From 477816aa2541d875454f1a6877d0b651bcaed988 Mon Sep 17 00:00:00 2001
From: Henrique Dias <hacdias@gmail.com>
Date: Wed, 26 Jul 2017 11:25:42 +0100
Subject: [PATCH] Comments and clean on download

Former-commit-id: 3d869836823fd87d28dcaa3d3280e8dfaaadf00d [formerly f8481d704990ba762ebf01995b157b3a4a034e9b] [formerly b2d229ddb0ef95d20bc51622ad62ff2c8a235b5a [formerly 0fc30ab1b60cff9c60efd18881cd3b5b4e7edb47]]
Former-commit-id: 79a72ef077f3be66ceb74d1496c336f3edcd18cd [formerly 031550bb40724ef2ce161305011a8432413b2840]
Former-commit-id: 5849301db71d34084b3a9a408197099fcfe4179c
---
 download.go | 34 +++++++++++++++++++++++-----------
 1 file changed, 23 insertions(+), 11 deletions(-)

diff --git a/download.go b/download.go
index 88cb735c..2d59ab48 100644
--- a/download.go
+++ b/download.go
@@ -9,6 +9,7 @@ import (
 	"path/filepath"
 	"strings"
 
+	"github.com/hacdias/filemanager/dir"
 	"github.com/mholt/archiver"
 )
 
@@ -17,6 +18,8 @@ import (
 func downloadHandler(c *RequestContext, w http.ResponseWriter, r *http.Request) (int, error) {
 	query := r.URL.Query().Get("format")
 
+	// If the file isn't a directory, serve it using http.ServeFile. We display it
+	// inline if it is requested.
 	if !c.FI.IsDir {
 		if r.URL.Query().Get("inline") == "true" {
 			w.Header().Set("Content-Disposition", "inline")
@@ -31,21 +34,25 @@ func downloadHandler(c *RequestContext, w http.ResponseWriter, r *http.Request)
 	files := []string{}
 	names := strings.Split(r.URL.Query().Get("files"), ",")
 
+	// If there are files in the query, sanitize their names.
+	// Otherwise, just append the current path.
 	if len(names) != 0 {
 		for _, name := range names {
+			// Unescape the name.
 			name, err := url.QueryUnescape(name)
-
 			if err != nil {
 				return http.StatusInternalServerError, err
 			}
 
+			// Clean the slashes.
+			name = dir.SlashClean(name)
 			files = append(files, filepath.Join(c.FI.Path, name))
 		}
-
 	} else {
 		files = append(files, c.FI.Path)
 	}
 
+	// If the format is true, just set it to "zip".
 	if query == "true" {
 		query = "zip"
 	}
@@ -57,12 +64,13 @@ func downloadHandler(c *RequestContext, w http.ResponseWriter, r *http.Request)
 		tempfile  string
 	)
 
+	// Create a temporary directory.
 	temp, err = ioutil.TempDir("", "")
 	if err != nil {
 		return http.StatusInternalServerError, err
 	}
-
 	defer os.RemoveAll(temp)
+
 	tempfile = filepath.Join(temp, "temp")
 
 	switch query {
@@ -84,17 +92,21 @@ func downloadHandler(c *RequestContext, w http.ResponseWriter, r *http.Request)
 		return http.StatusInternalServerError, err
 	}
 
-	file, err := os.Open(temp + "/temp")
-	if err != nil {
-		return http.StatusInternalServerError, err
-	}
-
+	// Defines the file name.
 	name := c.FI.Name
 	if name == "." || name == "" {
 		name = "download"
 	}
+	name += extension
 
-	w.Header().Set("Content-Disposition", "attachment; filename="+name+extension)
-	io.Copy(w, file)
-	return 0, nil
+	// Opens the file so it can be downloaded.
+	file, err := os.Open(temp + "/temp")
+	if err != nil {
+		return http.StatusInternalServerError, err
+	}
+	defer file.Close()
+
+	w.Header().Set("Content-Disposition", "attachment; filename="+name)
+	_, err = io.Copy(w, file)
+	return 0, err
 }