Problem with quotes in filename downloads

Hello!

When downloading a file with double quotes, the file is correctly downloaded by the filename hangs at the first double quote. I escape the url of course, japanese, german and french chars are well supported but not double quotes.

Here is an example of the html fragment :

<a href="#" class="link" rel="http://example.com/?s2member_file_download=/This+is+%22my%22+file.txt">This is "my" file.txt</a>

On the server, the file is named :

s2member-files/This is "my" file.txt

And the downloaded file is :

This is .txt

If you replace the file extension with .php instead of .txt for example, the downloaded file will not have its extension and will result as :

This is 

Given that it is for the plugin s2member Secure File Browser, I don’t really want to have a hot fix but just a fix in a future version. Or perhaps I can bypass this problem with a trick in my plugin.

Thank you !

Thanks for reporting this important issue.

I’m sending this issue to Jason to get his input.

Thank you!

Thanks for the heads up on this thread :-)

I just took a quick look at this, and it’s not actually s2Member losing any data and/or formatting here. What’s happening is that s2Member’s call to PHP’s file_exists() function is failing on some operating systems. Either due to safe mode restrictions, or because of a lack of support for that character in a file name.

Comparison of filename limitations (from the Wikipedia)
http://en.wikipedia.org/wiki/File_name#Comparison_of_filename_limitations

My suggestion would be to avoid using double-quotes in file names. Even if you’re on a server that would support this, it is highly likely that issues would occur during the download and Save action within a browser. For instance, Windows does not support the double-quote character in a file name at all.

Please let us know if problems persist :-)

Related articles:
http://en.wikipedia.org/wiki/File_name
http://stackoverflow.com/questions/948072/why-doesnt-file-exists-work

Thank you for your answer !

I do not use double quotes in filename, but my clients… certainly ! I really agree with you on this point.

In fact the file is well downloaded, so I presume the file_exists do not crash.
The downloaded file name is just cut at the first double quote.

Moreover, it seems there is a filename computing given that .txt still persist at the end of the filename.

It is not really important…

Ok, I found the solution. Again a new RFC :-)
http://tools.ietf.org/html/rfc6266#appendix-D

In includes/classes/files-in.inc.php line 361 (for version 121213), replace :

header('Content-Disposition: '.(($inline) ? "inline" : "attachment").'; filename="'.$basename.'"');

with

header('Content-Disposition: '.(($inline) ? "inline" : "attachment").'; filename*=UTF-8\'\''.rawurlencode($basename) );

but not for all user agents (http://greenbytes.de/tech/tc2231/)

It seems there is a trick with a fake file name at the end of the php and with a rewrite rule :
http://stackoverflow.com/questions/93551/how-to-encode-the-filename-parameter-of-content-disposition-header-in-http

Interesting! Thank you. I’m going to review this shortly!

Thanks for the great tips!

RFC 6266 says…
http://tools.ietf.org/html/rfc6266#appendix-D

o When a “filename” parameter is included as a fallback (as per
above), “filename” should occur first, due to parsing problems in
some existing implementations.

Use UTF-8 as the encoding of the “filename*” parameter, when
present, because at least one existing implementation only
implements that encoding.

This site you pointed me to indicates that including both values might work best here.
See: http://greenbytes.de/tech/tc2231/#attfnboth

I’m currently testing the following change at line #274 in s2Member v130116. If testing goes well, I’ll see about having this change made for the next maintenance release.

$disposition = (($inline) ? "inline" : "attachment")."; filename=\"".c_ws_plugin__s2member_utils_strings::esc_dq($basename)."\"; filename*=UTF-8''".rawurlencode($basename);

If you get a chance to test this, I would greatly appreciate it :-) Please note that s2Member v130116 added support for byte-range requests. Thus, the current stable release of s2Member (v130116) includes significant changes inside files-in.inc.php from the previous version.

Thank you, I changed this line in all installation (with the last version of course).
I will tell you if I notice a problem but for the moment, it works perfectly on :
– safari 6 on mac
– firefox (latest) on mac
– chrome on mac which change quotes by dashes