Attachment_Controller::_send_headers()

Complexity

Conditions	14
Paths	20

Size

Total Lines	78
Code Lines	36

Duplication

Lines	0
Ratio	0 %

Importance

Changes	1
Bugs	0	Features	0

<?php
	protected function _send_headers($filename, $eTag, $mime_type, $use_compression, $disposition, $real_filename, $do_cache, $check_filename = true)

The parameter $use_compression is not used and could be removed.

	{
		global $txt;

		// No point in a nicer message, because this is supposed to be an attachment anyway...
		if ($check_filename === true && !file_exists($filename))
		{
			loadLanguage('Errors');

			header((preg_match('~HTTP/1\.[01]~i', $_SERVER['SERVER_PROTOCOL']) ? $_SERVER['SERVER_PROTOCOL'] : 'HTTP/1.0') . ' 404 Not Found');
			header('Content-Type: text/plain; charset=UTF-8');

			// We need to die like this *before* we send any anti-caching headers as below.
			die('404 - ' . $txt['attachment_not_found']);
		}

		// If it hasn't been modified since the last time this attachment was retrieved, there's no need to display it again.
		if (!empty($_SERVER['HTTP_IF_MODIFIED_SINCE']))
		{
			list ($modified_since) = explode(';', $_SERVER['HTTP_IF_MODIFIED_SINCE']);
			if ($check_filename === false || strtotime($modified_since) >= filemtime($filename))
			{
				@ob_end_clean();

It seems like you do not handle an error condition for ob_end_clean(). This can introduce security issues, and is generally not recommended.

				// Answer the question - no, it hasn't been modified ;).
				header('HTTP/1.1 304 Not Modified');
				exit;
			}
		}

		// Check whether the ETag was sent back, and cache based on that...
		if (!empty($_SERVER['HTTP_IF_NONE_MATCH']) && strpos($_SERVER['HTTP_IF_NONE_MATCH'], $eTag) !== false)
		{
			@ob_end_clean();

			header('HTTP/1.1 304 Not Modified');
			exit;
		}

		// Send the attachment headers.
		header('Expires: ' . gmdate('D, d M Y H:i:s', time() + 525600 * 60) . ' GMT');
		header('Last-Modified: ' . gmdate('D, d M Y H:i:s', $check_filename === true ? filemtime($filename) : time() - 525600 * 60) . ' GMT');
		header('Accept-Ranges: bytes');
		header('Connection: close');
		header('ETag: ' . $eTag);

		if (!empty($mime_type) && strpos($mime_type, 'image/') === 0)
		{
			header('Content-Type: ' . $mime_type);
		}
		else
		{
			header('Content-Type: application/octet-stream');
		}

		// Different browsers like different standards...
		$filename = str_replace('"', '', $real_filename);

		// Send as UTF-8 if the name requires that
		$altName = '';
		if (preg_match('~[\x80-\xFF]~', $filename))
			$altName = "; filename*=UTF-8''" . rawurlencode($filename);

		header('Content-Disposition: ' . $disposition . '; filename="' . $filename . '"' . $altName);

		// If this has an "image extension" - but isn't actually an image - then ensure it isn't cached cause of silly IE.
		if ($do_cache === true)
		{
			header('Cache-Control: max-age=' . (525600 * 60) . ', private');
		}
		else
		{
			header('Pragma: no-cache');
			header('Cache-Control: no-cache');
		}

		// Try to buy some time...
		detectServer()->setTimeLimit(600);
	}