note 46525 deleted from function.header by danbrown
| From: | danbrown@php.net | Date: | Sun, 07 Dec 2008 18:31:59 +0000 |
| Subject: | note 46525 deleted from function.header by danbrown | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-147832@lists.php.net to get a copy of this message | ||
Note Submitter: Jonas Forsman <jfo123 (- at -) hotmail dot com>
----
I realized that a download script easily could be made to download the whole server in clear code.
That is, all your jewels revealed. To avoid this, use a directory where only your downloadable files
resides and second, strip the URL from everything that can be used as evil code.
Evil code coould look like this:
download.php?dl=../../index.php or
download.php?dl=../../password.txt
The below example protects you fairly well from these types of attacks.
$dir = $_SERVER['DOCUMENT_ROOT'].'/download/';
$file = $dir.basename($_REQUEST['dl']);
if (isset($_REQUEST['dl']) && file_exists($file) ) {
header('Content-type: application/force-download');
header('Content-Transfer-Encoding: Binary');
header('Content-length: '.filesize($file));
header('Content-disposition: attachment;
filename='.basename($file));
readfile($file);
} else {
echo 'No file with this name for download.';
}