From f53c98312e320dcb57edeebdbe534d2eef4819ba Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jan=20B=C3=B6hmer?= <mail@jan-boehmer.de>
Date: Sun, 15 Oct 2023 00:50:43 +0200
Subject: [PATCH] Escape space in attachment URLs with %20

Fixes issue #401
---
 src/Entity/Attachments/Attachment.php       |  4 ++++
 tests/Entity/Attachments/AttachmentTest.php | 26 +++++++++++++++++++++
 2 files changed, 30 insertions(+)

diff --git a/src/Entity/Attachments/Attachment.php b/src/Entity/Attachments/Attachment.php
index 61f370e4..9e367450 100644
--- a/src/Entity/Attachments/Attachment.php
+++ b/src/Entity/Attachments/Attachment.php
@@ -472,6 +472,10 @@ abstract class Attachment extends AbstractNamedDBElement
     #[SerializedName('url')]
     public function setURL(?string $url): self
     {
+        $url = trim($url);
+        //Escape spaces in URL
+        $url = str_replace(' ', '%20', $url);
+
         //Only set if the URL is not empty
         if ($url !== null && $url !== '') {
             if (str_contains($url, '%BASE%') || str_contains($url, '%MEDIA%')) {
diff --git a/tests/Entity/Attachments/AttachmentTest.php b/tests/Entity/Attachments/AttachmentTest.php
index 321c71ba..e775f32f 100644
--- a/tests/Entity/Attachments/AttachmentTest.php
+++ b/tests/Entity/Attachments/AttachmentTest.php
@@ -265,6 +265,32 @@ class AttachmentTest extends TestCase
         $this->assertSame($expected, $attachment->getFilename());
     }
 
+    public function testSetURL(): void
+    {
+        $attachment = new PartAttachment();
+
+        //Set URL
+        $attachment->setURL('https://google.de');
+        $this->assertSame('https://google.de', $attachment->getURL());
+
+        //Ensure that an empty url does not overwrite the existing one
+        $attachment->setPath('%MEDIA%/foo/bar.txt');
+        $attachment->setURL(' ');
+        $this->assertSame('%MEDIA%/foo/bar.txt', $attachment->getPath());
+
+        //Ensure that spaces get replaced by %20
+        $attachment->setURL('https://google.de/test file.txt');
+        $this->assertSame('https://google.de/test%20file.txt', $attachment->getURL());
+    }
+
+    public function testSetURLForbiddenURL(): void
+    {
+        $attachment = new PartAttachment();
+
+        $this->expectException(InvalidArgumentException::class);
+        $attachment->setURL('%MEDIA%/foo/bar.txt');
+    }
+
     public function testIsURL(): void
     {
         $url = '%MEDIA%/test.txt';