Document downloads instead of opens

[Chrisj]

This upload form code works successfully, where a file is chosen, renamed and stored in the 'upload' folder,

and when I select the "Click Here" link from a web page, it shows what was uploaded, successfully.

 

But when I added the extension "doc" and selected "Click Here", instead of showing the document, 

the file automatically shows that it's downloading to my computer. Can you tell me possibly why is that happening?

 

$allowedExts = array("gif", "jpeg", "jpg", "pdf", "doc", "png");
$temp = explode(".", $_FILES["file"]["name"]);
$extension = strtolower( end($temp) );
if (!in_array($extension,$allowedExts))
{
echo ("Error - Invalid File Name");
exit();  
}
$length = 20;
$randomString = (time());
$thumbnail = $randomString . "." . $extension;
move_uploaded_file($_FILES["file"]["tmp_name"], "upload/" . $thumbnail);
$sql = "INSERT INTO videos ( filename ) VALUES( '$thumbnail' )";
mysql_query($sql);
$file_location = '<a href="http://www....com/upload/' . $thumbnail . '">' . $thumbnail . '</a>';

 

[requinix]

Because your server is telling the browser to do a download and/or your browser is not capable of showing the doc.

 

Do you want all files in /upload/ to always show inside the browser? Never download? Are you using Apache?

[Chrisj]

Thanks for your reply.

Yes, I "want all files in /upload/ to always show inside the browser". Never download.

 

Yes, it's Apache

 

Any additional help will be appreciated. 

[requinix]

If you can use .htaccess files then put one in the uploads folder containing

Header set Content-Disposition attachment

If your browser still doesn't show the doc, or other file, inline then there's nothing else you can do - short of verifying that the Content-Disposition header was present in the response (using whatever tool you like).

[Chrisj]

Thanks for your reply.

If I read your reply correctly, this is what I tried, I added this line "Header set Content-Disposition attachment" into a .htaccess file, and then added the .htaccess file to the /upload/ folder, then uploaded a .doc file, but it still downloaded.

If I didn't do that correctly please let me know what to do. If I did that correctly, any other ideas will be appreciated.

[mogosselin]

Like @requinix said, you can check if the line you added in the .htaccess is present in the HTTP header when you call the files.

 

To do that, use the tab 'Network' in Google Chromes' Developer tools (or other developer tools on other browsers). The HTTP header is something that you don't 'see' when you look at a web page, but it is always present when you ask for a web page. 

[Chrisj]

Thanks for your message.

I opened the web page where the "select "Click Here" link is" and then opened "the tab 'Network' in Google Chromes' Developer tools",

and didn't see the line "Header set Content-Disposition attachment" anywhere.

 

My .htaccess file looks like this:

# By default, no module files may be accessed
# directly from a webbrowser.
Order deny,allow
Deny from all

# File types for which we make an exception.
<Files ~ "\.(gif|jpg|jpeg|png|css|doc|js|php)$">
    Order allow,deny
    Allow from all
</Files>

Header set Content-Disposition attachment

ErrorDocument 403 /403.php
ErrorDocument 404 /404.php

AddType application/x-httpd-php .html .htm

Any additional help will be appreciated.

[requinix]

[edit] It should be "inline", not "attachment". Big oops. [/edit]

 

How to use the Network Panel

 

You need to see the response headers for the page. That means opening up the network panel thing, reloading the page, clicking on the request for the page (and not for an image or something else), and reading the headers.

[Chrisj]

Thanks for that reply.

I did go to Google Chrome > Developer Tools > Network --- refreshed --- and then selected the php page 'results1.php > Headers > Request Headers > view source     and I see this:

 

 

GET /results1.php?x=63&y=11 HTTP/1.1

Host: .......com

Connection: keep-alive

Cache-Control: max-age=0

Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8

User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/38.0.2125.111 Safari/537.36

Referer: http://........com/video1.php

Accept-Encoding: gzip,deflate,sdch

Accept-Language: en-US,en;q=0.8

Cookie: user=chrisj; pass=23c50817fd4612579a4aa31634388a2b8815e9; PHPSESSID=32d4133605a93870317c09aa3e8918

Query String Parametersview sourceview URL encoded

 

And I don't see the line "Header set Content-Disposition attachment" anywhere. I look forward to any additional reply/thoughts/guidance.

thanks again

[requinix]

Those are the request headers. You need to look at the response headers. They'll start with "HTTP/1.1 200 OK" (probably).