Content-Disposition 'inline' filenames not respected by download_url()

[mi5t4n]

# Content-Disposition 'inline' filename extraction not working in download_url()

The download_url() function successfully extracts filenames from Content-Disposition headers when they use the 'attachment' directive (e.g., Content-Disposition: attachment; filename="xyz.png"). However, the function fails to extract filenames when the 'inline' directive is used (e.g., Content-Disposition: inline; filename="abc.jpg"). This inconsistency means filenames are only properly captured with the 'attachment' directive but are ignored when using 'inline'.

​https://lh3.googleusercontent.com/a/ACg8ocIsaU5KyoziSpU_mP5OpE-dzbmc8hoyOEXemog5RopRRoqTz2Y=s96-c

Example URL:

<?php
File: src/wp-admin/includes/file.php
1221: 
1222:           if ( str_starts_with( $content_disposition, 'attachment; filename=' ) ) {
1223:                   $tmpfname_disposition = sanitize_file_name( substr( $content_disposition, 21 ) );
1224:           } else {
1225:                   $tmpfname_disposition = '';
1226:           }

[TobiasBg]

This seems to be a duplicate of #63015? #60788 is also an interesting question...

[mi5t4n]

@TobiasBg Yes, it seems it's duplicate of #63015. #60788 raises valid concerns regarding handling of filenames from Content-Disposition header.