I am passing a filename to a download page.
ie somefile.xls
The download page adds back in the full directory path onto the filename.
ie c:\\temp\\somefile.xls
The problem is that now setting the 'Content-Disposition' of the header doesn't work. The filename it wants to download is the full directory-filename path. ie c_temp_somefile
Can the Content-Disposition handle a full path?
If it can how do I get my script to properly download the file?
Code is:
$myad = $_GET['myad'];
$glob_string = realpath('/foldera/folderb/folderc'). DIRECTORY_SEPARATOR .$myad;
header('Content-Type: application/excel');
$headerstring = 'Content-Disposition: attachment; filename='.$glob_string;
header($headerstring);
readfile($myad);
UPDATED code (from answers):
$myad = $_GET['myad'];
$glob_string = realpath('/mit/mit_tm/mrl_bol'). DIRECTORY_SEPARATOR .$myad;
header('Content-Type: application/excel');
$headerstring = 'Content-Disposition: attachment; filename='.$myad;
header($headerstring);
readfile($glob_string);
You can put almost everything you want in the Content-Disposition
header but most browsers, for security reasons, will ignore or replace paths and convert them to a valid filename for the operating system they're running on.
Content-Disposition
is only a hint to the browser, it is not mandatory for the web client to respect this setting.
So, no, you can't force the download to a specific directory on the client computer.
Don't pass the full path via the header string, but use the base name ( $myad
) instead.
You should really use a better validation for $_GET['myad']
, since your script will pass arbitrary paths to the user ( readfile()
gets the unfiltered user input). This is a security hole!
Calculate the real path using realpath
, make sure that the file is within a allowed folder, then use basename()
on the full path to get the plain file name. Pass this substring via the Content-Disposition
header, but use the real path for readfile()
.
UPDATE: Your updated code still contains a security hole. If $_GET['myad']
contained ../../../some/full/path
, your script would happily send any requested readable file to the client.
You should use something along the lines of the following snippet:
$myad = $_GET['myad'];
$rootDir = realpath('/mit/mit_tm/mrl_bol');
$fullPath = realpath($rootDir . '/' . $myad);
// Note that, on UNIX systems, realpath() will return false if a path
// does not exist, but an absolute non-existing path on Windows.
if ($fullPath && is_readable($fullPath) && dirname($fullPath) === $rootDir) {
// OK, the requested file exists and is in the allowed root directory.
header('Content-Type: application/excel');
// basename() returns just the file name.
header('Content-Disposition: attachment; filename=' . basename($fullPath));
readfile($fullPath);
}
Never ever. If a browser accepts full paths it is time to file a bug, quickly: this would be a major security hole.
我不知道这是否会有所帮助,但我认为excel文档的内容类型标题可能不是真的正确,我自己没有尝试过,但那些微软软件包都是满口的,就像mirosoft这个词一样
application/vnd.openxmlformats-officedocument.wordprocessingml.document
The technical post webpages of this site follow the CC BY-SA 4.0 protocol. If you need to reprint, please indicate the site URL or the original address.Any question please contact:yoyou2525@163.com.