/**
* Send file to browser
*/
function send_file_to_browser($attachment, $upload_dir)
{
    $filename = $upload_dir . $attachment;
    if (!@file_exists($filename)) {
        trigger_error(phpbb::$user->lang['ERROR_NO_ATTACHMENT'] . '<br /><br />' . sprintf(phpbb::$user->lang['FILE_NOT_FOUND_404'], $filename));
    }
    if (@ob_get_length()) {
        @ob_end_clean();
    }
    // Now send the File Contents to the Browser
    $size = @filesize($filename);
    // To correctly display further errors we need to make sure we are using the correct headers for both (unsetting content-length may not work)
    // Check if headers already sent or not able to get the file contents.
    if (headers_sent() || !@file_exists($filename) || !@is_readable($filename)) {
        // PHP track_errors setting On?
        if (!empty($php_errormsg)) {
            trigger_error(phpbb::$user->lang['UNABLE_TO_DELIVER_FILE'] . '<br />' . sprintf(phpbb::$user->lang['TRACKED_PHP_ERROR'], $php_errormsg));
        }
        trigger_error('UNABLE_TO_DELIVER_FILE');
    }
    // Now the tricky part... let's dance
    header('Pragma: public');
    // Send out the Headers. Do not set Content-Disposition to inline please, it is a security measure for users using the Internet Explorer.
    $is_ie8 = strpos(strtolower(phpbb::$user->browser), 'msie 8.0') !== false;
    header('Content-Type: text/xml');
    if ($is_ie8) {
        header('X-Content-Type-Options: nosniff');
    }
    if ($size) {
        header("Content-Length: {$size}");
    }
    // Close the db connection before sending the file
    phpbb::$db->sql_close();
    if (!set_modified_headers(@filemtime($attachment), phpbb::$user->browser)) {
        // Try to deliver in chunks
        @set_time_limit(0);
        $fp = @fopen($filename, 'rb');
        if ($fp !== false) {
            while (!feof($fp)) {
                echo fread($fp, 8192);
            }
            fclose($fp);
        } else {
            @readfile($filename);
        }
        flush();
    }
    file_gc();
}

/**
* Send file to browser
*/
function send_file_to_browser($attachment, $upload_dir, $category)
{
    global $user, $db, $config, $phpbb_root_path, $request;
    $filename = $phpbb_root_path . $upload_dir . '/' . $attachment['physical_filename'];
    if (!@file_exists($filename)) {
        send_status_line(404, 'Not Found');
        trigger_error('ERROR_NO_ATTACHMENT');
    }
    // Correct the mime type - we force application/octetstream for all files, except images
    // Please do not change this, it is a security precaution
    if ($category != ATTACHMENT_CATEGORY_IMAGE || strpos($attachment['mimetype'], 'image') !== 0) {
        $attachment['mimetype'] = strpos(strtolower($user->browser), 'msie') !== false || strpos(strtolower($user->browser), 'opera') !== false ? 'application/octetstream' : 'application/octet-stream';
    }
    if (@ob_get_length()) {
        @ob_end_clean();
    }
    // Now send the File Contents to the Browser
    $size = @filesize($filename);
    // To correctly display further errors we need to make sure we are using the correct headers for both (unsetting content-length may not work)
    // Check if headers already sent or not able to get the file contents.
    if (headers_sent() || !@file_exists($filename) || !@is_readable($filename)) {
        // PHP track_errors setting On?
        if (!empty($php_errormsg)) {
            send_status_line(500, 'Internal Server Error');
            trigger_error($user->lang['UNABLE_TO_DELIVER_FILE'] . '<br />' . sprintf($user->lang['TRACKED_PHP_ERROR'], $php_errormsg));
        }
        send_status_line(500, 'Internal Server Error');
        trigger_error('UNABLE_TO_DELIVER_FILE');
    }
    // Make sure the database record for the filesize is correct
    if ($size > 0 && $size != $attachment['filesize']) {
        // Update database record
        $sql = 'UPDATE ' . ATTACHMENTS_TABLE . '
			SET filesize = ' . (int) $size . '
			WHERE attach_id = ' . (int) $attachment['attach_id'];
        $db->sql_query($sql);
    }
    // Now the tricky part... let's dance
    header('Cache-Control: public');
    // Send out the Headers. Do not set Content-Disposition to inline please, it is a security measure for users using the Internet Explorer.
    header('Content-Type: ' . $attachment['mimetype']);
    if (phpbb_is_greater_ie_version($user->browser, 7)) {
        header('X-Content-Type-Options: nosniff');
    }
    if ($category == ATTACHMENT_CATEGORY_FLASH && $request->variable('view', 0) === 1) {
        // We use content-disposition: inline for flash files and view=1 to let it correctly play with flash player 10 - any other disposition will fail to play inline
        header('Content-Disposition: inline');
    } else {
        if (empty($user->browser) || strpos(strtolower($user->browser), 'msie') !== false && !phpbb_is_greater_ie_version($user->browser, 7)) {
            header('Content-Disposition: attachment; ' . header_filename(htmlspecialchars_decode($attachment['real_filename'])));
            if (empty($user->browser) || strpos(strtolower($user->browser), 'msie 6.0') !== false) {
                header('Expires: ' . gmdate('D, d M Y H:i:s', time()) . ' GMT');
            }
        } else {
            header('Content-Disposition: ' . (strpos($attachment['mimetype'], 'image') === 0 ? 'inline' : 'attachment') . '; ' . header_filename(htmlspecialchars_decode($attachment['real_filename'])));
            if (phpbb_is_greater_ie_version($user->browser, 7) && strpos($attachment['mimetype'], 'image') !== 0) {
                header('X-Download-Options: noopen');
            }
        }
    }
    // Close the db connection before sending the file etc.
    file_gc(false);
    if (!set_modified_headers($attachment['filetime'], $user->browser)) {
        // We make sure those have to be enabled manually by defining a constant
        // because of the potential disclosure of full attachment path
        // in case support for features is absent in the webserver software.
        if (defined('PHPBB_ENABLE_X_ACCEL_REDIRECT') && PHPBB_ENABLE_X_ACCEL_REDIRECT) {
            // X-Accel-Redirect - http://wiki.nginx.org/XSendfile
            header('X-Accel-Redirect: ' . $user->page['root_script_path'] . $upload_dir . '/' . $attachment['physical_filename']);
            exit;
        } else {
            if (defined('PHPBB_ENABLE_X_SENDFILE') && PHPBB_ENABLE_X_SENDFILE && !phpbb_http_byte_range($size)) {
                // X-Sendfile - http://blog.lighttpd.net/articles/2006/07/02/x-sendfile
                // Lighttpd's X-Sendfile does not support range requests as of 1.4.26
                // and always requires an absolute path.
                header('X-Sendfile: ' . dirname(__FILE__) . "/../{$upload_dir}/{$attachment['physical_filename']}");
                exit;
            }
        }
        if ($size) {
            header("Content-Length: {$size}");
        }
        // Try to deliver in chunks
        @set_time_limit(0);
        $fp = @fopen($filename, 'rb');
        if ($fp !== false) {
            // Deliver file partially if requested
            if ($range = phpbb_http_byte_range($size)) {
                fseek($fp, $range['byte_pos_start']);
                send_status_line(206, 'Partial Content');
                header('Content-Range: bytes ' . $range['byte_pos_start'] . '-' . $range['byte_pos_end'] . '/' . $range['bytes_total']);
                header('Content-Length: ' . $range['bytes_requested']);
            }
            while (!feof($fp)) {
                echo fread($fp, 8192);
            }
            fclose($fp);
//.........这里部分代码省略.........

/**
* Send file to browser
*/
function send_file_to_browser($attachment, $upload_dir)
{
    $filename = $upload_dir . $attachment['physical_filename'];
    if (!@file_exists($filename)) {
        trigger_error(phpbb::$user->lang['ERROR_NO_ATTACHMENT'] . '<br /><br />' . sprintf(phpbb::$user->lang['FILE_NOT_FOUND_404'], $filename));
    }
    // Correct the mime type - we force application/octetstream for all files, except images
    // Please do not change this, it is a security precaution
    if (strpos($attachment['mimetype'], 'image') !== 0) {
        $attachment['mimetype'] = strpos(strtolower(phpbb::$user->browser), 'msie') !== false || strpos(strtolower(phpbb::$user->browser), 'opera') !== false ? 'application/octetstream' : 'application/octet-stream';
    }
    if (@ob_get_length()) {
        @ob_end_clean();
    }
    // Now send the File Contents to the Browser
    $size = @filesize($filename);
    // To correctly display further errors we need to make sure we are using the correct headers for both (unsetting content-length may not work)
    // Check if headers already sent or not able to get the file contents.
    if (headers_sent() || !@file_exists($filename) || !@is_readable($filename)) {
        // PHP track_errors setting On?
        if (!empty($php_errormsg)) {
            trigger_error(phpbb::$user->lang['UNABLE_TO_DELIVER_FILE'] . '<br />' . sprintf(phpbb::$user->lang['TRACKED_PHP_ERROR'], $php_errormsg));
        }
        trigger_error('UNABLE_TO_DELIVER_FILE');
    }
    // Now the tricky part... let's dance
    header('Pragma: public');
    // Send out the Headers. Do not set Content-Disposition to inline please, it is a security measure for users using the Internet Explorer.
    $is_ie8 = strpos(strtolower(phpbb::$user->browser), 'msie 8.0') !== false;
    header('Content-Type: ' . $attachment['mimetype']);
    if ($is_ie8) {
        header('X-Content-Type-Options: nosniff');
    }
    if (empty(phpbb::$user->browser) || !$is_ie8 && strpos(strtolower(phpbb::$user->browser), 'msie') !== false) {
        header('Content-Disposition: attachment; ' . header_filename(htmlspecialchars_decode($attachment['real_filename'])));
        if (empty(phpbb::$user->browser) || strpos(strtolower(phpbb::$user->browser), 'msie 6.0') !== false) {
            header('expires: -1');
        }
    } else {
        header('Content-Disposition: ' . (strpos($attachment['mimetype'], 'image') === 0 ? 'inline' : 'attachment') . '; ' . header_filename(htmlspecialchars_decode($attachment['real_filename'])));
        if ($is_ie8 && strpos($attachment['mimetype'], 'image') !== 0) {
            header('X-Download-Options: noopen');
        }
    }
    if ($size) {
        header("Content-Length: {$size}");
    }
    // Close the db connection before sending the file
    phpbb::$db->sql_close();
    if (!set_modified_headers($attachment['filetime'], phpbb::$user->browser)) {
        // Try to deliver in chunks
        @set_time_limit(0);
        $fp = @fopen($filename, 'rb');
        if ($fp !== false) {
            while (!feof($fp)) {
                echo fread($fp, 8192);
            }
            fclose($fp);
        } else {
            @readfile($filename);
        }
        flush();
    }
    file_gc();
}

/**
* Send file to browser
*/
function send_file_to_browser($attachment, $upload_dir, $category)
{
    global $user, $db, $config, $phpbb_root_path;
    $filename = $phpbb_root_path . $upload_dir . '/' . $attachment['physical_filename'];
    if (!@file_exists($filename)) {
        trigger_error($user->lang['ERROR_NO_ATTACHMENT'] . '<br /><br />' . sprintf($user->lang['FILE_NOT_FOUND_404'], $filename));
    }
    // Correct the mime type - we force application/octetstream for all files, except images
    // Please do not change this, it is a security precaution
    if ($category != ATTACHMENT_CATEGORY_IMAGE || strpos($attachment['mimetype'], 'image') !== 0) {
        $attachment['mimetype'] = strpos(strtolower($user->browser), 'msie') !== false || strpos(strtolower($user->browser), 'opera') !== false ? 'application/octetstream' : 'application/octet-stream';
    }
    if (@ob_get_length()) {
        @ob_end_clean();
    }
    // Now send the File Contents to the Browser
    $size = @filesize($filename);
    // To correctly display further errors we need to make sure we are using the correct headers for both (unsetting content-length may not work)
    // Check if headers already sent or not able to get the file contents.
    if (headers_sent() || !@file_exists($filename) || !@is_readable($filename)) {
        // PHP track_errors setting On?
        if (!empty($php_errormsg)) {
            trigger_error($user->lang['UNABLE_TO_DELIVER_FILE'] . '<br />' . sprintf($user->lang['TRACKED_PHP_ERROR'], $php_errormsg));
        }
        trigger_error('UNABLE_TO_DELIVER_FILE');
    }
    // Now the tricky part... let's dance
    header('Pragma: public');
    /**
     * Commented out X-Sendfile support. To not expose the physical filename within the header if xsendfile is absent we need to look into methods of checking it's status.
     *
     * Try X-Sendfile since it is much more server friendly - only works if the path is *not* outside of the root path...
     * lighttpd has core support for it. An apache2 module is available at http://celebnamer.celebworld.ws/stuff/mod_xsendfile/
     *
     * Not really ideal, but should work fine...
     * <code>
     *	if (strpos($upload_dir, '/') !== 0 && strpos($upload_dir, '../') === false)
     *	{
     *		header('X-Sendfile: ' . $filename);
     *	}
     * </code>
     */
    // Send out the Headers. Do not set Content-Disposition to inline please, it is a security measure for users using the Internet Explorer.
    $is_ie8 = strpos(strtolower($user->browser), 'msie 8.0') !== false;
    header('Content-Type: ' . $attachment['mimetype'] . ($is_ie8 ? '; authoritative=true;' : ''));
    if (empty($user->browser) || !$is_ie8 && strpos(strtolower($user->browser), 'msie') !== false) {
        header('Content-Disposition: attachment; ' . header_filename(htmlspecialchars_decode($attachment['real_filename'])));
        if (empty($user->browser) || strpos(strtolower($user->browser), 'msie 6.0') !== false) {
            header('expires: -1');
        }
    } else {
        header('Content-Disposition: ' . (strpos($attachment['mimetype'], 'image') === 0 ? 'inline' : 'attachment') . '; ' . header_filename(htmlspecialchars_decode($attachment['real_filename'])));
        if ($is_ie8 && strpos($attachment['mimetype'], 'image') !== 0) {
            header('X-Download-Options: noopen');
        }
    }
    if ($size) {
        header("Content-Length: {$size}");
    }
    // Close the db connection before sending the file
    $db->sql_close();
    if (!set_modified_headers($attachment['filetime'], $user->browser)) {
        // Try to deliver in chunks
        @set_time_limit(0);
        $fp = @fopen($filename, 'rb');
        if ($fp !== false) {
            while (!feof($fp)) {
                echo fread($fp, 8192);
            }
            fclose($fp);
        } else {
            @readfile($filename);
        }
        flush();
    }
    file_gc();
}

        header('Content-Disposition: attachment; ' . header_filename(htmlspecialchars_decode($attachment['real_filename'])));
        if (empty($user->browser) || strpos(strtolower($user->browser), 'msie 6.0') !== false) {
            header('expires: -1');
        }
    } else {
        header('Content-Disposition: ' . (strpos($attachment['mimetype'], 'image') === 0 ? 'inline' : 'attachment') . '; ' . header_filename(htmlspecialchars_decode($attachment['real_filename'])));
        if ($is_ie8 && strpos($attachment['mimetype'], 'image') !== 0) {
            header('X-Download-Options: noopen');
        }
    }
    if ($size) {
        header("Content-Length: {$size}");
    }
    // clean up properly before sending the file
    garbage_collection();
    if (!set_modified_headers($attachment['filetime'], $user->browser)) {
        // Try to deliver in chunks
        @set_time_limit(0);
        $fp = @fopen($filename, 'rb');
        if ($fp !== false) {
            while (!feof($fp)) {
                echo fread($fp, 8192);
            }
            fclose($fp);
        } else {
            @readfile($filename);
        }
        flush();
    }
}
// ****************************

 $avatar_group = false;
 $exit = false;
 if (isset($filename[0]) && $filename[0] === 'g') {
     $avatar_group = true;
     $filename = substr($filename, 1);
 }
 // '==' is not a bug - . as the first char is as bad as no dot at all
 if (strpos($filename, '.') == false) {
     send_status_line(403, 'Forbidden');
     $exit = true;
 }
 if (!$exit) {
     $ext = substr(strrchr($filename, '.'), 1);
     $stamp = (int) substr(stristr($filename, '_'), 1);
     $filename = (int) $filename;
     $exit = set_modified_headers($stamp, $browser);
 }
 if (!$exit && !in_array($ext, array('png', 'gif', 'jpg', 'jpeg'))) {
     // no way such an avatar could exist. They are not following the rules, stop the show.
     send_status_line(403, 'Forbidden');
     $exit = true;
 }
 if (!$exit) {
     if (!$filename) {
         // no way such an avatar could exist. They are not following the rules, stop the show.
         send_status_line(403, 'Forbidden');
     } else {
         send_avatar_to_browser(($avatar_group ? 'g' : '') . $filename . '.' . $ext, $browser);
     }
 }
 file_gc();

 /**
  * Sending the image to the browser.
  * Mostly copied from phpBB::download/file.php
  */
 public function send_image_to_browser($content_length = 0)
 {
     global $db, $user;
     if (!$this->image_content_type) {
         // We don't have the image, so we guess the mime_type by filename
         $this->image_content_type = $this->mimetype_by_filename($this->image_source);
         if (!$this->image_content_type) {
             trigger_error('NO_MIMETYPE_MATCHED');
         }
     }
     header('Pragma: public');
     header('Content-Type: ' . $this->image_content_type);
     if (self::is_ie_greater7($user->browser)) {
         header('X-Content-Type-Options: nosniff');
     }
     if (empty($user->browser) || !self::is_ie_greater7($user->browser) && strpos(strtolower($user->browser), 'msie') !== false) {
         header('Content-Disposition: attachment; ' . $this->header_filename(htmlspecialchars_decode($this->image_name)));
         if (empty($user->browser) || strpos(strtolower($user->browser), 'msie 6.0') !== false) {
             header('expires: -1');
         }
     } else {
         header('Content-Disposition: inline; ' . $this->header_filename(htmlspecialchars_decode($this->image_name)));
         if (self::is_ie_greater7($user->browser)) {
             header('X-Download-Options: noopen');
         }
     }
     if ($content_length) {
         header('Content-Length: ' . $content_length);
     }
     garbage_collection();
     $cached = false;
     if ($this->browser_cache) {
         $this->set_last_modified(@filemtime($this->image_source));
         if (!function_exists('\\set_modified_headers')) {
             global $phpbb_root_path, $phpEx;
             include $phpbb_root_path . 'includes/functions_download.' . $phpEx;
         }
         $cached = \set_modified_headers($this->last_modified, $user->browser);
     }
     if ($cached) {
         return;
     } else {
         if ($this->image) {
             $image_function = 'image' . $this->image_type;
             $image_function($this->image);
         } else {
             // Try to deliver in chunks
             @set_time_limit(0);
             $fp = fopen($this->image_source, 'rb');
             if ($fp !== false) {
                 while (!feof($fp)) {
                     echo fread($fp, 8192);
                 }
                 fclose($fp);
             } else {
                 @readfile($this->image_source);
             }
             flush();
         }
     }
 }

    /**
     * Send file to browser
     *
     * Copy of send_file_to_browser() from functions_download.php
     * with some minor modifications to work correctly in Titania.
     *
     * @param array $attachment	Attachment data.
     * @param string $filename	Full path to the attachment file.
     * @param int $category		Attachment category.
     *
     * @return \Symfony\Component\HttpFoundation\Response if error found. Otherwise method exits.
     */
    protected function send_file_to_browser($attachment, $filename, $category)
    {
        if (!@file_exists($filename)) {
            return $this->helper->error('ERROR_NO_ATTACHMENT', 404);
        }
        // Correct the mime type - we force application/octetstream for all files, except images
        // Please do not change this, it is a security precaution
        if ($category != ATTACHMENT_CATEGORY_IMAGE || strpos($attachment['mimetype'], 'image') !== 0) {
            $attachment['mimetype'] = strpos(strtolower($this->user->browser), 'msie') !== false || strpos(strtolower($this->user->browser), 'opera') !== false ? 'application/octetstream' : 'application/octet-stream';
        }
        if (@ob_get_length()) {
            @ob_end_clean();
        }
        // Now send the File Contents to the Browser
        $size = @filesize($filename);
        // To correctly display further errors we need to make sure we are using the correct headers for both (unsetting content-length may not work)
        // Check if headers already sent or not able to get the file contents.
        if (headers_sent() || !@file_exists($filename) || !@is_readable($filename)) {
            // PHP track_errors setting On?
            if (!empty($php_errormsg)) {
                return $this->helper->error($this->user->lang['UNABLE_TO_DELIVER_FILE'] . '<br />' . $this->user->lang('TRACKED_PHP_ERROR', $php_errormsg), self::INTERNAL_SERVER_ERROR);
            }
            return $this->helper->error('UNABLE_TO_DELIVER_FILE', self::INTERNAL_SERVER_ERROR);
        }
        // Make sure the database record for the filesize is correct
        if ($size > 0 && $size != $attachment['filesize']) {
            // Update database record
            $sql = 'UPDATE ' . TITANIA_ATTACHMENTS_TABLE . '
				SET filesize = ' . (int) $size . '
				WHERE attachment_id = ' . (int) $attachment['attachment_id'];
            $this->db->sql_query($sql);
        }
        // Now the tricky part... let's dance
        header('Pragma: public');
        // Send out the Headers. Do not set Content-Disposition to inline please, it is a security measure for users using the Internet Explorer.
        header('Content-Type: ' . $attachment['mimetype']);
        if (phpbb_is_greater_ie_version($this->user->browser, 7)) {
            header('X-Content-Type-Options: nosniff');
        }
        if ($category == ATTACHMENT_CATEGORY_FLASH && request_var('view', 0) === 1) {
            // We use content-disposition: inline for flash files and view=1 to let it correctly play with flash player 10 - any other disposition will fail to play inline
            header('Content-Disposition: inline');
        } else {
            if (empty($this->user->browser) || strpos(strtolower($this->user->browser), 'msie') !== false && !phpbb_is_greater_ie_version($this->user->browser, 7)) {
                header('Content-Disposition: attachment; ' . header_filename(htmlspecialchars_decode($attachment['real_filename'])));
                if (empty($this->user->browser) || strpos(strtolower($this->user->browser), 'msie 6.0') !== false) {
                    header('expires: -1');
                }
            } else {
                header('Content-Disposition: ' . (strpos($attachment['mimetype'], 'image') === 0 ? 'inline' : 'attachment') . '; ' . header_filename(htmlspecialchars_decode($attachment['real_filename'])));
                if (phpbb_is_greater_ie_version($this->user->browser, 7) && strpos($attachment['mimetype'], 'image') !== 0) {
                    header('X-Download-Options: noopen');
                }
            }
        }
        if ($size) {
            header("Content-Length: {$size}");
        }
        // Close the db connection before sending the file etc.
        file_gc(false);
        if (!set_modified_headers($attachment['filetime'], $this->user->browser)) {
            // Try to deliver in chunks
            @set_time_limit(0);
            $fp = @fopen($filename, 'rb');
            if ($fp !== false) {
                // Deliver file partially if requested
                if ($range = phpbb_http_byte_range($size)) {
                    fseek($fp, $range['byte_pos_start']);
                    send_status_line(206, 'Partial Content');
                    header('Content-Range: bytes ' . $range['byte_pos_start'] . '-' . $range['byte_pos_end'] . '/' . $range['bytes_total']);
                    header('Content-Length: ' . $range['bytes_requested']);
                }
                while (!feof($fp)) {
                    echo fread($fp, 8192);
                }
                fclose($fp);
            } else {
                @readfile($filename);
            }
            flush();
        }
        exit;
    }