From 9d76a9f82c2d0b047647fb9e2876a4326f8dc927 Mon Sep 17 00:00:00 2001
From: labkey-susanh <susanh@labkey.com>
Date: Tue, 8 Jul 2025 09:21:20 -0700
Subject: [PATCH] Issue 53408: Encode field names in attachment download links

---
 .../org/labkey/experiment/api/ExpDataClassDataTableImpl.java  | 4 ++--
 list/src/org/labkey/list/model/ListTable.java                 | 3 ++-
 2 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/experiment/src/org/labkey/experiment/api/ExpDataClassDataTableImpl.java b/experiment/src/org/labkey/experiment/api/ExpDataClassDataTableImpl.java
index 90408498d8b..71e13dba83e 100644
--- a/experiment/src/org/labkey/experiment/api/ExpDataClassDataTableImpl.java
+++ b/experiment/src/org/labkey/experiment/api/ExpDataClassDataTableImpl.java
@@ -537,7 +537,7 @@ private void configureAttachmentURL(MutableColumnInfo col)
     {
         ActionURL url = new ActionURL(ExperimentController.DataClassAttachmentDownloadAction.class, getUserSchema().getContainer())
                 .addParameter("lsid", "${LSID}")
-                .addParameter("name", "${" + col.getName() + "}");
+                .addParameter("name", "${" + PageFlowUtil.encode(col.getName()) + "}");
         if (FileLinkDisplayColumn.AS_ATTACHMENT_FORMAT.equalsIgnoreCase(col.getFormat()))
         {
             url.addParameter("inline", "false");
@@ -622,7 +622,7 @@ public void decorateColumn(MutableColumnInfo columnInfo, PropertyDescriptor pd)
                     columnInfo.setURL(StringExpressionFactory.createURL(
                             new ActionURL(ExperimentController.DataClassAttachmentDownloadAction.class, getContainer())
                                     .addParameter("lsid", "${LSID}")
-                                    .addParameter("name", "${" + columnInfo.getFieldKey() + "}")));
+                                    .addParameter("name", "${" + PageFlowUtil.encode(columnInfo.getName()) + "}")));
 
                 }
 
diff --git a/list/src/org/labkey/list/model/ListTable.java b/list/src/org/labkey/list/model/ListTable.java
index 07ef3f2d493..c6feb8cd2bd 100644
--- a/list/src/org/labkey/list/model/ListTable.java
+++ b/list/src/org/labkey/list/model/ListTable.java
@@ -70,6 +70,7 @@
 import org.labkey.api.security.permissions.UpdatePermission;
 import org.labkey.api.study.assay.FileLinkDisplayColumn;
 import org.labkey.api.util.ContainerContext;
+import org.labkey.api.util.PageFlowUtil;
 import org.labkey.api.util.StringExpressionFactory;
 import org.labkey.api.view.ActionURL;
 import org.labkey.data.xml.TableType;
@@ -366,7 +367,7 @@ public void overlayMetadata(Collection<TableType> metadata, UserSchema schema, C
 
     private void configureAttachmentURL(MutableColumnInfo col)
     {
-        ActionURL url = ListController.getDownloadURL(_list, "${EntityId}", "${" + col.getName() + "}");
+        ActionURL url = ListController.getDownloadURL(_list, "${EntityId}", "${" + PageFlowUtil.encode(col.getName()) + "}");
         if (FileLinkDisplayColumn.AS_ATTACHMENT_FORMAT.equalsIgnoreCase(col.getFormat()))
         {
             url.addParameter("inline", "false");