Header Strangeness

PHP
1

I have this here when a link is clicked…

if (isset($_REQUEST['download']))
{
	$file = $_REQUEST['download'];
	header("Content-Disposition: attachment; filename=$file");
	readfile($file);
	exit;
}

It works, but in some cases, it appends .htm to the end of the file name. Do I need to clarify the header details per file type better, or is this an Apache issue?

2

If you have that exact piece of code on a website, you should seriously consider making it more secure.

With that code, there is nothing stopping me from downloading files you did not want me to access.

For your question, it sounds strange. Ive never had that happen before.

You can try to throw with some of these headers as well and see if it disappear:


Cache-Control: must-revalidate, post-check=0, pre-check=0
Pragma: public
Content-Type: application/octet-stream
Content-Transfer-Encoding: binary
Content-Length: 
Accept-Ranges: bytes
Connection: close

Also, I notice that you dont wrap the filename in the header, Ive always written that one as:


Content-Disposition: attachment; filename="name"