3 Replies - 617 Views - Last Post: 10 August 2012 - 04:13 AM Rate Topic: -----

#1 kumaraj  Icon User is offline

  • D.I.C Head
  • member icon

Reputation: 3
  • View blog
  • Posts: 80
  • Joined: 12-February 09

Changing Filename in Download Link

Posted 09 August 2012 - 03:16 PM

Hey guys, I'm not sure if this belongs in the PHP forum, but I've put it here anyway. I want to create a link to download files from my site, just images and stuff. I was doing some googling and found this script on StackOverflow. When I saw it, it seemed so obvious, I implemented it into my code, modified it and it works perfectly.

The only problem is when you hit the download link, it gives away the path to the file, which I'd rather it didn't do, for security reasons, is there anyway I can change this, even if it's just to a random string of numbers?

HTML
<a href="#" onclick="downloadFile();">Download</a>
<!-- A little later on -->
<iframe id="downloadFrame" style="display:none"></iframe>



Javascript:
function downloadFile()
{
var iframe = document.getElementById('downloadFrame');
var path = 'path/to/file';
iframe.src = "download.php?path="+path;
}



PHP (download.php):
<?php 
	header("Content-Type: application/octet-stream");
	header("Content-Disposition: attachment; filename=".$_GET['path']);
	readfile($_GET['path']);
?>



Just to remind you, when you hit download, the name of the file downloaded is the path to the file (with all "/" replaced with "_") can I sort this?

Thanks in advance for your help!

Is This A Good Question/Topic? 0
  • +

Replies To: Changing Filename in Download Link

#2 CTphpnwb  Icon User is offline

  • D.I.C Lover
  • member icon

Reputation: 3100
  • View blog
  • Posts: 10,889
  • Joined: 08-August 08

Re: Changing Filename in Download Link

Posted 09 August 2012 - 05:00 PM

What you want is a force download. There are many examples on the web, but you could modify what you have by sending an id which PHP could use to look up the correct path. Using an id and session variable(s) you could ensure that only authorized users can download the file.
Was This Post Helpful? 1
  • +
  • -

#3 kumaraj  Icon User is offline

  • D.I.C Head
  • member icon

Reputation: 3
  • View blog
  • Posts: 80
  • Joined: 12-February 09

Re: Changing Filename in Download Link

Posted 10 August 2012 - 12:31 AM

All the authentication is done, users have to be logged in in order to have access to the download link. What I'm trying to do is mask the filename with a random string of numbers so that the path to the file is not given away.
Was This Post Helpful? 0
  • +
  • -

#4 codeprada  Icon User is offline

  • Changed Man With Different Priorities
  • member icon

Reputation: 948
  • View blog
  • Posts: 2,357
  • Joined: 15-February 11

Re: Changing Filename in Download Link

Posted 10 August 2012 - 04:13 AM

That script's pretty dangerous. I could download practically any file on the server with that. One option is to associate a random string of numbers and letters with a file in a database. You could also do so in a XML file but that's a lot slower and not practical for larger sites. So therefore you've have something like
function downloadFile()
{
    var iframe = document.getElementById('downloadFrame');
    var id = "9999dddddddddd999999999";
    iframe.src = "download.php?id=" + id;
}


<?php
    //Make database call to get the file that $_GET['id'] refers to here
    // DB CALL - store path in $path and name of file in $name
    	header("Content-Type: application/octet-stream");
	header("Content-Disposition: attachment; filename=".$name);
	readfile($path);
?>


This post has been edited by codeprada: 10 August 2012 - 04:14 AM
Reason for edit:: code edits

Was This Post Helpful? 2
  • +
  • -

Page 1 of 1