Private Files

k8e1050's picture

Hello everyone.
I'll just post this here and if its not the place I guess you'll let me know, and i'll wander back into the labyrinth that is Drupal proper. I'm loath to disturb the core gods so thought I might ask here.
My issue is as it has always been with Drupal since I started dragging sites through 4.7 to 5 to 6 to 7. I am a huge fan of Drupal of course, but one thing remains consistent throughout. Private Files. In the community sites I do , private files are essential, access control is essential. I'd think thats true of all sites really which are more than just giant advertisements. I'm building a site now because the community simply cant afford an actual 'real' developer , and i'm just a photographer with a dangerous love of drupal and friends in this community.
Here in Drupal 7 , the curse of "Array to string conversion in drupal_send_headers" hangs about for anything put into private storage , but now ( now finally getting the point of this post ) along with those php notices comes a real problem.
Google Chrome - the most used browser , has problems with private pdf files. I've reported this to google and that has no doubt disappeared into googles own labyrinth, but I cant help feel that those header notices are connected.
Chrome will show in browser the pdf if the pdf is in public storage fine. It displays the pdf language ( ewww) not the pdf if the pdf is in private storage. Safari and Edge download the file as expected. This happens in OSX and Windows 10 . Android and iOS are fine with everything. Interestingly enough on the local site in MAMP , everything is fine.

My own thought are that the header issue begins in the File module, or the file_entity module but I don't know. I'm certainly reading up and learning , but that doesn't help my present site. So. I'm asking here for some direction or some ideas.
Sorry about my rambling - a bad habit I'm told.


G'day Kate. You are

seaarg's picture

G'day Kate. You are mentioning 2 things that may be related:
- The warning about headers
- The fact that chrome shows the -binary? instead of downloading the pdf.

When files are private stored, the file is given to the browser via php and not directly from the webserver. This means php must send the correct header for the browser to interpret this as a file to be downloaded (or asked what to do with it)

This means your sent headers should be (at min):

Content-Type: application/pdf
Content-Disposition: attachment; filename="downloaded.pdf"

Therefore, I suspect the "Array to string conversion" warning you mention has something to do with it.

I never encounter this issue myself so I cannot point you to a direct solution, but I hope I gave you some info that helps you to look into issue queues or google.

I would suggest check the issue queues of the module you use to upload the file and in core issue queues for patches / fixes.


Thanks seaarg for replying.

k8e1050's picture

Thanks seaarg for replying. Really appreciate it.
I've been all over the core issues queue and all google responses to such header warnings. All header warnings I have found point to various modules but recently mostly to image module, and I have patched the image module with a patch found in core which has existed all through drupal 7 releases. But I don't use yet images so wasn't expecting it to make much difference and it didn't.
Ive kept things simple so far. I have added a field attachment using file to a book page and thats it. I've kept the allowed files to txt pdf . If any module is causing this its core i think.

I'm leaning toward the core file module myself but cant find any issues in core like mine. Specifically " Notice: Array to string conversion in drupal_send_headers() (line 1475 of /includes/" strangely that line is a blank line?

Just a question about a point in your reply .

"When files are private stored, the file is given to the browser via php and not directly from the webserver."
my understanding is that drupal comes up with a 'virtual path' from the file root , in my case 'files' to serve the file. Is that correct? if so , how does it arrive at this virtual path ?

Thanks again

The private file transfer is

seaarg's picture

The private file transfer is done in "file_transfer()" function at line 1955 of includes/

Around this function you will see other functions used in this process as well, like file_download() and file_download_headers()

In the function drupal_send_headers() sends the headers we are talking about, but those are set before in other parts of the code.

The warning you are getting is definitively some kind of bug or corrupted install (just guessing) and solving it may or may not solve the chrome + pdf problem as well. There is definitively some unexpected array over there, hence the warning when it tries to concatenate the header string.

Since you are using the core file module, a good place to start debugging this is trace from file_file_download() function at file.module

I cannot tell you an exact breakpoint or variables to check, but here's a question: have you tried replicate the issue in a clean drupal install? I cannot infer that from your original post.

This is a long shot, but try to open the console (F12) and check network tab. Once you click the download link, get the response headers for the pdf request and paste it here, maybe there's something we can use in there.

Btw: "(line 1475 of /includes/" strangely that line is a blank line?" In a Drupal 7 I have over here, that line have this: header($header_names[$name_lower] . ': ' . $value);

WOW. So much new information

k8e1050's picture

WOW. So much new information for me to look into . Thanks. I need to take some time to absorb all that and read up.
Also, i'll set up a clean install on MAMP , and one on the server I'm using. I should have thought of doing that.

I'll get back here soon as I have played around for a bit. might be a day or two. Thanks so much seaarg :) . Woohoo .

"This is a long shot, but try

k8e1050's picture

"This is a long shot, but try to open the console (F12) and check network tab. Once you click the download link, get the response headers for the pdf request and paste it here, maybe there's something we can use in there."

can you explain what you mean here please

Sure, in Chrome if you press

seaarg's picture

Sure, in Chrome if you press the F12 key (or menu > more tools > developer tools) you'll have the chrome debug console. In it there is a "Network" tab that shows all network connections when you hit a page.

When you click the download pdf link, a new entry will appear on that list: If you click it, you'll have the request and response headers (along with other information). Look for "Response Headers" somewhere there and you will see things like this:

Date:Sun, 04 Dec 2016 23:32:01 GMT
Last-Modified:Tue, 19 Aug 2014 14:25:52 GMT

I believe the "Accept-Ranges: bytes" header is very important for Chrome + PDF

Make sure you have at least accept-ranges, content-length and content-type: application/pdf in your server response.

I am a developer myself, but I hope this will help you at least to have something to start with. I'll help you as much as I can from here :)

Cheers from Argentina!

k Things are different on a

k8e1050's picture

Things are different on a mac, the console works different, so I swapped over to windows, and found the info as you suggested. Hummm. Might stay with windows now/soonish

Response Headers
date:Mon, 05 Dec 2016 03:44:35 GMT
expires:Sun, 19 Nov 1978 05:00:00 GMT
last-modified:Fri, 02 Dec 2016 13:29:51 GMT

no content-type:application/pdf ?

Ah Ha!the warning you are

seaarg's picture

Ah Ha!

the warning you are getting is array to string conversion.

Also, see how it says:

cache-control: array
content-type: array

That is the reason why is failing. content-type should be application/pdf but for some reason you have, in code probably, an array where you suppose to have a string variable.

It's debug time :)

btw: I use linux, not windows but I guess the commands for chrome console are the same

Okay :) , so I suspect there

k8e1050's picture

Okay :) , so I suspect there are lots of readers liking this thread for learning purposes , but it may be not what this group likes to see posted here. It may be that this group is for posting australian events . I don't know . So, in case this is breaking/stretching the rules , myself and seaarg will take the issue he is helping me with to private email. Thanks for letting me find someone to help me though :) . Drupal users are the best :)


Group categories


Group events

Add to calendar

Group notifications

This group offers an RSS feed. Or subscribe to these personalized, sitewide feeds: