note 97161 deleted from function.header by danbrown

Note Submitter: admin at jbud dot org ---- <?php /************************************************************ PHP Header Style Download, By Joe Jackson WILL NOT WORK IF SAFEMODE IS ON! !!!!!!!!!!!WARNING!!!!!!!!!!! As is, this script is a HIGH SECURITY RISK! it will allow users to download any file on the server that can be read by the permissions the user running the php application (usually admin or root, and usually means everything.) for increased security you may want to include some directory limitations or user limitations on who can download. For now this script checks for a file's existance, and sends it. It will also save a log file for each download it will save statistics, if it failed to complete, or successfully transfered, and the full filename with path. disclaimer: This was tested on "windows server 2008 w/ apache & php5.3" and not tested on any other configuration as of yet. This is a free to use at your own risk script, please do not send me emails about how someone missused this to hack into the server and steal files, providing security is YOUR RESPONSIBILITY Ive highlighted the main code with: ////////////////////////////////////// /***and included commenting within and outside of the main code.***/ ////////////////////////////////////// /* ************************************************************/ // VERY IMPORTANT!!!! downloads over 60 seconds (or your set time limit in php.ini) // will fail to complete. This sets time limit to infinity. set_time_limit (int $seconds); set_time_limit(0); // // //TODO: Security measures, reccomend creating an array, or storing valid filenames in a database, and just calling them for matches. // // // input to determine file to be transfered: $file = $_GET['download']; // // /* Absolute path examples: Windows: C:/path/to/file.extension NOTE: FORWARD SLASHES!!!! Linux: /path/to/File.extension NOTE: CASE SENSITIVITY!!!! */ // // // name of the file to be transfered: $fname = $_GET['fname']; // // // log file for transfer errors: $logfile = "error.txt"; // // // Block size in bytes: $block_size = 4096; // Change at your own risk, tested, written for, and working at 4KB (4096). // // //Dont change this: $i = 0; // reset current bytes transfered. if (file_exists($file)) // file exists, continue... { $length = filesize($file); // attempt get file size. ////////////////////////////////////// /*** BEGIN SENDING HEADERS ***/ // cache controls header("Cache-Control: private;\n"); header("Pragma: cache;\n"); header("Content-Type: application/unknown;\n"); // set content type to application/unknown, this seems to cover any filetype for transfering. header("Content-Transfer-Encoding: binary;\n"); // set transfer encoding to binary. if ($length > 0) { header("Content-Length: $length;\n"); // do not include length with headers if it is larger than a 32-bit int. } header("Content-Disposition: attachment; filename=$fname;\n"); // Name the file. /*** OPEN FILE FOR READING ***/ $fp = fopen($file, "r"); /*** LOOP TO OPEN AND SENDING FILE BLOCKS ***/ while (!feof($fp)) { $i = $i + $block_size; echo fgets($fp, $block_size); // Begin sending information block by block. } /*** CLOSE THE FILE ***/ fclose($fp); ////////////////////////////////////// if ($length > 0) // do not log failures in files over 4GB PHP returns negative value on filesize() for files over 4GB (32 bit int wall) { if (file_exists($logfile) && (filesize($logfile) < 4194304) && ($i != $length)) // dont allow log to pass about 4 megs. { $fh = fopen($logfile, "r+"); // open file fread($fh, filesize($logfile)); // read file fwrite(date("H:i:s;M/S/Y", time())": $note in transfering: $i bytes of file: $file whos original size is: $length\n", $fh); // write to file. fclose($fh); } elseif ($i != $length) { $fh = fopen($logfile, "w"); // create new file. fwrite(date("H:i:s;M/S/Y", time())": $note in transfering: $i bytes of file: $file whos original size is: $length\n", $fh); // write to file. fclose($fh); } } } else { echo "ERROR 1: Unable to verify file existance!"; } ?>