Wrap CSV response values in double quotes (")

While double quotes are mostly optional in implementations, some CSV
linters want double quotes for whatever the reason. Assumably, it
reduces the amount of bugs and avoids possible parsing errors. This also
has very little relevance for not trusting the user input, but better be
safe than sorry.

This commit is not very pretty. In a future commit, this issue will be
addressed with arrays and fputcsv().

1 files changed, 6 insertions, 6 deletions

diff --git a/static/classes/Response.class.php b/static/classes/Response.class.php
index e44652a..4e28678 100755
--- a/static/classes/Response.class.php
+++ b/static/classes/Response.class.php
@@ -104,17 +104,17 @@ class Response
 
     private static function csv_error($description)
     {
-        return "error\r\n".$description."\r\n";
+        return '"error"'."\r\n"."\"$description\""."\r\n";
     }
 
     private static function csv_success($files)
     {
-        $result = "name,url,hash,size\r\n";
+        $result = '"name","url","hash","size"'."\r\n";
         foreach ($files as $file) {
-            $result .= $file['name'].','.
-                       $file['url'].','.
-                       $file['hash'].','.
-                       $file['size']."\r\n";
+            $result .= '"'.$file['name'].'"'.','.
+                       '"'.$file['url'].'"'.','.
+                       '"'.$file['hash'].'"'.','.
+                       '"'.$file['size'].'"'."\r\n";
         }
 
         return $result;