Hello,
SB>Can someone please summarize the problem and add possible solutions and
SB>post it here so we can add it to this document:
SB>http://perl.apache.org/docs/tutorials/client/browserbugs/browserbugs.html
Sometimes, MSIE will ignore the MIME type specified in a Content-Type
header, and instead guess the type of a file based on its extension. For
example, on most Windows systems files with a .reg extension are registry
files. So if you happen to have a Perl script on your mod_perl webserver
called foo.reg, even if it outputs a "Content-Type: text/plain" webserver,
MSIE may treat the output from the URL as a registry file (and pop up a
dialog box asking if you want to "run" the file, e.g., attempt to merge
its contents with the registry, in this example).
This is especially a problem if the computer running MSIE does something
special for .pl files (for example, feed the file to ActiveState Perl).
Here is how to reproduce the bug. Make a simple script like this:
#!/usr/local/bin/perl -w
use strict;
use Apache ();
my $r = Apache->request;
$r->content_type('text/plain');
$r->send_http_header;
$r->print('ok');
Call it plain.reg, and associate .reg files with Apache::Registry. An
.htaccess entry like this may do the trick:
<FilesMatch "\.reg$">
SetHandler perl-script
PerlHandler Apache::Registry
PerlSendHeader On
</FilesMatch>
Now if you access http://www.example.com/plain.reg with MSIE, you may
trigger this bug. (I'm not positive what causes MSIE to ignore
Content-Type on some extensions but not others. If plain.reg doesn't work
for you, try plain.exe, plain.bin, or some other file extensions.)
There are a variety of workarounds.
Easiest is to just fool IE, by making it think the script is named
something else. Most foolproof is to use extra path information:
http://www.example.com/plain.reg/plain.txt
You can also append a dummy parameter. Apparently, MSIE uses a simple
string match to find the extension.
http://www.example.com/plain.reg?bogus=plain.txt
Finally, MSIE respects the Content-Disposition MIME header. This isn't
officially part of the HTTP spec, but is especially useful because you can
suggest a filename. This is nice so that if the user does "Save As..." or
if your script produces a CSV file or some other application specific
output, a pretty filename will be suggested. Just include a line like this
in the Apache::Registry script before calling send_http_header():
$r->header_out('Content-Disposition' => 'inline; filename=plain.txt');
I just verified all of this on freshly patched IE 6.
Humbly,
Andrew
----------------------------------------------------------------------
Andrew Ho http://www.tellme.com/ [EMAIL PROTECTED]
Engineer 1-800-555-TELL Voice 650-930-9062
Tellme Networks, Inc. Fax 650-930-9101
----------------------------------------------------------------------
