Broken HTTP headers on avatars

[Duke of Prunes]

The following avatar doesn't load in Chrome:

http://www.social-anxiety-community....ine=1375873820

If I go to it directly I get an error from Chrome (ERR_RESPONSE_HEADERS_MULTIPLE_CONTENT_DISPOSITION ).

This is the header in question:

Content-disposition: inline; filename=**** knows, but it's pretty.jpg

Ignore the starred out bit (it's sweary in the actual header, not asterisks, so that's not an issue).

The comma (and most likely the apostrophe as well) in the filename causes the problem (confirmed in https://code.google.com/p/chromium/i...tail?id=100011).

I guess it probably works fine in other browsers (they probably accept the header anyway, even though they shouldn't), but issue is still at the server side.

Basically, the value of filename needs to be double-quoted and/or URL-encoded so that there are no loose commas/apostrophes. You're best off filing an issue with the vB devs.

[Duke of Prunes]

Getting the same error on this one now:
http://www.social-anxiety-community....ine=1380479474

Here's what the server is sending:

~ $ curl -s -D - 'http://www.social-anxiety-community.org/db/image.php?u=10247&dateline=1380479474' -o /dev/null | egrep '^Content-'
Content-disposition: inline; filename=fc,550x550,navy.u2.jpg
Content-transfer-encoding: binary
Content-Length: 28056
Content-Type: image/jpeg

The bolded bit is the problem. Having an unquoted filename with commas makes Chrome angry.

[Lindalino]

This is too fundamental for the forum to get fixed?

P.S. Is Chrome any good, I thought its main aim was to make data theft easier for google?

[Duke of Prunes]

Originally Posted by Lindalino

P.S. Is Chrome any good, I thought its main aim was to make data theft easier for google?

Only the branded version (Google Chrome) has all the data collection stuff – the open-source version that it's based on (Chromium) is awesome. It's hard to get Chromium though unless you know how to build it yourself (unless you want to use really unstable development versions, or trust some dodgy unofficial build).