From bd3bf6834b42ae6b51f6c8c2fdcd2774192c71a8 Mon Sep 17 00:00:00 2001
From: robbond <rob@rdbsolutions.co.uk>
Date: Mon, 23 Mar 2026 17:04:30 +0000
Subject: [PATCH] TASK22224: accept encoded hash variants for downloadblob

---
 pages/api/file/downloadblob.js | 38 +++++++++++++++++++++++++++-------
 1 file changed, 31 insertions(+), 7 deletions(-)

diff --git a/pages/api/file/downloadblob.js b/pages/api/file/downloadblob.js
index 3973d93a..5209128e 100644
--- a/pages/api/file/downloadblob.js
+++ b/pages/api/file/downloadblob.js
@@ -32,15 +32,39 @@ ApiProxy.get(async (req, res) => {
         });
     }
 
-    const checkquerypath =
+    const blobNameTrimmed = blobName.trim();
+    const hashCandidatePaths = [
         "/api/file/downloadblob?container=" +
-        containerName +
-        "&casefolderID=" +
-        casefolderID +
-        "&blobname=" +
-        blobName.trim();
+            containerName +
+            "&casefolderID=" +
+            casefolderID +
+            "&blobname=" +
+            blobNameTrimmed,
+        "/api/file/downloadblob?container=" +
+            containerName +
+            "&casefolderID=" +
+            encodeURIComponent(casefolderID) +
+            "&blobname=" +
+            blobNameTrimmed,
+        "/api/file/downloadblob?container=" +
+            containerName +
+            "&casefolderID=" +
+            casefolderID +
+            "&blobname=" +
+            encodeURIComponent(blobNameTrimmed),
+        "/api/file/downloadblob?container=" +
+            containerName +
+            "&casefolderID=" +
+            encodeURIComponent(casefolderID) +
+            "&blobname=" +
+            encodeURIComponent(blobNameTrimmed)
+    ];
 
-    if (hashAPIPath(checkquerypath) != "&hash=" + checkHash) {
+    const isHashValid = hashCandidatePaths.some(
+        (candidatePath) => hashAPIPath(candidatePath) == "&hash=" + checkHash
+    );
+
+    if (!isHashValid) {
         return respondError(res, {
             status: 400,
             code: "INVALID_HASH",