JPEG file download via PHP on Mac(IE)

[starship]

Hi - I 'm struggling with this one . . . I am trying to download a JPG file through a php page. The code is pretty straight forward, it obtains the filename from the query string, reads the file and outputs to the browser. Here is the code:

<?php
$filename = $_GET["file"];
$bytes = filesize("PATH_TO_FOLDER/$filename");
header("Content-type: application/jpg");
header("Content-disposition: attachment; filename=\"$filename\"");
header("Content-length: $bytes");
//Read the file and output to browser
@readfile("PATH_TO_FOLDER/$filename");
//Code to record the download in database
?>

Originally I had "Content-type: image/jpeg"), but later on changed to "application/jpg" after reading through some forums on web. Both the content-types work fine in all browsers on a Windows PC, but they behave very differently with IE5.2 on MacOSX and IE5.1 on Mac OS9. The "Save As.." box does not open and the image gets displayed directly on the window. If I try to save the image by Ctrl+Click and Download to Disk, it shows the filename as "download.php" instead of the correct name "FILENAME.jpg" given in the Content-disposition header.

I did a lot of google and read in several forums that IE on Mac ignores the Content-disposition header. Is there any workaround for this. My aim is to display the "Save As.." dialog box on Mac IE (OSX and OS9), display the correct filename in the save as dialog box and allow the user to save the file through the dialog box.

(In Mozilla (Mac) it will download the file (but you have to be very quick as it tends to close the "What should Mozilla do with this file?" dialog quickly if you don't select the 'save' option and click 'ok'). Safari seems to be the only browser happy to download a .jpg file onto the disk.)

Any suggestions or pointers would be appreciated.

 

[jeremy.king]

My guess is this behavior is going to vary and its just something you may have to accept since the browser needs to determine what to do with the response based on its content-type. Perhaps changing content-type to something like application/download or application/octet-stream or something similar could "force" a download.

As far as right clicking, its doing just what you should expect. Since the image was delivered using your download.php script and the content-dispostion header was ignored, the browser is going to truncate the request string and think the file should be named download.php. Again, this too will most likely be browser dependant.

Finally, you MUST MUST MUST validate the filename that is passed it. Based on the code you posted, a malicious surfer could use that script to fetch any file that can be read by the webserver. I highly recommend that you strip_slashes and perform other validation on that request parameter.