[- use MIME::Types; use IO::File; my ($filename); # Do not allow the user to specify anything including slashes (this # means, do not allow directory traversals. Any amount of consecutive # periods will be converted to a single period. Finally, don't serve # Perl (.pm), Embperl (.epl) or plain HTML (.htm, .html) files off # this directory. (how not to serve them? Easy, just chop those # suffixes off ;-) Yes, might lead to some strangeness, but then # again... It just works(tm) ;-) ) $fdat{file} =~ s!/!!g; $fdat{file} =~ s!\.+!\.!g; $fdat{file} =~ s!\.(?:pm|epl|html?)!!g; $filename = $epreq->{conf}->static_dir . '/' . $fdat{file}; if (my $fh = IO::File->new($filename, 'r')) { my ($type, $mime); $mime = MIME::Types->new or die "Could not query MIME type"; $type = $mime->mimeTypeOf($filename) or 'application/octet-stream'; $epreq->{webclient}->content_type($type); $http_headers_out{'Content-Disposition'} = "attachment; filename=" . $filename; print OUT $fh->getlines; $fh->close; # Exit in order not to break binary content (don't worry, this is # Embperl-safe) exit 0; } -] Could not open requested file