TalkPHP - View Single Post

Wildhoney · 12-03-2007, 08:21 PM

I'm sure there will be a way, but I'm not so sure what that would be. Most people simply cloak the URL to the file and then use PHP to load it in using the header function. I've put you together a script that shows you how to achieve that.

Fundamentally, what it does is checks the file they're after, strips the forward slashes to prevent against relative directory trawling, checks to see it if exists, if it does then it will prompt the user to download the file.

I have even added a little mod-rewrite which allows the URL to look like so: /file/my_file.zip.

php Code:

define('FOLDER_DOWNLOAD', './downloads/');

if(isset($_GET['download']))
{
    $szFile = str_replace('/', '', urldecode($_GET['download']));

    if(file_exists(FOLDER_DOWNLOAD . $szFile))
    {
        header('Content-type: application/zip');
        header('Content-Disposition: attachment; filename="' . $szFile . '"');
        readfile(FOLDER_DOWNLOAD . $szFile);
    }
}