php download script failing on Droid phone

[HaLo2FrEeEk]

I wrote a script to go through a directory and generate a paginated list of all the files of a certain type. The script works great on my computer, I click the file and it automatically force-downloads the file (which is what I wanted.) I just got the new Droid phone, though, and when I tried downloading some stuff from the page, files that had spaces in them wouldn't work. Files that have no spaces work fine, even files in which the spaces are replaced by underscores. I've tried replacing the spaces with %20, but that doesn't seem to work for some reason.

I really want this to work both desktop and mobile, can someone PLEASE help me!

[Dormilich]

I suspect it to be a matter of the Droid’s browser or OS not supporting file names with spaces.

[HaLo2FrEeEk]

Well how can I spoof it? Thi is the code I'm using to force the download:

header("Cache-Control: ");
  header("Pragma: ");
  header("Content-type: application/octet-stream");
  header("Content-Disposition: attachment; filename=\"".$download."\"");
  header("Content-length:".(string)(filesize($path.$download)));
  readfile($path.$download);

I've tried changing the filename="" value to have spaces replaced with underscores, dashes, plus signs, %20, everything. Nothing works. I suspect that the problem lies with the readfile line, but it doesn't make sense, that's all done on the server. If it works on my browser, it should work on my phone without issue.

[Atli]

Hey.

How is the filename being sent to the download script?
Could it be that the Droid browser is somehow messing up the filename in the request itself, thus causing the readfile function to fail?

[HaLo2FrEeEk]

First I crawl the directory using opendir() and get all the files inside it. Using readdir() in a loop I put only files whose extensions are in the $allow array, into another array called $files. Directly after that I have an if statement that does this:

$download = $_REQUEST['file'];

if(!empty($download) && in_array($download, $files)) {
  header("Cache-Control: ");
  header("Pragma: ");
  header("Content-type: application/octet-stream");
  header("Content-Disposition: attachment; filename=\"".$download."\"");
  header("Content-length:".(string)(filesize($path.$download)));
  readfile($path.$download);
  }

This checks that $download is not empty, and that the filename specified in $download is in the $files array, to prevent people from downloading files from other places on the site.

I print the links out by array_slice()-ing the $files array so I can display 10 results per page and I foreach() the sliced portion. The links are printed to the page in this format:

http://infectionist.com/music/?file=somefilename.mp3

Or in the case of a filename with spaces:

http://infectionist.com/music/?file=some+file+name.mp3

I use urlencode() to print the filename in the link. I just now tried removing the urlencode and just printing the filename variable. Oddly, on my computer the link prints like this:

http://infectionist.com/music/?file=Across the Stars.wma

On my Droid it displays like this:

http://infectionist.com/music/?file=Across%20the%20Stars.wma

It downloads on my computer, not on the droid.