From ce10e293517228018ab8a761df48e5effa4dcdb9 Mon Sep 17 00:00:00 2001 From: def Date: Sun, 7 Nov 2021 17:01:48 +0100 Subject: [PATCH] Escape skin name when downloading (fixes #4333) --- src/game/client/components/skins.cpp | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/src/game/client/components/skins.cpp b/src/game/client/components/skins.cpp index 061f81a48..46e85c7e4 100644 --- a/src/game/client/components/skins.cpp +++ b/src/game/client/components/skins.cpp @@ -422,7 +422,9 @@ int CSkins::FindImpl(const char *pName) str_copy(Skin.m_aName, pName, sizeof(Skin.m_aName)); char aUrl[256]; - str_format(aUrl, sizeof(aUrl), "%s%s.png", g_Config.m_ClSkinDownloadUrl, pName); + char aEscapedName[256]; + EscapeUrl(aEscapedName, sizeof(aEscapedName), pName); + str_format(aUrl, sizeof(aUrl), "%s%s.png", g_Config.m_ClSkinDownloadUrl, aEscapedName); str_format(Skin.m_aPath, sizeof(Skin.m_aPath), "downloadedskins/%s.%d.tmp", pName, pid()); Skin.m_pTask = std::make_shared(this, Storage(), aUrl, Skin.m_aPath, IStorage::TYPE_SAVE, CTimeout{0, 0, 0}, HTTPLOG::NONE); m_pClient->Engine()->AddJob(Skin.m_pTask);