PHP autentikacija - problem

Torej, problem je naslednji.

Imam neke JPEG in PDF datoteke, za katere bi rad, da so dostopne samo z geslom.

Datoteke sem zato spravil na disk izven /www direktorija, torej niso neposredno dostopne (v vpisom URLja v brskalnik).

Imam index.php datoteko, kjer preverim geslo, potem pa prikažem seznam - linke do datotek.
Linki pa so oblikovani v naslednji obliki:
a href="file.php/?ime_fajla.pdf"

Ko kliknem gor, mi skripta file.php preveri avtentikacijo (zaenkrat imam narejeno samo glede na http referer - bom sprogramiral s session cookijem, ko bo ostalo delalo) in če je avtentikacija OK, naj bi skripta poslala ustrezne headerje in datoteko, ki jo prebere iz diska.

Now, the problem.

Na Zendu sem našel skriptico, ki naj bi storila točno to. Pravzaprav naj bi poslala headerje, ki bi omogočili forcible download, da torej brskalnik datoteko downloada in ne odpre.
Te ukaze sem dal v komentar.

Vendar.
Zadeva v FireFoxu lepo dela. V MSIE pa se usuje. In ko se usuje v MSIE, ne dela več tudi v FF.
Usuje se pa tako, da datoteke sploh ne prikaže, pač pa prikaže ... v bistvu nič. Tudi reload ne pomaga.
Vendar to ne velja za vse datoteke - nekatere MSIE lepo prikaže, drugih pa ne. Včasih eno prikaže, v drugem sessionu pa jo ne prikaže več.

A morda kdo ve v čem je trik? Verjetno pošiljam kakšen header narobe, kakšna prav banalna napaka mora biti. Skripta file.php je tule spodaj:

<php
$errormsg = "Dostop do te datoteke ni mogoč brez gesla.";

$wtreferer = addslashes($HTTP_REFERER);

// This is a foo authentication method. Session cookies should be used instead.
if (($wtreferer == "http://***/index.php") || ($wtreferer == "http://***/")) {
  if ($QUERY_STRING=="") {
    echo "Nedovoljen poiskus dostopa!";
  }
  else {
    dl_file($QUERY_STRING);
  }
}
else {
  echo "$errormsg";
}


function dl_file($file){
   // open file from the secret location
   $file = "/home/*******/".$file;

   //First, see if the file exists
   if (!is_file($file)) { die("$errormsg"); }

   //Gather relevent info about file
   $len = filesize($file);
   $filename = basename($file);
   $file_extension = strtolower(substr(strrchr($filename,"."),1));

   //This will set the Content-Type to the appropriate setting for the file
   switch( $file_extension ) {
     case "pdf": $ctype="application/pdf"; break;
     case "exe": $ctype="application/octet-stream"; break;
     case "zip": $ctype="application/zip"; break;
     case "doc": $ctype="application/msword"; break;
     case "xls": $ctype="application/vnd.ms-excel"; break;
     case "ppt": $ctype="application/vnd.ms-powerpoint"; break;
     case "gif": $ctype="image/gif"; break;
     case "png": $ctype="image/png"; break;
     case "jpeg": $ctype="image/jpg"; break;
     case "jpg": $ctype="image/jpg"; break;
     case "mp3": $ctype="audio/mpeg"; break;
     case "wav": $ctype="audio/x-wav"; break;
     case "mpeg": $ctype="video/mpeg"; break;
     case "mpg": $ctype="video/mpeg"; break;
     case "mpe": $ctype="video/mpeg"; break;
     case "mov": $ctype="video/quicktime"; break;
     case "avi": $ctype="video/x-msvideo"; break;

     //The following are for extensions that shouldnt be downloaded (sensitive stuff, like php files)
     case "php":
     case "htm":
     case "html":
     case "txt": die("$errormsg"); break;

     //default: $ctype="application/force-download";
   }

   //Begin writing headers
   //header("Pragma: public");
   //header("Expires: 0");
   //header("Cache-Control: must-revalidate, post-check=0, pre-check=0");
   //header("Cache-Control: public");
   //header("Content-Description: File Transfer");

   //Use the switch-generated Content-Type
   header("Content-Type: $ctype");

   //Force the download
   //$header="Content-Disposition: attachment; filename=".$filename.";";
   header($header );
   //header("Content-Transfer-Encoding: binary");
   header("Content-Length: ".$len);
   @readfile($file);
   exit;
}

?>

Torej, kje pri headerjih ga polomim?

Hmm, jaz bi rad, da ODPRE, ne shrani. Pa niti odpreti noce (oz. vcasih ja, vcasih ne).

OK, zdaj sem dal takole... zadeva naj se ne bi cachirala, naj bi bil binary content in naj bi se prikazalo in ne downloadalo.

FF prikaze ok. MSIE pa... za jpeg pokaze save or open dialog, potem pa downloada in ne prikaze (ce dam open).
Za PDF pa javi "File does not begin with %PDF-".

Koda je pa naslednja:

function dl_file($file){
   $file = "/home/***/".$file;

   //First, see if the file exists
   if (!is_file($file)) { die("$errormsg"); }

   //Gather relevent info about file
   $len = filesize($file);
   $filename = basename($file);
   $file_extension = strtolower(substr(strrchr($filename,"."),1));

   //This will set the Content-Type to the appropriate setting for the file
   switch( $file_extension ) {
     case "pdf": $ctype="application/pdf"; break;
     case "exe": $ctype="application/octet-stream"; break;
     case "zip": $ctype="application/zip"; break;
     case "doc": $ctype="application/msword"; break;
     case "xls": $ctype="application/vnd.ms-excel"; break;
     case "ppt": $ctype="application/vnd.ms-powerpoint"; break;
     case "gif": $ctype="image/gif"; break;
     case "png": $ctype="image/png"; break;
     case "jpeg": $ctype="image/jpg"; break;
     case "jpg": $ctype="image/jpg"; break;
     case "mp3": $ctype="audio/mpeg"; break;
     case "wav": $ctype="audio/x-wav"; break;
     case "mpeg": $ctype="video/mpeg"; break;
     case "mpg": $ctype="video/mpeg"; break;
     case "mpe": $ctype="video/mpeg"; break;
     case "mov": $ctype="video/quicktime"; break;
     case "avi": $ctype="video/x-msvideo"; break;

     //The following are for extensions that shouldnt be downloaded (sensitive stuff, like php files)
     case "php":
     case "htm":
     case "html":
     case "txt": die("$errormsg"); break;

     //Force the download
     //default: $ctype="application/force-download";
   }

   //NEW HEADERZ
   //Begin writing headers
   // Content is never cached
   header("Pragma: no-cache");
   header("Expires: -1");
   header("Cache-Control: private");
   header("Cache-Control: must-revalidate, no-cache, no-store, post-check=0, pre-check=0");
   // Optional header with a description
   //header("Content-Description: File Transfer");
   //NEW HEADERZ

   //OLD HEADERZ
   //header("Pragma: public");
   //header("Expires: 0");
   //header("Cache-Control: must-revalidate, post-check=0, pre-check=0");
   //header("Cache-Control: public");
   //header("Content-Description: File Transfer");
   //OLD HEADERZ

   //Use the switch-generated Content-Type
   header("Content-Type: $ctype");

   //Force the download
   $header="Content-Disposition: inline; filename=".$filename.";";
   header($header );
   header("Content-Transfer-Encoding: binary");
   header("Content-Length: ".$len);
   @readfile($file);
   exit;
}

@Matthai: IE ima velike probleme s PDFji.

header("Content-type: application/pdf");
header("Content-Disposition: attachment; filename=report-" . $input->func . ".pdf");
header("Expires: Mon, 26 Jul 1997 05:00:00 GMT");
header("Cache-Control: must-revalidate, post-check=0,pre-check=0");
header("Pragma: public");

Tole definitivno deluje tudi v IE AFAIR.

AFAIK: Content-Disposition: attachment; mora vedno odpreti okno za shranjevanje datoeke