url parameters on a non-script file (download)

Hello,

I have a problem with urls like

http://site.com/file.exe?fromhere

I used the url of this style for years, with no problems.

Now, on a new server Apache/1.3.27 (Unix) (Red-Hat/Linux)
I've got a problem with IE - it saves the file as file.exe?fromhere
and does not recognize it as an executable.

Can it be caused by some Apache misconfiguration?
BTW, Apache returns Content-Type: application/octet-stream

Thanks
Alex

On Thu, 23 Oct 2003, AlexZ wrote:

> Now, on a new server Apache/1.3.27 (Unix) (Red-Hat/Linux)

presumably specification-conforming...

> I've got a problem with IE

Nothing unusual there, then. It violates mandatory requirements of
Internet and WWW specifications, so problems are the "order of the
day".

> - it saves the file as file.exe?fromhere

Nice...

> and does not recognize it as an executable.

Even better. For once they seem have a right-side failure (whether
intentionally or by accident). Maybe they really _are_ finally taking
security seriously, instead of just telling their PR dept to say they
are...

> Can it be caused by some Apache misconfiguration?

Let's have a URL to demonstrate this behaviour?

> BTW, Apache returns Content-Type: application/octet-stream

Well, that certainly isn't an MS executable content-type. That says,
in effect, "this is an unstructured bag of bytes". A browser would be
behaving entirely correctly in declining to guess what that might be,
and putting the onus on the user to take responsiblity for deciding
what it's fit for.

More detail of the situation as I see it, at
http://ppewww.ph.gla.ac.uk/~flavell/...tent-type.html

Of course, nothing becomes true merely by me saying it is so, but I do
try to support the various assertions by reference to authoritative
specifications.