download a file problem

[jagguy]

ok i have got code that can download a file BUT if i use a download manager it downloads the whole aspx file. The same things happens with PHP and is a big security flaw so i need to stop this. My download manager comes up by default unless i cancel it then it works with normal save file to download.

I cant have this as the download manager will download the aspx file i am using.

What this is doing with a download manager is downloading the url name instead of the given filename. so if the file name in the url is http..../download.aspx it will download that file.

        Dim fullpath As String
        Dim name As String
        Dim type As String = ""
        Dim ext As String
        Dim forceDownload As Boolean
        name = "revision3.doc"
        forceDownload = True
        ext = ".doc"
        fullpath = "f:\asp\" + name


        If Not IsDBNull(ext) Then
            ext = LCase(ext)
        End If

        Select Case ext
            Case ".htm", ".html"
                type = "text/HTML"
            Case ".txt"
                type = "text/plain"
            Case ".doc", ".rtf"
                type = "Application/msword"
            Case ".csv", ".xls"
                type = "Application/x-msexcel"
            Case Else
                type = "text/plain"
        End Select

        If (forceDownload) Then
            Response.AppendHeader("content-disposition", _
            "attachment; filename=" + name)
        End If
        If type <> "" Then
            Response.ContentType = type
        End If

        Response.WriteFile(fullpath)
        Response.End()
    End Sub

[mendhak]

Response.Clear() before you AppendHeader(). Look at this sample code and compare it with what you've got.

http://www.vbforums.com/showpost.php...78&postcount=2

Besides, if you just want them to download it, send it as an octet stream. Does the type then matter?

[jagguy]

it doesnt work sorry using a download manager.
when i download a file my 3rd part download manager comes up and downloads the file from the URL (which is the actual aspx file that downloads and NOT the file I require which is set in that file revision3.doc).

now if i click cancel then a second screen appears which is the normal download screen and it correctly downloads the revision3.doc.

Now I need this fixed for security reasons.

    Dim fullpath As String
        Dim name As String
        Dim type As String = ""
        Dim ext As String
        Dim forceDownload As Boolean
        name = "revision3.doc"
        forceDownload = True
        ext = ".doc"
        fullpath = "f:\asp\" + name
        ' Dim ext2 = Path.GetExtension(fullpath)
        'TextBox1.Text = ext2.ToString

        Dim FilePath As String = fullpath

        Dim TargetFile As New FileInfo(FilePath)


        If Not IsDBNull(ext) Then
            ext = LCase(ext)
        End If

        Select Case ext
            Case ".htm", ".html"
                type = "text/HTML"
            Case ".txt"
                type = "text/plain"
            Case ".doc", ".rtf"
                type = "Application/msword"
            Case ".csv", ".xls"
                type = "Application/x-msexcel"
            Case Else
                type = "text/plain"
        End Select

        If (forceDownload) Then
            Response.Clear()
            Response.AppendHeader("content-disposition", _
            "attachment; filename=" + TargetFile.Name)

            Response.AddHeader("Content-Length", TargetFile.Length.ToString())


        End If
        If type <> "" Then
            ' Response.ContentType = type
            Response.ContentType = "application/octet-stream"
        End If

        Response.WriteFile(TargetFile.FullName)
        Response.End()

[mendhak]

What else are you doing on the page? Does it have any HTML/aspx content?

[jagguy]

the code i gave is all in the button click and there is nothing else in that button click code. .

Protected Sub Button3_Click(ByVal sender As Object, ByVal e As System.EventArgs) Handles Button3.Click


in the page (design area)i have a few asp buttons and 1 textbox.

note php has the same problem until i tweaked a few commands

do you mean i cant use an asp button for this?

[mendhak]

Can the third party downloader do a button click? No. It has no way of knowing that you want the download to happen on the button click.

Therefore, you need to put the download in a separate, standalone page without any markup (HTML/ASPX) in it. Just do it on the page load, based upon querystring parameters if you need.

[jagguy]

ok when i run a page with any content i cant simply overwrite the headers with code for a download manager .

i am not exactly sure how this works but it seems any content written to the screen before a download sets the variables which the download manager picks up.

[mendhak]

Yes, hence the need for a standalone page. Treat the page in the browser as you would with the third party downloader, the browser itself is a download tool of sorts. If you have to 'do' something on the page to get the download working, then the third party downloader will need to do the same. Hence, you need a response.redirect which takes you to the real download page.