From: tgal at rdslink dot ro
Operating system: WindowsXP
PHP version: 4.4.2
PHP Bug Type: HTTP related
Bug description: fileopen through header
Description:
------------
Under php-4.3.10 this method works just fine. But with php-4.4.1 and
php-4.4.2 the application crashes(mostly MS Word, because I try to open
rtf documents and this is the default application).
The script uses header function to get the document from server.
Reproduce code:
---------------
to get the file:
<a href="fileopen.php?folder=subfolder&filename=file.rtf">file.rtf</a>
fileopen.php:
<?
if(!isset($_GET["folder"])) $_GET["folder"]=NULL;
if(!isset($_GET["subfolder"])) $_GET["subfolder"]=NULL;
if(!isset($_GET["id"])) $_GET["id"]=NULL;
if(!isset($_GET["filename"])) $_GET["filename"]=NULL;
if($_GET["folder"]=="somatie")
{
$name="../".$_GET["folder"]."/".$_GET["filename"];
}
else
{
if($_GET["subfolder"]!=NULL)
$name="../".$_GET["folder"]."/".$_GET["subfolder"]."/".$_GET["id"].str_replace("*","&",$_GET["filename"]);
else
$name="../".$_GET["folder"]."/".$_GET["id"].str_replace("*","&",$_GET["filename"]);
}
$file_extension=strtolower(substr(strrchr($_GET["filename"],"."),1));
switch($file_extension)
{
case "pdf": $ctype="application/pdf"; break;
case "exe": $ctype="application/octet-stream"; break;
case "zip": $ctype="application/zip"; break;
case "doc": $ctype="application/msword"; break;
case "csv":
case "xls": $ctype="application/vnd.ms-excel"; break;
case "ppt": $ctype="application/vnd.ms-powerpoint"; break;
case "gif": $ctype="image/gif"; break;
case "png": $ctype="image/png"; break;
case "jpeg":
case "jpg": $ctype="image/jpg"; break;
case "mp3": $ctype="audio/mpeg"; break;
case "wav": $ctype="audio/x-wav"; break;
case "mpeg":
case "mpg":
case "mpe": $ctype="video/mpeg"; break;
case "mov": $ctype="video/quicktime"; break;
case "avi": $ctype="video/x-msvideo"; break;
//The following are for extensions that shouldn't be downloaded
(sensitive stuff, like php files)
case "php":
case "htm":
case "html":
case "txt": die("<b>Cannot be used for ". $file_extension ."
files!</b>"); break;
default: $ctype="application/force-download";
}
// send the right headers
header("Pragma: no-cache");
header("Expires: 0");
header("Cache-Control: no-store, no-cache, must-revalidate, post-check=0,
pre-check=0");
header("Content-Description: File Transfer");
header("Content-Type: $ctype");
header('Content-Disposition: attachment;
filename="'.$_GET["filename"].'";');
header("Content-Transfer-Encoding: binary");
header("Content-Length: ".filesize($name));
// dump the picture and stop the script
@readfile($name);
exit;
?>
Expected result:
----------------
The file should be opened with the default application.
Actual result:
--------------
Default application crashes.
--
Edit bug report at http://bugs.php.net/?id=36734&edit=1
--
Try a CVS snapshot (PHP 4.4): http://bugs.php.net/fix.php?id=36734&r=trysnapshot44
Try a CVS snapshot (PHP 5.1): http://bugs.php.net/fix.php?id=36734&r=trysnapshot51
Try a CVS snapshot (PHP 6.0): http://bugs.php.net/fix.php?id=36734&r=trysnapshot60
Fixed in CVS: http://bugs.php.net/fix.php?id=36734&r=fixedcvs
Fixed in release: http://bugs.php.net/fix.php?id=36734&r=alreadyfixed
Need backtrace: http://bugs.php.net/fix.php?id=36734&r=needtrace
Need Reproduce Script: http://bugs.php.net/fix.php?id=36734&r=needscript
Try newer version: http://bugs.php.net/fix.php?id=36734&r=oldversion
Not developer issue: http://bugs.php.net/fix.php?id=36734&r=support
Expected behavior: http://bugs.php.net/fix.php?id=36734&r=notwrong
Not enough info: http://bugs.php.net/fix.php?id=36734&r=notenoughinfo
Submitted twice: http://bugs.php.net/fix.php?id=36734&r=submittedtwice
register_globals: http://bugs.php.net/fix.php?id=36734&r=globals
PHP 3 support discontinued: http://bugs.php.net/fix.php?id=36734&r=php3
Daylight Savings: http://bugs.php.net/fix.php?id=36734&r=dst
IIS Stability: http://bugs.php.net/fix.php?id=36734&r=isapi
Install GNU Sed: http://bugs.php.net/fix.php?id=36734&r=gnused
Floating point limitations: http://bugs.php.net/fix.php?id=36734&r=float
No Zend Extensions: http://bugs.php.net/fix.php?id=36734&r=nozend
MySQL Configuration Error: http://bugs.php.net/fix.php?id=36734&r=mysqlcfg