PHP download management

Printable View

February 13th, 2006, 01:39 AM
J_K9

PHP download management

Hi,

I'm currently learning PHP, and I'd like to put it into practice to help me learn. Now, I've got a vague idea of how to make a download script so that if the value of a certain variable is '1', the first download is selected, if it's '2', the second is selected, and so on... But, all the time, the download source's URI is not revealed.

As I was saying, I have a vague idea of how to do it - but I know it wrong. I was thinking of something like this:

PHP Code:

<?php $dl = '0'; switch($dl){ case '1': echo 'data/download1.zip'; case '2': echo 'data/download2.zip'; } ?>

I can already see most of you cringing after that! Ok, so it's pretty obvious this doesn't work. So, could someone please tell me what I can do to make it work?

Thanks in advance,

-jk ;)
February 13th, 2006, 01:55 AM
skiddieleet

I'm guessing you're doing this through php to have a download counter and hide where the file is on the server? If my second guess is correct you can also have your downloads in a folder that is no accessible since what the link I'm going to give you will show you works locally to serve local files to remote users.
http://www.antionline.com/showthread...r=1#post880750
I'm not sure how it's really done, but that would be a simple way to do it. Hope that helped.
February 13th, 2006, 02:17 AM
J_K9

Hi heretic, thanks for replying!

I checked out the thread you linked to - and I've tried to implement what it had, but it isn't working. I get an error in 'line 19' (which just so happens to be '</html>', and there's nothing wrong with that).

Here's the code I'm using:

PHP Code:

<html> <head> <title>Downloads</title> </head> <body> <?php $dl = '0'; switch($dl){ case '1': header('Content-Type: application/zip'); echo file_get_contents('/data/download1.zip'); case '2': header('Content-Type: application/zip'); echo file_get_contents('/data/download2.zip'); ?> </body> </html>

I also tried removing the header lines, but that leaves me with a similar error. Any ideas?

Thanks,

-jk

[edit]

Quote:

I'm guessing you're doing this through php to have a download counter and hide where the file is on the server

Yup, that's right! :)

[edit2]

Wait a minute...I left out a closing brace. I'll see if it works now...
February 13th, 2006, 02:24 AM
J_K9

Ah ok, now I've fixed the code by adding a closign brace to the switch statement. But, I still can't get the download to begin - I'm just taken to the blank page and that's where it stops.

Here's the corrected code:

PHP Code:

<?php $dl = '0'; switch($dl){ case '1': echo file_get_contents('/data/download1.zip'); break; case '2': echo file_get_contents('/data/download2.zip'); break; } ?>

You can see what happens here.

Thanks again,

-jk
February 13th, 2006, 04:04 AM
skiddieleet

Don't put the html stuff in, to do it that way you'll want to only have the echo of file_get_contents(). I think there's another way to load the page then have a download dialog box appear. Probably with js or something. But to do it how I was talking about the echo of file_get_contents has to be your only output.
February 13th, 2006, 06:38 AM
Freakyg

im not sure how well that would work to get zip files anyways, as i get the impression that get_file_contents is more designed for reading plaintext. now while i havent read an rfc on zip, the file is compressed. im not sure how that would affect trying to read the file as if it was plaintext and then trying to force the server to display it as a zip?

now there is gzip/zip/rar support in PHP, although you may need to install some extensions or possibly PECL. If you really want to keep your files hidden, id suggest trying to dynamically zipping the files on each request. that way the user never really knows where they are comming from. Im not sure what kind of performance impacts that would have. wouldnt suggest it for a high volume website but for something that only gets downloaded a few times a day, shouldnt be difficult.
February 13th, 2006, 09:53 AM
J_K9

Ok, I get what I'm trying to do - I'm telling PHP to get the contents of the zip files and try to display it as plaintext, when it obviously isn't! Hehe....oops!

I'm not doing this so much because I want to hide my downloads, but because I think it'd be useful to know for the future. Piping requests to a user without displaying the URI might come in handy someday.

Quote:

If you really want to keep your files hidden, id suggest trying to dynamically zipping the files on each request. that way the user never really knows where they are comming from. Im not sure what kind of performance impacts that would have. wouldnt suggest it for a high volume website but for something that only gets downloaded a few times a day, shouldnt be difficult.

How would I do that?

All I want to do is give the user a download popup - but to give them a URI like http://blah.com/download.php?dl=1, so they don't have a direct link to the content. I've seen it in action before, and they were using PHP for it (on a very large download site), so there should be some way of doing it...

Thanks so far! :)

-jk
February 13th, 2006, 12:48 PM
valhallen

untested

Code:

<?php if(!empty($_GET['file_id']) { // do any additional stuff switch ($_GET['file_id']) { case 0: header("Location: http://fileLocation.com"); break; case 1: header("Location: http://fileLocation.com"); break; case 2: header("Location: http://fileLocation.com"); break; default: echo "No file found with that id"; } exit(); } else { echo "Please specify a file ID"; } ?>
February 13th, 2006, 12:58 PM
J_K9

Thanks valhallen for replying so quickly! Em, I tried setting a value to file_id using ?file_id=n (where n is the download) but it didn't work. How can I set a value to it properly?

Cheers,

-jk
February 13th, 2006, 05:01 PM
skiddieleet

If you were using the same code as valhallen gave, then it may not have worked if the id you were trying was 0. 0 counts as empty. Otherwise I don't see why it didn't work for you. Could we see what you have?
February 13th, 2006, 06:35 PM
J_K9

Sure. Here's the code I used:

PHP Code:

<?php if(!empty($file_id) { switch ($file_id) { case 0: echo "Please specify a file ID"; case 1: header("Location: ./data/download1.zip"); break; case 2: header("Location: ./data/download2.zip"); break; default: echo "No file found with that id"; } exit(); } else { echo "Please specify a file ID"; } ?>

Thanks,

-jk
February 13th, 2006, 09:07 PM
skiddieleet

Do you have register_globals on? I think to do it like that you need register_globals on, unless you didn't include some code where you set $file_id = $_GET['file_id']. Otherwise, make all occurences of $file_id in your code $_GET['file_id'].
February 13th, 2006, 11:09 PM
J_K9

Hmm...aren't there any security issues in using register_globals? I seem to have read quite a lot of comments which advise against using it.

I thought this was going to be easier - hehe! :S

[edit] Changing all occurences of $file_id to $_GET['file_id'] didn't work either...
June 21st, 2006, 06:39 PM
J_K9

Just for completeness... Here's how I did it in the end (I'm not sure where I got this from - kudos to the author):

PHP Code:

<?php // Fix for IE catching or PHP bug issue header("Pragma: public"); header("Expires: 0"); // set expiration time header("Cache-Control: must-revalidate, post-check=0, pre-check=0"); // browser must download file from server instead of cache // Force download dialog header("Content-Type: application/force-download"); header("Content-Type: application/octet-stream"); header("Content-Type: application/download"); // Path to file and filename $path = "data/Filetodownload.zip"; $filename = "Filetodownload.zip"; // Use the Content-Disposition header to supply a // recommended filename and // force the browser to display the save dialog. header("Content-Disposition: attachment; filename=".$filename.";"); header("Content-Transfer-Encoding: binary"); header("Content-Length: ".filesize($path)); readfile($path); ?>

It wouldn't be hard to add cases in there, etc.

However, I have a question (which I am unable to try out for myself at the moment) - if you used this method to download a file, would you be able to work out the actual location of the file by sniffing and inspecting the packets with Wireshark?

Thanks,

-jk
June 22nd, 2006, 04:56 AM
skiddieleet

That's a good question, and I believe the answer is no. I remember trying that once and that header you're returning looks very familiar. The reason I tried it is because I use command line with wget on nix, and I was looking for URLs in a normal browser on windows, then typing them out on my linux box. And I couldn't get a direct path to a file that used something that was very similar, if not the same thing as what you describe.
June 22nd, 2006, 06:07 AM
sec_ware

Hi

Quote:

f you used this method to download a file, would you be able to work out the
actual location of the file by sniffing and inspecting the packets with Wireshark?

The answer, indeed, is no. The reason:

1. The client himself has no access to the unparsed php-script, and thus to $path

2. After parsing the php-script, there is no information left in the generated data
(which is sent to the client) of $path. Basically, you are creating your own
http-"application-packet". You could look at it simply with burpproxy[1].

3. there is no information in lower layers about the path of the file.

However, there might be a way to obtain the information - namely in the file, which
you send, itself. Assume you are sending a word-document with the filepath-variable set ... :)

Cheers

[1] http://freshmeat.net/projects/burpproxy/
June 22nd, 2006, 01:27 PM
J_K9

Thanks to both of you! sec_ware, you have a very good point - there are no fields in the header which display the location of the file, and so any collected packets wouldn't show up anything useful.

Luckily, I modified the script beforehand to make sure this wasn't possible (although I wasn't sure if there was another method through which it could be obtained). The script previously read:

PHP Code:

header("Content-Disposition: attachment; filename=".$path.";");

I then added the constant '$filename', and put that as the filename instead, because before any downloaded files would have the filename 'dir1-dir2-filename' (eg. 'data-Abstract.zip'), which gave away the original path ;)

Thanks :)

-jk