Re: [HTTP_Download] : Security and MIME types

Hi Mos, you wrote: > I use HTTP_Download apckage to set up a feature to download some > files. > > Is reasonnable to set-up the 'contenttype' parameter in the > staticSend function ? Yes IMO. You could also use HTTP_Download::guessContentType() which utilizes ext/mime_magic by setting the second parameter of staticSend() to true. > I mean to set tup this parameter (with Windows OS) I should guess it > with the 3 last characters of the filename. But this extension can be > changed by the users before uploading the file (the files to download > can be upload by users in a previous process). Well, then you're a step "behind". The security risk here already is that (untrusted?) users may upload files that other users can download. Regards, -- Michael - < mike(@)php.net >

Attachment: [application/pgp-signature] OpenPGP digital signature signature.asc