X-Git-Url: https://git.arvados.org/arvados.git/blobdiff_plain/dfb9a5e285e4275c26b6f959a04babd5a8ad836e..0da328cc74af2989f811d2970096bd5be5f9776b:/apps/workbench/app/controllers/collections_controller.rb

diff --git a/apps/workbench/app/controllers/collections_controller.rb b/apps/workbench/app/controllers/collections_controller.rb
index 0806a0a429..7a002427cf 100644
--- a/apps/workbench/app/controllers/collections_controller.rb
+++ b/apps/workbench/app/controllers/collections_controller.rb
@@ -1,6 +1,5 @@
 require "arvados/keep"
 require "uri"
-require "cgi"
 
 class CollectionsController < ApplicationController
   include ActionController::Live
@@ -340,7 +339,7 @@ class CollectionsController < ApplicationController
       # Prefer the attachment-only-host when we want an attachment
       # (and when there is no preview link configured)
       tmpl = Rails.configuration.keep_web_download_url
-    else
+    elsif not Rails.configuration.trust_all_content
       check_uri = URI.parse(tmpl % fmt)
       if opts[:query_token] and
           not check_uri.host.start_with?(munged_id + "--") and
@@ -369,9 +368,9 @@ class CollectionsController < ApplicationController
       uri.path += 't=' + opts[:path_token] + '/'
     end
     uri.path += '_/'
-    uri.path += CGI::escape(file)
+    uri.path += URI.escape(file)
 
-    query = CGI::parse(uri.query || '')
+    query = Hash[URI.decode_www_form(uri.query || '')]
     { query_token: 'api_token',
       disposition: 'disposition' }.each do |opt, param|
       if opts.include? opt
@@ -379,7 +378,7 @@ class CollectionsController < ApplicationController
       end
     end
     unless query.empty?
-      uri.query = query.to_query
+      uri.query = URI.encode_www_form(query)
     end
 
     uri.to_s