I've got a setup where a site generates internal analytics about site usage. Users are able to request a download of their personal analytics, and because this information is sensitive I do not create any files, I generate a CSV file in a variable and then "push" it to the user with this:
function _cex_download( $output, $filename )
{
header("Pragma: public");
header("Expires: 0");
header("Cache-Control: private");
header("Content-type: application/octet-stream");
header("Content-Disposition: attachment; filename=$filename");
header("Accept-Ranges: bytes");
echo $output;
exit;
}
This causes the user's browser to pop a "save file" dialog, and the user gets the file created on their end. This works fine, except the site's administrators are able to trigger 'destructive exports' - and in that situation I have a secondary confirmation form the admin needs to accept before the destructive export executes.
The problem is that this "push download" routine ends the Drupal page processing. There does not appear any way to redirect the admin to some page after that push download routine is called. Admins get a 'save file' dialog popped by their browser, but they remain on the confirmation form.
I tried going the multi-step form route, but after a day of dinking around with strange redirects, I backed out of that confusion. Started looking at ChaosTool's multi-step form logic too. But something tells me that the issue really is that this "push downloading" is a guided-process-killer.
Perhaps a jquery confirmation dialog that intercepts the initial 'Export' button click, do the confirmation entirely in javascript, forget out having a php/FAPI confirmation form, and when the user confirms in jquery I programmatically submit the Export I intercepted?