Re: Re: Strategy for Secure File Storage

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Kevin Murphy wrote:
Ok, I'm almost there. I took what everyone said (and a few Google searches later) and built this, which works great on Firefox and Safari (both mac and PC). The $path leads to a directory outside the web root, and there is also an array with all the mime types in it ($mimetype).


$file_path = $path."/".$file;

$ext = explode(".",$file);

$filesize = filesize($file_path);

$extension = $mimetypes["$ext[1]"];

header("Content-type: $extension");
header("Content-length: $filesize");
header("Content-Disposition: attachment; filename=\"$file\"");
header("Pragma: no-cache");
$file = file_get_contents($file_path);
echo ($file);

The problem is IE7. All browsers work with this code as is but IE says "Internet Explorer cannot download test.pdf from XXX...."

Any suggestions?


echo 'Your software provider sucks eggs. Get a better browser.';

heh ...

I just did precisely this (the script, not the "sucks eggs" comment) for a project i'm working on. There's a file store above document root and a script that does user validation, then reads the top dir of the file store and display links for each directory or file in there (of course, they're not direct links), letting the user drill down as far as it goes.


What exactly is in the var $extension?
header("Content-type: $extension");


Don't do this:
$file = file_get_contents($file_path);
echo ($file);

Do this instead:
readfile($file_path);
exit;


Here's the business end of my script:

-- snip --
header ('Cache-Control: must-revalidate, post-check=0, pre-check=0');
header ('Content-Type: application/octet-stream');
header('Content-Transfer-Encoding: Binary');
header('Content-length: ' . filesize($filepath));
header('Content-disposition: attachment; filename="' . basename($filepath) .'"');
readfile($filepath);
exit;
-- snip --

Note that i'm not trying to give the option for the browser to hand off the file to a "helper application" or plugin. This script is for downloading only, hence no MIME type and the "octet-stream' & 'attachment'.

I just checked another project where i did pass the MIMIE to allow for the file to open in Adobe Reader, MSExcel, etc. You also might want to add these two with your no-cache header:

header ('Expires: Mon, 1 Apr 1974 05:00:00 GMT');
header ('Last-Modified: ' . gmdate('D,d M YH:i:s') . ' GMT');

I seem to remember that it was IE that wanted these in order to play nice.

brian

--
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php


[Index of Archives]     [PHP Home]     [Apache Users]     [PHP on Windows]     [Kernel Newbies]     [PHP Install]     [PHP Classes]     [Pear]     [Postgresql]     [Postgresql PHP]     [PHP on Windows]     [PHP Database Programming]     [PHP SOAP]

  Powered by Linux