Allowing users to download files using headers

[mpar612]

I am trying to create an area where a user can come to a page that
queries a database and displays links to files. Here is the code for
the link:

<td><a href="download. php?path=../ftp/$path&name=$nam e\"
target=\"_blank \">$name</a></font></b></td>

>From what I have read the purpose of download.php is to contain the

header information to download the file. This is the only code that I
have in download.php:

<?php
$file = $_GET['file'];
$name = $_GET['name'];
header("Content-Type: application/octet-stream");
header("Content-Disposition: attachment; filename=$name" );
?>

When I click on the original link above a window pops up with the
correct filename asking me if I want to open or save the file, but when
I save it to a disk or try opening it, I do not get the file that is on
the server. It is simply a blank file or I get an error from the
program that is trying to open the file.

What I don't understand is how does download.php know which file to
open? Am I taking the right approach to this?

Any feedback would be great. Thanks!

[ZeldorBlat]

Re: Allowing users to download files using headers


mpar612 wrote:

I am trying to create an area where a user can come to a page that
queries a database and displays links to files. Here is the code for
the link:
>
<td><a href="download. php?path=../ftp/$path&name=$nam e\"
target=\"_blank \">$name</a></font></b></td>

Ok, that's a start.\

>

From what I have read the purpose of download.php is to contain the

header information to download the file.

That's part of what it should do. The other part is to actually send
the contents of the file.

>This is the only code that I
have in download.php:
>
<?php
$file = $_GET['file'];
$name = $_GET['name'];
header("Content-Type: application/octet-stream");
header("Content-Disposition: attachment; filename=$name" );
?>
>
When I click on the original link above a window pops up with the
correct filename asking me if I want to open or save the file, but when
I save it to a disk or try opening it, I do not get the file that is on
the server. It is simply a blank file or I get an error from the
program that is trying to open the file.

Right, because, although you've sent the headers, you haven't sent any
of the content.

>
What I don't understand is how does download.php know which file to
open? Am I taking the right approach to this?

It doesn't! After you send the headers you need to somehow get the
contents of the file and send (echo) it to the browser. Something like
this should work, but you probably need to think a little bit about
security issues (like scrubbing the value of 'file' and 'name' and
making sure people can't get something they shouldn't):

echo file_get_conten ts($path);

[mpar612]

Re: Allowing users to download files using headers

ZeldorBlat, that worked great. Thank you!

I'm relatively new to all of this. For scrubbing the data, I added a
unique id to each row of the db table. This is auto incremented each
time a new row is added. So rather than sending the path and name of
the file through the URL, I am just sending the unique id. Is this
acceptable for security purposes?

Thanks again!

[ZeldorBlat]

Re: Allowing users to download files using headers


mpar612 wrote:

ZeldorBlat, that worked great. Thank you!
>
I'm relatively new to all of this. For scrubbing the data, I added a
unique id to each row of the db table. This is auto incremented each
time a new row is added. So rather than sending the path and name of
the file through the URL, I am just sending the unique id. Is this
acceptable for security purposes?
>
Thanks again!

That's better -- it would only allow people to download the file if it
appears in a row in the database. But it doesn't, however, prevent me
from getting a file that only you should see. If all the files are
supposed to be accessible to everyone then that's fine -- but it
doesn't provide any sort of per-user authorization.