[kumaraj]

Hey guys, I'm not sure if this belongs in the PHP forum, but I've put it here anyway. I want to create a link to download files from my site, just images and stuff. I was doing some googling and found this script on StackOverflow. When I saw it, it seemed so obvious, I implemented it into my code, modified it and it works perfectly.

The only problem is when you hit the download link, it gives away the path to the file, which I'd rather it didn't do, for security reasons, is there anyway I can change this, even if it's just to a random string of numbers?

HTML

<a href="#" onclick="downloadFile();">Download</a>
<!-- A little later on -->
<iframe id="downloadFrame" style="display:none"></iframe>

Javascript:

function downloadFile()
{
var iframe = document.getElementById('downloadFrame');
var path = 'path/to/file';
iframe.src = "download.php?path="+path;
}

PHP (download.php):

<?php 
	header("Content-Type: application/octet-stream");
	header("Content-Disposition: attachment; filename=".$_GET['path']);
	readfile($_GET['path']);
?>

Just to remind you, when you hit download, the name of the file downloaded is the path to the file (with all "/" replaced with "_") can I sort this?

Thanks in advance for your help!

[CTphpnwb]

What you want is a force download. There are many examples on the web, but you could modify what you have by sending an id which PHP could use to look up the correct path. Using an id and session variable(s) you could ensure that only authorized users can download the file.

[kumaraj]

All the authentication is done, users have to be logged in in order to have access to the download link. What I'm trying to do is mask the filename with a random string of numbers so that the path to the file is not given away.

[codeprada]

That script's pretty dangerous. I could download practically any file on the server with that. One option is to associate a random string of numbers and letters with a file in a database. You could also do so in a XML file but that's a lot slower and not practical for larger sites. So therefore you've have something like

function downloadFile()
{
    var iframe = document.getElementById('downloadFrame');
    var id = "9999dddddddddd999999999";
    iframe.src = "download.php?id=" + id;
}

<?php
    //Make database call to get the file that $_GET['id'] refers to here
    // DB CALL - store path in $path and name of file in $name
    	header("Content-Type: application/octet-stream");
	header("Content-Disposition: attachment; filename=".$name);
	readfile($path);
?>

This post has been edited by codeprada: 10 August 2012 - 04:14 AM
Reason for edit:: code edits