Code:
<?php
// get the file url from querystring
$filename = $_GET['file'];
$sitename = $_SERVER['SERVER_NAME'];
// if the file url is on site it's not allowed to be downloaded - only on another site.
if (mb_eregi($sitename, $filename)) {
die( "The requested file cannot be retrieved for security reasons.");
}
if (!(mb_eregi('http:', $filename))) {
die( "The requested file cannot be retrieved for security reasons.");
}
// required for IE, otherwise Content-disposition is ignored
if(ini_get('zlib.output_compression')) { ini_set('zlib.output_compression', 'Off'); }
// build file headers
header("Pragma: public");
header("Expires: 0");
header("Cache-Control: must-revalidate, post-check=0, pre-check=0");
header("Cache-Control: private",false);
// header for the content type
$ext = strToLower(substr($filename,strlen($filename)-3, 3));
if ($ext == "mp3" ) { header("Content-Type: audio/x-mp3"); }
else if ($ext == "jpg") { header("Content-Type: image/jpeg"); }
else if ($ext == "gif") { header("Content-Type: image/gif"); }
else if ($ext == "png") { header("Content-Type: image/png"); }
else if ($ext == "swf") { header("Content-Type: application/x-shockwave-flash"); }
else if ($ext == "flv") { header("Content-Type: video/flv"); }
// and some more headers
header("Content-Disposition: attachment; filename=\"".basename($filename)."\";" );
header("Content-Transfer-Encoding: binary");
header("Content-Length: ".filesize($filename));
// refer to file and exit
readfile("$filename");
exit();
?>
2. if you want to force download, the file needs to be hosted locally. If it is locally, you need to make sure users can only download files from a specific directory and of a specific file extension.
Code:
$num = $_GET['show'];
$filename = '/path/to/your/mp3/files/yourshow'.$num.'.mp3';
if(strlen($num) != 3 || !is_int(substr($num,0,1)) || !is_int(substr($num,1,1)) || !is_int(substr($num,2,1)) || !file_exists($filename)) {
echo 'Invalid file';
exit;
}
// at this point you can proceed with the rest of your header() stuff and then doing readfile()
This is making sure they are only sending 3 characters. Then that all are integer values, and finally that the file exists. You want it all in this order so that each part has to be validated and as soon as one fails, the script says invalid file and bails
Bookmarks