RE: [PHP] How Do You Protect Individual Files

Justin French wrote On Thursday, August 22, 2002 10:32 AM > Let us know how you go, and feel free to ask specific problems as you dig > through the Zend article, which is pretty much all you need. Good News! It's working Bad News. It's not working right. I pretty much followed the Zend article. 1. My main web site is at /home/sites/home/users/demo/web 2. I have a document site at /home/sites/home/users/demodocs/web 3. I created a directory of files called "/docs/ProjDocs/", and put it outside the web root of my document site at ../demodocs/docs/ProjDocs/. 4. I created a file called "getdir.php" which reads "docs/ProjDocs/", lists the files therein, creates a link to each file, and then redirects to the file "getdocfiles.php" after clicking a link. 5. I created a file called "getdocfiles.php" which opens and downloads the linked file. "getdocfiles.php defines the mime types of all the files I wish to download. 6. I created the headers exactly per the Zend article. 7. I uploaded both "getdir.php" and "getdocfile.php" to ../demo/web 8. Calling "getdir.php" displays my file list correctly. 9. Clicking on a link gives the following error messages and downloads the file to the browser in binary (or something ??) Can you help me to understand these error messages. I have experimented with omitting the headers. The results is that I don't get the error messages and continue to receive the file in binary. (NOTE: I get warnings for lines 70, 71, 73, and 74 when trying to open gif or pdf files I get warnings for lines 65, 73, and 74 when trying to open other files.) Warning: Cannot add header information - headers already sent by (output started at /home/sites/home/users/demo/web/getdocfile.php:14) in /home/sites/home/users/demo/web/getdocfile.php on line 65 Warning: Cannot add header information - headers already sent by (output started at /home/sites/home/users/demo/web/getdocfile.php:14) in /home/sites/home/users/demo/web/getdocfile.php on line 70 Warning: Cannot add header information - headers already sent by (output started at /home/sites/home/users/demo/web/getdocfile.php:14) in /home/sites/home/users/demo/web/getdocfile.php on line 71 Warning: Cannot add header information - headers already sent by (output started at /home/sites/home/users/demo/web/getdocfile.php:14) in /home/sites/home/users/demo/web/getdocfile.php on line 73 Warning: Cannot add header information - headers already sent by (output started at /home/sites/home/users/demo/web/getdocfile.php:14) in /home/sites/home/users/demo/web/getdocfile.php on line 74 Here is the code for getdocfiles.php: <?php define('FILEDIR', '/home/sites/home/users/demodocs/docs/ProjDocs/'); $path = FILEDIR . $file; //check that this file exists and that it doesn't include //any special characters if(!is_file($path) OR !eregi('^[A-Z_0-9][A-Z_0-9.]*$', $file)) { header("Location: error.php"); exit(); } $mimetype = array( 'doc'=>'application/msword', 'htm'=>'text/html', 'html'=>'text/html', 'jpg'=>'image/jpeg', 'pdf'=>'application/pdf', 'txt'=>'text/plain', 'xls'=>'application/vnd.ms-excel', 'ppt'=>'application/vnd.ms-powerpoint', 'mdb'=>'application/msaccess', 'mpp'=>'application/vnd.ms-project', 'dwf'=>'drawing/x-dwf', 'dxf'=>'image/vnd.dxf', 'dwg'=>'image/vnd.dwg' ); $p = explode('.', $file); $pc = count($p); //send headers if(($pc > 1) AND isset($mimetype[$p[$pc - 1]])) { //display file inside browser header("Content-type: " . $mimetype[$p[$pc - 1]] . "\n"); //LINE 65 } else { //force download dialog header("Content-type: application/octet-stream\n"); //LINE 70 header("Content-disposition: attachment; filename=\"$file\"\n"); //LINE 71 } header("Content-transfer-encoding: binary\n"); //LINE 73 header("Content-length: " . filesize($path) . "\n"); //LINE 74 //send file contents $fp=fopen($path, "r"); fpassthru($fp); ?> Thanks much, Roger