Fix/usr fdbck ch (#1105)

* fix(privacy): mask voucher amounts in session replays

* fix: persist transaction source filter

* fix: clarify invoice filenames and booking previews

* fix: truncate long uploaded filenames

* feat: add invoice delivery history

* fix: harden invoice delivery history

* fix: include invoice deliveries in full archive

lib/api/content-disposition.ts

@@ -28,9 +28,9 @@ export function contentDisposition(
   const normalized = filename.toWellFormed().normalize('NFC')
 
   // ASCII fallback for the quoted-string form: anything outside printable
-  // ASCII, plus the quoted-string specials " and \, becomes _. This also
-  // neutralizes CR/LF header injection.
-  const fallback = normalized.replace(/[^\x20-\x7e]|["\\]/g, '_')
+  // ASCII, plus structurally significant header characters, becomes _. This
+  // also neutralizes CR/LF header injection.
+  const fallback = normalized.replace(/[^\x20-\x7e]|["\\;]/g, '_')
 
   // RFC 5987 value-chars: encodeURIComponent covers everything except
   // ! ' ( ) * which it leaves bare but RFC 5987 forbids unencoded.
@@ -41,3 +41,19 @@ export function contentDisposition(
 
   return `${type}; filename="${fallback}"; filename*=UTF-8''${encoded}`
 }
+
+/** Read the preferred UTF-8 filename from a Content-Disposition header. */
+export function contentDispositionFilename(header: string | null): string | null {
+  if (!header) return null
+
+  const extended = header.match(/(?:^|;)\s*filename\*=UTF-8''([^;]*)/i)
+  if (extended?.[1]) {
+    try {
+      return decodeURIComponent(extended[1])
+    } catch {
+      // Fall through to the ASCII quoted-string form.
+    }
+  }
+
+  return header.match(/(?:^|;)\s*filename="([^"]*)"/i)?.[1] ?? null
+}