-1

Background

I have a PHP application running on a CentOS server. The front end is using an ajax call to hit a PHP script. The script returns a file from the server and downloads it to the client.

Problem

If the file has a # in the name, the file fails to download.

Example

File#Name.pdf = Does not download correctly

FileName.pdf = Does download correctly

This is the PHP used to retrieve the files,

if( isset($_GET['path'])) {
    $path = $_GET['path'];
    if(!file_exists($path)) {
        die('file not found');
    } else {
        header('Content-Description: File Transfer');
        header('Content-Type: application/octet-stream');
        header('Content-Disposition: attachment; filename='.$path);
        header('Content-Length: '.filesize($path));
        readfile($path);
        ob_clean();
        flush();
        exit;
    }
}

Question

Why is the file failing to download when the # is in the name?

2
  • 1
    Does it work if you use File%23Name.pdf in the URL? Sep 18, 2019 at 4:31
  • What is happening in the failure case? Does your ajax call get a response? Can you use your browser profiler to see what the headers or body of the response object is? Sep 18, 2019 at 4:34

1 Answer 1

1

Ah, is the filename coming in from a GET request? If so the # is probably getting rewritten as a %23. Try

$path = urldecode($_GET['path']);
1
  • 1
    No prob. In general, in php be suspicious of any text value that came to you from the client. By suspicious I mean both from a security/malicious user standpoint, and also from a "is this really what I think it is" standpoint. Sep 18, 2019 at 5:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.