I recently upgraded Drupal from version 7.12 to 7.23. After the upgrade, I noticed that when downloading private files, I no longer get the correct filename when I select "Save As" in the browser.

These are the steps I follow:

  • I upload a file ("testfile.pdf") in a file field for a node
  • I view the node, right click the file and choose "Save As"
  • The filename in the download dialog (which should have been "testfile.pdf") now depends on the browser

    • Chrome: download.pdf
    • FF: [random string].pdf
    • IE: [domain name].pdf

I am using private files to be able to restrict access to files. In the release notes for Drupal 7.22, I read that a "Content-Disposition" header was removed from private file downloads.

Could this be the reason that private files no longer retain the filename when downloading?

  • I only see this behaviour with Clean URL's disabled. Molot's answer below solves the problem. Consider accepting it? Apr 6, 2015 at 8:59

2 Answers 2


If server does not provide content-disposition, especially filename part of it, browser is free to choose suggested name. FF defaults to what appears to some kind of UUID, IE to domain, Chrome bases it's guess on the script being called, as far as I can tell. On the other hand adding content disposition can prevent inline viewing of PDF files, and confuse browsers in a few more ways.

You can use hook_file_download to conditionally add header with a file name where it needs to be added:

If the user has permission, return an array with the appropriate headers.

  • I guess creating my own module to make use of the hook is the way to go then, since there doesn't seem to be any other modules or core functionality of use? Do you know if Drupal 7.22 caused the change? Sep 10, 2013 at 14:37
  • @JonathanPersson it seems it did. And since up to 7.21 this functionality was in core, it's too short to expect good contrib modules published.
    – Mołot
    Sep 10, 2013 at 14:39

This is how you can use hook_file_download to put the Content-Disposition header back in:

function mymodule_file_download($uri) {
  return array(
    'Content-Disposition' => 'inline; filename="' . drupal_basename($uri) . '"',

If any implementation of hook_file_download returns -1, access is denied anyway, so the above does not change the current access permissions for the file.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.