Re: File Download Problems

From:	Marek Kilimajer	Date:	Thu, 16 Sep 2004 13:49:05 +0000
Subject:	Re: File Download Problems
References:	1 2	Groups:	php.general
Request:	Send a blank email to php-general+get-196857@lists.php.net to get a copy of this message

John Holmes wrote:

From: "PHP Junkie" <phpjunkie@mjimm.com>
As my link to the download file, I changed it to <a href=\"imsafm_user_dl.php?F=imsafm/$user/$myrow[filename]\"><img src=b_newtbl.png border=0></a> And changed the code in the download file to <?php header("Content-Description: File Transfer"); header("Content-Type: application/force-download"); header("Content-Disposition: attachment; filename=".basename($F)); @readfile($F); ?>
How are you validating $F and ensuring it's not a path to any file on your server? imsafm_user_dl.php?F=/home/path/to/secret/file.txt

It's a File Manager application, so I guess it's supposed to be accessible only to administrators that have (s)ftp access anyway.