1 file changed, 32 insertions, 1 deletion
diff --git a/source/ui-shared.c b/source/ui-shared.c
index 9e3757d..d2eec25 100644
--- a/source/ui-shared.c
+++ b/source/ui-shared.c
@@ -1385,6 +1385,30 @@ static int type_has_charset(const char *mimetype)
 		ends_with(mimetype, "+xml");
 }
 
+/*
+ * Whether a download name goes out a second time as RFC 6266's filename*,
+ * which is so for a name past ASCII. That form carries UTF-8 alone, so a name
+ * that is not valid UTF-8 keeps the plain filename by itself.
+ */
+static int wants_ext_filename(const char *name)
+{
+	const unsigned char *p = (const unsigned char *)name;
+	size_t left = strlen(name);
+	int past_ascii = 0;
+
+	while (left) {
+		size_t seq = *p < 0x80 ? 1 : cgit_utf8_seq_len(p, left);
+
+		if (!seq)
+			return 0;
+		if (seq > 1)
+			past_ascii = 1;
+		p += seq;
+		left -= seq;
+	}
+	return past_ascii;
+}
+
 void cgit_print_http_headers(void)
 {
 	ctx.page.headers_sent = 1;
@@ -1408,7 +1432,14 @@ void cgit_print_http_headers(void)
 	if (ctx.page.filename) {
 		html("Content-Disposition: inline; filename=\"");
 		html_header_arg_in_quotes(ctx.page.filename);
-		html("\"\n");
+		html("\"");
+		// A client that knows filename* reads it in place of filename,
+		// which stays for one that does not.
+		if (wants_ext_filename(ctx.page.filename)) {
+			html("; filename*=UTF-8''");
+			html_header_ext_value(ctx.page.filename);
+		}
+		html("\n");
 	}
 	// An untrusted page serves repository bytes verbatim, so the browser is
 	// told not to guess a type of its own from them and not to load