaderBag::DISPOSITION_ATTACHMENT, $filename . '.pdf');
 
         $response->headers->set('Content-Type', 'application/pdf');
         $response->headers->set('Content-Disposition', $disposition);

src/Invoice/InvoiceFilename.php

@@ -10,7 +10,7 @@
 namespace App\Invoice;
 
 use App\Entity\Project;
-use Symfony\Component\String\UnicodeString;
+use App\Utils\FileHelper;
 
 final class InvoiceFilename
 {
@@ -31,8 +31,7 @@ final class InvoiceFilename
         }
 
         if (!empty($company)) {
-            $uCompany = new UnicodeString($company);
-            $filename .= '-' . $uCompany->ascii()->snake();
+            $filename .= '-' . $this->convert($company);
         }
 
         if (null !== $model->getQuery()) {
@@ -40,8 +39,7 @@ final class InvoiceFilename
             if (\count($projects) === 1) {
                 $pName = $projects[0];
                 if ($pName instanceof Project) {
-                    $uProject = new UnicodeString($pName->getName());
-                    $filename .= '-' . $uProject->ascii()->snake();
+                    $filename .= '-' . $this->convert($pName->getName());
                 }
             }
         }
@@ -49,6 +47,11 @@ final class InvoiceFilename
         $this->filename = $filename;
     }
 
+    private function convert(string $filename): string
+    {
+        return FileHelper::convertToAsciiFilename($filename);
+    }
+
     public function getFilename()
     {
         return $this->filename;

src/Utils/FileHelper.php

@@ -10,6 +10,7 @@
 namespace App\Utils;
 
 use Symfony\Component\Filesystem\Filesystem;
+use Symfony\Component\String\UnicodeString;
 
 final class FileHelper
 {
@@ -68,4 +69,20 @@ final class FileHelper
     {
         $this->filesystem->remove($filename);
     }
+
+    public static function convertToAsciiFilename(string $filename): string
+    {
+        $filename = new UnicodeString($filename);
+        $filename = (string) $filename->collapseWhitespace()->trim()->replace(PHP_EOL, '')->replace(' ', '_');
+
+        $dangerousCharacters = ['"', "'", '&', '/', '\\', '?', '#', '%'];
+        $filename = str_replace($dangerousCharacters, ' ', $filename);
+
+        $filename = new UnicodeString($filename);
+        $filename = (string) $filename->collapseWhitespace()->replace(' ', '_')->ascii()->trim();
+        $filename = preg_replace('/[^a-zA-Z0-9\x7f-\xff\-]++/', ' ', $filename);
+        $filename = str_replace(' ', '_', trim($filename));
+
+        return $filename;
+    }
 }