We Recommend

Wicked Cool PHP: Real-World Scripts That Solve Difficult Problems
Wicked Cool PHP contains a wide variety of scripts to process credit cards, check the validity of email addresses, template HTML, and serve dynamic images and text.

Posted By

luman on 07/03/06

Tagged

file download

Versions (?)

Who likes this?

42 people have marked this snippet as a favorite

alvaroisorna
mate
jano
sendoa
damarev
vaaaska
demods
clapfouine
frankyfish
Phoenix
jbo
bitcrumb
fael
vali29
sbbath
benrasmusen
ganu
celoria
sp1r1t
ds
Steffen82
JimiJay
DFCNT
Morgano
cristianciofu
SpinZ
wbowers
Nils
hellion
adamsimms
zeljkoprsa
ibomb
Arzakon
srpsco
mrjthethird
tonic
panatlantica
blackabee
JustinCrossman
boguzz
aristoworks
vilebender

Download file

Published in: PHP

Plain TextExpand

<?php
 
$filename = $_GET['filename'];
 
// Modify this line to indicate the location of the files you want people to be able to download
// This path must not contain a trailing slash.  ie.  /temp/files/download
$download_path = "ficheros/";
 
// Make sure we can't download files above the current directory location.
if(eregi("\.\.", $filename)) die("I'm sorry, you may not download that file.");
$file = str_replace("..", "", $filename);
 
// Make sure we can't download .ht control files.
if(eregi("\.ht.+", $filename)) die("I'm sorry, you may not download that file.");
 
// Combine the download path and the filename to create the full path to the file.
$file = "$download_path$file";
 
// Test to ensure that the file exists.
if(!file_exists($file)) die("I'm sorry, the file doesn't seem to exist.");
 
// Extract the type of file which will be sent to the browser as a header
$type = filetype($file);
 
// Get a date and timestamp
$today = date("F j, Y, g:i a");
$time = time();
 
// Send file headers
header("Content-type: $type");
header("Content-Disposition: attachment;filename=$filename");
header("Content-Transfer-Encoding: binary");
header('Pragma: no-cache');
header('Expires: 0');
// Send the file contents.
set_time_limit(0);
readfile($file);
 
?>

Report this snippet

Comments

Subscribe to comments

Posted By: koncept on April 22, 2008

Hey there. Just noticed that the script is killed on line 10 if '..' is detected in the filename string. As such, line #11's overhead is redundant — the condition will not be met.

Posted By: NotIan on July 16, 2008

Since ereg is being phased out for PHP6 you should use preg_match, and you should be checking it on a per path chunk basis, ie:

$targetArray = explode('/',$filename); foreach($targetArray as $key => $value){ if(preg_match('/^(..|.ht).*/',$value){ die('File Path Invalid'); } }

What if i have a file in: ficheros/images/picture.htc.jpg or ficheros/filename..doc?

Also if you are not subdirectorying you could just use basename($filename) and be done with it