From 8a877dfd4f67c1445755506db08fa102b70affb7 Mon Sep 17 00:00:00 2001
From: jesscall <34260251+jesscall@users.noreply.github.com>
Date: Mon, 1 Jun 2020 11:47:18 -0400
Subject: [PATCH] [media] File download should retrive decoded path (#6137)

This aims to fix a bug that was experienced by a CCNA user when trying to download a file that had a '&' in the name. SQL encodes strings containing special chars and thus we need to use the decoded file names in the path when downloading files from media module.

    Resolves #6136
---
 modules/media/ajax/FileDownload.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/media/ajax/FileDownload.php b/modules/media/ajax/FileDownload.php
index 5db0dc39b2a..2e40245b7d1 100644
--- a/modules/media/ajax/FileDownload.php
+++ b/modules/media/ajax/FileDownload.php
@@ -24,7 +24,7 @@
 
 // Make sure that the user isn't trying to break out of the $path
 // by using a relative filename.
-$file     = basename($_GET['File']);
+$file     = html_entity_decode(basename($_GET['File']));
 $config   =& NDB_Config::singleton();
 $path     = $config->getSetting('mediaPath');
 $filePath = $path . $file;