Re: Content-Type not working on MSIE

Hello,

SB>Can someone please summarize the problem and add possible solutions and
SB>post it here so we can add it to this document:
SB>http://perl.apache.org/docs/tutorials/client/browserbugs/browserbugs.html

Sometimes, MSIE will ignore the MIME type specified in a Content-Type
header, and instead guess the type of a file based on its extension. For
example, on most Windows systems files with a .reg extension are registry
files. So if you happen to have a Perl script on your mod_perl webserver
called foo.reg, even if it outputs a "Content-Type: text/plain" webserver,
MSIE may treat the output from the URL as a registry file (and pop up a
dialog box asking if you want to "run" the file, e.g., attempt to merge
its contents with the registry, in this example).

This is especially a problem if the computer running MSIE does something
special for .pl files (for example, feed the file to ActiveState Perl).

Here is how to reproduce the bug. Make a simple script like this:

    #!/usr/local/bin/perl -w
    use strict;

    use Apache ();

    my $r = Apache->request;
    $r->content_type('text/plain');
    $r->send_http_header;
    $r->print('ok');

Call it plain.reg, and associate .reg files with Apache::Registry. An
.htaccess entry like this may do the trick:

    <FilesMatch "\.reg$">
        SetHandler perl-script
        PerlHandler Apache::Registry
        PerlSendHeader On
    </FilesMatch>

Now if you access http://www.example.com/plain.reg with MSIE, you may
trigger this bug. (I'm not positive what causes MSIE to ignore
Content-Type on some extensions but not others. If plain.reg doesn't work
for you, try plain.exe, plain.bin, or some other file extensions.)

There are a variety of workarounds.

Easiest is to just fool IE, by making it think the script is named
something else. Most foolproof is to use extra path information:

    http://www.example.com/plain.reg/plain.txt

You can also append a dummy parameter. Apparently, MSIE uses a simple
string match to find the extension.

    http://www.example.com/plain.reg?bogus=plain.txt

Finally, MSIE respects the Content-Disposition MIME header. This isn't
officially part of the HTTP spec, but is especially useful because you can
suggest a filename. This is nice so that if the user does "Save As..." or
if your script produces a CSV file or some other application specific
output, a pretty filename will be suggested. Just include a line like this
in the Apache::Registry script before calling send_http_header():

    $r->header_out('Content-Disposition' => 'inline; filename=plain.txt');

I just verified all of this on freshly patched IE 6.

Humbly,

Andrew

----------------------------------------------------------------------
Andrew Ho               http://www.tellme.com/       andrew@xxxxxxxxxx
Engineer                    1-800-555-TELL          Voice 650-930-9062
Tellme Networks, Inc.                                 Fax 650-930-9101
----------------------------------------------------------------------