I can not download files from Drupal, server running on https/ssl

  • Using IE7
  • Download method: Private - files are transferred by Drupal.
  • Site accessed over https/ssl

IE can not download the file, apparently because it can not store files downloaded over https in the browser cache.

This issue is described in more detail in a 4.x bug report as well. http://drupal.org/node/163298
I think it is mentioned here as well
http://support.microsoft.com/kb/323308/en-us

The problem can be solved by sending custom headers to IE

CommentFileSizeAuthor
#19 181036_ie_cannot_dl_over_ssl_19.patch931 bytesaspilicious
#14 ie_cannot_dl_over_ssl-181036-14.d7.patch878 bytesgreg.1.anderson
#6 ie_cannot_dl_over_ssl-181036-6.patch996 bytesmlsamuelson
#4 ssl.patch749 bytesjody lynn
#2 file.inc_.patch836 bytesBodo Maass

Comments

dovry’s picture

dovry commented

I think I've solved the problem by making changes in the file module, similar to the solution others have posted for drupal 4.x (se related bug report). 

/**
 * Transfer file using http to client. Pipes a file through Drupal to the
 * client.
 *
 * @param $source File to transfer.
 * @param $headers An array of http headers to send along with file.
 */
function file_transfer($source, $headers) {
  ob_end_clean();
  global $base_url; //********* added ************
  foreach ($headers as $header) {
    // To prevent HTTP header injection, we delete new lines that are
    // not followed by a space or a tab.
    // See http://www.w3.org/Protocols/rfc2616/rfc2616-sec4.html#sec4.2
    $header = preg_replace('/\r?\n(?!\t| )/', '', $header);
    drupal_set_header($header);
  }

  //*********** added *******************
  if (preg_match('|^https://|', $base_url)) {
    drupal_set_header('Cache-Control: private');
    drupal_set_header('Pragma: private');
  }
  //*********** /added *******************

  $source = file_create_path($source);

  // Transfer file in 1024 byte chunks to save memory usage.
  if ($fd = fopen($source, 'rb')) {
    while (!feof($fd)) {
      print fread($fd, 1024);
    }
    fclose($fd);
  }
  else {
    drupal_not_found();
  }
  exit();
}
Bodo Maass’s picture

Bodo Maass commented
Version: 5.2 » 5.15
Status: Active » Reviewed & tested by the community
StatusFileSize
new file.inc_.patch836 bytes

Hi dovry,

Thanks for this patch. I found the same problem on Drupal 5.15, and your code fixed it. I think this should be committed, because it clearly is a bug.
Attached is the same code as a patch to file.inc.

With this I have tested that the private file transfers work over https in IE6, IE7, FF3 and Opera 9.6. Normal (http) transfers are unaffected by the patch.

drumm’s picture

drumm
he/him
Location NY, US
commented
Version: 5.15 » 7.x-dev
Status: Reviewed & tested by the community » Needs work

There should be a code comment explaining the addition since this is not obvious from reading the code. Code comments like // *** added **** are completely unnecessary.

It appears that the development version of Drupal has the same issue, the same Cache-Control headers are set. I would like to see this fixed there and then backported as needed.

jody lynn’s picture

jody lynn
she/her
Primary language English
commented
Status: Needs work » Needs review
StatusFileSize
new ssl.patch749 bytes

Rerolled for HEAD with comments fixed.

Status: Needs review » Needs work

The last submitted patch failed testing.

mlsamuelson’s picture

mlsamuelson commented
Status: Needs work » Needs review
StatusFileSize
new ie_cannot_dl_over_ssl-181036-6.patch996 bytes

This problem continues to persist in IE browsers.

Patch updated for HEAD (Drupal 7).

greg.1.anderson’s picture

greg.1.anderson commented

Note that there is already a patch for d6 at #163445: Internet Explorer cannot download private files. Please commit to d6 after accepting in d7.

aspilicious’s picture

aspilicious commented

#6: ie_cannot_dl_over_ssl-181036-6.patch queued for re-testing.

damien tournoud’s picture

damien tournoud commented
Status: Needs review » Needs work 
if (preg_match('|^https://|', $base_url)) {}

should probably be:

if ($is_https) {}

As this decision should be based on the state of the protocol of the current request, not on the protocol of the base URL.

The last submitted patch, ie_cannot_dl_over_ssl-181036-12.d7.patch, failed testing.

greg.1.anderson’s picture

greg.1.anderson commented
Status: Needs work » Needs review
StatusFileSize
new ie_cannot_dl_over_ssl-181036-14.d7.patch878 bytes

Good point. I tested that on d6, and it works well. (Used server variables instead of $is_https on d6; see #163445: Internet Explorer cannot download private files.)

Here is the d7 version, untested, but should work equally well. [I deleted two previous patches that did not pass SimpleTest; oops.]

yesct’s picture

yesct commented

#14: ie_cannot_dl_over_ssl-181036-14.d7.patch queued for re-testing.

greg.1.anderson’s picture

greg.1.anderson commented

Note that in 163445#43, pescetti posted a new patch that also adds Content-Disposition: to the header. This did not seem to be an issue for me, but might be important in some configurations.

yesct’s picture

yesct commented

I tried the patch in #4 on my D6 site...
and got
patching file includes/file.inc
Hunk #1 succeeded at 819 (offset -501 lines).

I'm guessing this needs to be fixed in D7 first, then ported back to D6. But I thought it might have gone through a D6 version over the years... is the one in #4 the right one for D6?

greg.1.anderson’s picture

greg.1.anderson commented

I recommend 163445#43 for D6. That patch should be re-rolled for D7 and posted here.

aspilicious’s picture

aspilicious commented
StatusFileSize
new 181036_ie_cannot_dl_over_ssl_19.patch931 bytes

Reroll

webengr’s picture

webengr commented

subscribe....

I can not believe this is still not fixed,,, every core update I have to rehack to fix customers...

greg.1.anderson’s picture

greg.1.anderson commented

I can no longer reproduce this problem, and believe it probably has been fixed.

With IE 8.0.6001 and a fresh install of drupal-7.x-HEAD, which includes includes/file.inc,v229, I found that I could download a .pdf using the private download method. The patch in #19 is not applied in my file.inc,v229, but when I pull down the file, I find that Cache-Control: private and the Content-Disposition: attachment lines are being sent, although Pragma:private is not included.

Cache-control: private was added by #898036: Private images broken, which I believe takes care of this issue as well. I recommend closing this as a duplicate, but I'm leaving this open for secondary verification.

greg.1.anderson’s picture

greg.1.anderson commented
Status: Needs review » Closed (duplicate)

Since no one has shown any interest in this issue in ~6 months, I'm taking that as confirmation that this issue is fixed as described above. Closing.

webengr’s picture

webengr commented

Actually I think it was not fixed till a few days later after your post, there is another forum
thread with patches and Gábor Hojtsy submitted the patch to core on April 14th 2011 that may address this issue:

http://drupal.org/node/163445#comment-4346740

greg.1.anderson’s picture

greg.1.anderson commented

In d6, you are correct; in d7, this issue was fixed per #21 some time ago.