when setting content-disposition, uri-encode names

services/web/app/coffee/Features/Compile/CompileController.coffee

@@ -85,7 +85,9 @@ module.exports = CompileController =
 			res.contentType("application/pdf")
 			if !!req.query.popupDownload
 				logger.log project_id: project_id, "download pdf as popup download"
-				res.header('Content-Disposition', "attachment; filename=#{project.getSafeProjectName()}.pdf")
+				res.header(
+					'Content-Disposition', "attachment; filename=#{encodeURIComponent(project.getSafeProjectName())}.pdf"
+				)
 			else
 				logger.log project_id: project_id, "download pdf to embed in browser"
 				res.header('Content-Disposition', "filename=#{project.getSafeProjectName()}.pdf")

services/web/app/coffee/Features/FileStore/FileStoreController.coffee

@@ -35,5 +35,5 @@ module.exports =
 				if (is_mobile_safari(user_agent) and is_html(file))
 					logger.log filename: file.name, user_agent: user_agent, "sending html file to mobile-safari as plain text"
 					res.setHeader('Content-Type', 'text/plain')
-				res.setHeader("Content-Disposition", "attachment; filename=#{file.name}")
+				res.setHeader("Content-Disposition", "attachment; filename=#{encodeURIComponent(file.name)}")
 				stream.pipe res

services/web/test/UnitTests/coffee/Compile/CompileControllerTests.coffee

@@ -137,7 +137,7 @@ describe "CompileController", ->
 
 			it "should set the content-disposition header with the project name", ->
 				@res.header
-					.calledWith("Content-Disposition", "filename=#{@safe_name}.pdf")
+					.calledWith("Content-Disposition", "filename=#{encodeURIComponent(@safe_name)}.pdf")
 					.should.equal true
 
 			it "should increment the pdf-downloads metric", ->

services/web/test/UnitTests/coffee/FileStore/FileStoreControllerTests.coffee

@@ -62,7 +62,9 @@ describe "FileStoreController", ->
 
 		it "should set the Content-Disposition header", (done)->
 			@stream.pipe = (des)=>
-				@res.setHeader.calledWith("Content-Disposition", "attachment; filename=#{@file.name}").should.equal true
+				@res.setHeader.calledWith(
+					"Content-Disposition", "attachment; filename=#{encodeURIComponent(@file.name)}"
+				).should.equal true
 				done()
 			@controller.getFile @req, @res