PHP - How to set full directory path in Content-Disposition?
-
20-09-2019 - |
Question
I am passing a filename to a download page.
ie somefile.xls
The download page adds back in the full directory path onto the filename.
ie c:\temp\somefile.xls
The problem is that now setting the 'Content-Disposition' of the header doesn't work. The filename it wants to download is the full directory-filename path. ie c_temp_somefile
Can the Content-Disposition handle a full path?
If it can how do I get my script to properly download the file?
Code is:
$myad = $_GET['myad'];
$glob_string = realpath('/foldera/folderb/folderc'). DIRECTORY_SEPARATOR .$myad;
header('Content-Type: application/excel');
$headerstring = 'Content-Disposition: attachment; filename='.$glob_string;
header($headerstring);
readfile($myad);
UPDATED code (from answers):
$myad = $_GET['myad'];
$glob_string = realpath('/mit/mit_tm/mrl_bol'). DIRECTORY_SEPARATOR .$myad;
header('Content-Type: application/excel');
$headerstring = 'Content-Disposition: attachment; filename='.$myad;
header($headerstring);
readfile($glob_string);
Solution
Don't pass the full path via the header string, but use the base name ($myad
) instead.
You should really use a better validation for $_GET['myad']
, since your script will pass arbitrary paths to the user (readfile()
gets the unfiltered user input). This is a security hole!
Calculate the real path using realpath
, make sure that the file is within a allowed folder, then use basename()
on the full path to get the plain file name. Pass this substring via the Content-Disposition
header, but use the real path for readfile()
.
UPDATE: Your updated code still contains a security hole. If $_GET['myad']
contained ../../../some/full/path
, your script would happily send any requested readable file to the client.
You should use something along the lines of the following snippet:
$myad = $_GET['myad'];
$rootDir = realpath('/mit/mit_tm/mrl_bol');
$fullPath = realpath($rootDir . '/' . $myad);
// Note that, on UNIX systems, realpath() will return false if a path
// does not exist, but an absolute non-existing path on Windows.
if ($fullPath && is_readable($fullPath) && dirname($fullPath) === $rootDir) {
// OK, the requested file exists and is in the allowed root directory.
header('Content-Type: application/excel');
// basename() returns just the file name.
header('Content-Disposition: attachment; filename=' . basename($fullPath));
readfile($fullPath);
}
OTHER TIPS
You can put almost everything you want in the Content-Disposition
header but most browsers, for security reasons, will ignore or replace paths and convert them to a valid filename for the operating system they're running on.
Content-Disposition
is only a hint to the browser, it is not mandatory for the web client to respect this setting.
So, no, you can't force the download to a specific directory on the client computer.
Never ever. If a browser accepts full paths it is time to file a bug, quickly: this would be a major security hole.
I dont know if this would help, but I think that the content-type header for excel document might not be really correct, I have not tried it myself, but those microsoft packages come in a mouthfull, like mirosoft word is application/vnd.openxmlformats-officedocument.wordprocessingml.document