From 357b3e6ed92be4fbed3e546b1db26ebba6b23c4b Mon Sep 17 00:00:00 2001
From: Jonathan Schuster <webmaster@jonathan859.com>
Date: Sun, 26 Apr 2026 13:53:36 +0200
Subject: [PATCH] fix: reject directories in _safe_path; remove
 Content-Disposition from _stream
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

_safe_path now uses path.is_file() instead of path.exists() so empty or
directory-traversal filenames never resolve to a directory and get served
as a 0-byte octet-stream download.  This was the cause of the browser
downloading a file named 'recordings' with 0 bytes when Play was clicked.

Removed Content-Disposition: inline from _stream responses — it is not
needed for <audio> playback and it was what labelled the erroneous
directory response as 'recordings' in the save dialog.
---
 web.py | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/web.py b/web.py
index d961b48..36a6b81 100644
--- a/web.py
+++ b/web.py
@@ -337,7 +337,6 @@ class _Handler(BaseHTTPRequestHandler):
 
             self.send_response(206)
             self.send_header('Content-Type', content_type)
-            self.send_header('Content-Disposition', f'inline; filename="{path.name}"')
             self.send_header('Content-Range', f'bytes {start}-{end}/{size}')
             self.send_header('Content-Length', str(length))
             self.send_header('Accept-Ranges', 'bytes')
@@ -355,7 +354,6 @@ class _Handler(BaseHTTPRequestHandler):
         else:
             self.send_response(200)
             self.send_header('Content-Type', content_type)
-            self.send_header('Content-Disposition', f'inline; filename="{path.name}"')
             self.send_header('Content-Length', str(size))
             self.send_header('Accept-Ranges', 'bytes')
             self.end_headers()
@@ -376,7 +374,7 @@ class _Handler(BaseHTTPRequestHandler):
             self._send(403, b'Forbidden', 'text/plain')
             return None
 
-        if not path.exists():
+        if not path.is_file():
             self._send(404, b'Not found', 'text/plain')
             return None