ElkArte\Controller\Attachment::prepare_headers()

Complexity

Conditions	11
Paths	9

Size

Total Lines	76
Code Lines	41

Duplication

Lines	0
Ratio	0 %

Code Coverage

Tests	0
CRAP Score	132

Importance

Changes	1
Bugs	0	Features	0

<?php
	public function prepare_headers($filename, $eTag, $mime_type, $disposition, $real_filename, $do_cache, $check_filename = true)
	{
		global $txt;

		$headers = Headers::instance();

		// No point in a nicer message, because this is supposed to be an attachment anyway...
		if ($check_filename && !file_exists($filename))
		{
			ThemeLoader::loadLanguageFile('Errors');

			$protocol = preg_match('~HTTP/1\.[01]~i', $this->_req->server->SERVER_PROTOCOL) ? $this->_req->server->SERVER_PROTOCOL : 'HTTP/1.0';
			$headers
				->removeHeader('all')
				->headerSpecial($protocol . ' 404 Not Found')
				->sendHeaders();

			// We need to die like this *before* we send any anti-caching headers as below.
			die('404 - ' . $txt['attachment_not_found']);

Using exit here is not recommended.

		}

		// If it hasn't been modified since the last time this attachment was retrieved, there's no need to display it again.
		if (!empty($this->_req->server->HTTP_IF_MODIFIED_SINCE))
		{
			list ($modified_since) = explode(';', $this->_req->server->HTTP_IF_MODIFIED_SINCE);
			if (!$check_filename || strtotime($modified_since) >= filemtime($filename))
			{
				@ob_end_clean();

It seems like you do not handle an error condition for ob_end_clean(). This can introduce security issues, and is generally not recommended.

				// Answer the question - no, it hasn't been modified ;).
				$headers
					->removeHeader('all')
					->headerSpecial('HTTP/1.1 304 Not Modified')
					->sendHeaders();
				exit;

Using exit here is not recommended.

			}
		}

		// Check whether the ETag was sent back, and cache based on that...
		if (!empty($this->_req->server->HTTP_IF_NONE_MATCH) && strpos($this->_req->server->HTTP_IF_NONE_MATCH, $eTag) !== false)
		{
			@ob_end_clean();

			$headers
				->removeHeader('all')
				->headerSpecial('HTTP/1.1 304 Not Modified')
				->sendHeaders();
			exit;

Using exit here is not recommended.

		}

		// Send the attachment headers.
		$headers
			->header('Expires', gmdate('D, d M Y H:i:s', time() + 525600 * 60) . ' GMT')
			->header('Last-Modified', gmdate('D, d M Y H:i:s', $check_filename ? filemtime($filename) : time() - 525600 * 60) . ' GMT')
			->header('Accept-Ranges', 'bytes')
			->header('Connection', 'close')
			->header('ETag', $eTag);

		// Different browsers like different standards...
		$headers->setAttachmentFileParams($mime_type, $real_filename, $disposition);

		// If this has an "image extension" - but isn't actually an image - then ensure it isn't cached cause of silly IE.
		if ($do_cache)
		{
			$headers
				->header('Cache-Control', 'max-age=' . (525600 * 60) . ', private');
		}
		else
		{
			$headers
				->header('Pragma', 'no-cache')
				->header('Cache-Control', 'no-cache');
		}

		// Try to buy some time...
		detectServer()->setTimeLimit(600);
	}