clean the filenames to make sure there aren't funny characters

diff --git a/course/grades.php b/course/grades.php
index d8c3dd3ad51c510011394de86e10049aa59d6441..8ac6b0356b0f2b317487fdd05223b14bb9b9028f 100644 (file)
--- a/course/grades.php
+++ b/course/grades.php
@@ -147,7 +147,8 @@
 
 // HTTP headers
         header("Content-type: application/vnd.ms-excel");
-        header("Content-Disposition: attachment; filename=".$course->shortname."_$strgrades.xls");
+        $downloadfilename = clean_filename("$course->shortname $strgrades");
+        header("Content-Disposition: attachment; filename=\"$downloadfilename.xls\"");
         header("Expires: 0");
         header("Cache-Control: must-revalidate,post-check=0,pre-check=0");
         header("Pragma: public");
@@ -203,7 +204,8 @@
 /// Print header to force download
 
         header("Content-Type: application/download\n"); 
-        header("Content-Disposition: attachment; filename=\"$course->shortname $strgrades.txt\"");
+        $downloadfilename = clean_filename("$course->shortname $strgrades");
+        header("Content-Disposition: attachment; filename=\"$downloadfilename.txt\"");
 
 /// Print names of all the fields