You are right that is stands. The generated code is fault as I have reported before.
Example in SC7 for a download in my grid_filestorage.php of the generated code:
if (is_file($trab_doc))
{
header("Pragma: public", true);
header("Content-type: application/force-download");
My corrections:
if (is_file($trab_doc))
{
//if not applewebkit so if ie/opera/.. and alike
if (isset($_SERVER['HTTP_USER_AGENT']) && (false == strpos(strtolower($_SERVER['HTTP_USER_AGENT']), 'applewebkit'))){
header("Content-Description: File Transfer");
header("Expires: 0");
header("Pragma: public");
header("Cache-Control: must-revalidate, post-check=0, pre-check=0");
and further on:
else
{
header("Content-Disposition: attachment; filename=\"" . $nm_nome_doc . "\"");
}
readfile($trab_doc);
}
becomes:
else
{
header("Content-Disposition: attachment; filename=\"" . $sProtectedFilename . "\"");
}
header('Content-Transfer-Encoding: binary');
header("Content-Length: ".filesize($trab_doc));
}else{
$finfo=finfo_open(FILEINFO_MIME_TYPE);
if (strtolower(substr($filename,-4))=='.eml'){
echo header("Content-type: message/rfc822");
}else{
echo header("Content-type: ".finfo_file($finfo,$trab_doc));
}
finfo_close($finfo);
$sProtectedFilename = str_replace(array(' ', "'", '!', ',', '-', '+'), array('__SC_SPACE__', '__SC_QUOTES__', '__SC_EXCLAMATION__', '__SC_COMMA__', '__SC_MINUS__', '__SC_PLUS__'), $nm_nome_doc);
$sProtectedFilename = urlencode($sProtectedFilename);
$sProtectedFilename = str_replace(array('__SC_SPACE__', '__SC_QUOTES__', '__SC_EXCLAMATION__', '__SC_COMMA__', '__SC_MINUS__', '__SC_PLUS__'), array(' ', "'", '!', ',', '-', '+'), $sProtectedFilename);
if (isset($_SERVER['HTTP_USER_AGENT']) && false !== strpos(strtolower($_SERVER['HTTP_USER_AGENT']), 'chrome'))
{
header("Content-Disposition: attachment; filename=\"" . $sProtectedFilename . "\"");
}
elseif (isset($_SERVER['HTTP_USER_AGENT']) && false !== strpos(strtolower($_SERVER['HTTP_USER_AGENT']), 'applewebkit'))
{
header("Content-Disposition: attachment; filename=\"" . $nm_nome_doc . "\"");
}
elseif (function_exists('NM_utf8_urldecode') && $nm_nome_doc != NM_utf8_urldecode($nm_nome_doc))
{
header("Content-Disposition: attachment; filename=\"" . $nm_nome_doc . "\" filename*=UTF-8''" . $sProtectedFilename);
}
else
{
header("Content-Disposition: attachment; filename=\"" . $sProtectedFilename . "\"");
}
}
readfile($trab_doc);
}
They did fix some of the bugs I detected but some are still left. The point is that if header(“Content-type: application/force-download”); is used that the browser undestands that this file must be downloaded (as chrome always does). If it is to be opened then you have to send the mime filetype, so this line then is important: $finfo=finfo_open(FILEINFO_MIME_TYPE);
Normally you would expect apache to properly handle the file types, but sadly enough it seriously screws up docx and xslx files and acts asif they are zip files (which they are also).
In scriptcase 7 there is no option to set the the default download behaviour tho so in order to get that working properly you have to seriously hack into the generated code… 
This same bad implementation (in my view) still exists in sc8.
