docx downloads as zip

[bloodbanker]

I am working on a document management system.  Yesterday I worked on it from home and all was well - I was on Windows7 then.

Today I am at work with Windows XP and docx files are trying to download as a zip file.

I have Office 2007 installed on my XP computer too.

The application will allow both doc and docx files and I store the extension in the database.

I looked at the source code on a page I am having trouble with and it correctly displays the docx extension (http://www.mysite.com/SOPs/drafts/27.docx) and it uploaded to the site correctly as 27.docx.

Here is my cffile

<cffile

  action="upload"

  accept="application/msword, application/vnd.openxmlformats-officedocument.wordprocessingml.document"

  destination="#Application.BasePath#\SOPs\drafts\"

  nameconflict="overwrite"

  filefield="uploadfile"

/>

<cffile

  action="rename"

  source="#Application.BasePath#\SOPs\drafts\#cffile.serverFileName#.#cffile.serverFileExt#"

  destination="#Application.BasePath#\SOPs\drafts\#pk#.#cffile.serverFileExt#"

/>

What the heck can I do to to fix this?  I know, upgrade from XP, but that's not an option.

Thanks

[-__cfSearching__- · Accepted solution]

We need to see the download code as well.   But did you register the mime types with whichever webserver you are using?

<cffile

  action="upload"

  accept="application/msword,...."

As an aside, mime types are easy to spoof. You might be interested in Tips for Secure File Uploads with ColdFusion

Message was edited by: -==cfSearching==-

[bloodbanker]

Thank you for the quick reply.

This is the code used to display the document.

<a href="#Application.BaseURL#/SOPs/drafts/#SOPs_Requests_pk#.#Trim(SOPs_Requests_draft_upload_ext)#">View</a>

The files are stored with the primary key of the document and the extension is stored in the database.

As I mentioned above the source code leads me to believe it is displaying correctly. (http://www.mysite.com/SOPs/drafts/27.docx)

As for making it more secure, thank you for the link, I will keep that in mind for other sites I work on, but this one is very controlled.  It's a password protected site that sites inside our firewall and is only used by about 100 people.  It's nice not to have to worry too much about security.

As for registering the mime types, I'm on a shared Windows 2003 SP2 with IIS6.0.  With IIS7 they would have been automatically registered.  My host registered it for me.  Still no luck.

Like I said, if I view the source code it displays http://www.mysite.com/SOPs/drafts/27.docx and if I visit that link directly, it opens as a Word doc.  I suspect is the way I am trying to display the file.

Here is what the link means:

#Application.BaseURL#/ = http://www.mysite.com

SOPs/drafts = the folder the document is stored in

#SOPs_Requests_pk# = the record in the database that is associated with this file

#Trim(SOPs_Requests_draft_upload_ext)# the extension of the document from the database.  This is a char filed type.

I think I found the problem, but don't know how to solve it.  If I change #Trim(SOPs_Requests_draft_upload_ext)# to docx it opens correctly!  The problem is people may upload doc or docx files.

Sorry for giving so much info, I wanted to make sure you have it all.

[bloodbanker]

Ugh, it's working now.  My host said the mime registration would be immediate, but it wasn't working whilke I was talking to him.  I even uploaded a new document to test it.

Anyhow thanks for the help, it looks like that fixed the problem.