Force File Download

Anon

Have you encountered the following problem:

Using IE5.5 through an ISP dial-up connection, when I specify "Content-Length: $size" where $size is the file length, the transfer begins correctly but is terminated straight away, and I get a zero-length file. It works fine with Netscape 6, or with a direct LAN connection.

By removing the "Content-Length" all is OK with IE (except no progress bar).

I am running PHP4.0.6 on Linux / Apache.

Anon

Can anyone give me a hand. Below is the code I am trying to use, including Wim's IE fix, but IE still will not connect to the server.

Lloyd

<?php

$file = explode('/', $HTTP_SERVER_VARS['QUERY_STRING']);
$file_name = array_pop($file);
if( count($file) )
$file_path = implode('/', $file) .'/';

if( $file_size = filesize("$file_path$file_name") )
{
// Hack for IE-bug [Wim Vandersmissen]
if (strstr($HTTP_USER_AGENT, 'MSIE'))
$attachment = '';
else
$attachment = ' attachment;';

//header("Content-Type: application/octet-stream");
header("Content-Type: application/ms-x-download");
header("Content-Length: $file_size");
header("Content-Disposition: filename=$file_name");
header("Content-Transfer-Encoding: binary");


//$file_handle = fopen("$file_path$file_name", "r");
//fpassthru($file_handle);
@readfile("$file_path$file_name");
exit;

}

<head>

File not found.

</head>

<body>

File not found
 
Click <a href='#' onclick="alert(document.location.href); return false;">here</a> to go back.

</body>

Anon

I've perhaps the same problem.
The download began correctly but it stops at the middle of the download (both with IE and Netscape)

What can I do ?

Anon

Helo everyone!
what i can say is:
my problems were fixed as i insalled ie 5.5 SP2!!!
its like that: ie5.5 doesnt read the Content-Dispositio Header correctly, an without the correct information, there wont run something correctly. it is that simple 🙂

in any case, i`ve installed ie 5.5 SP2 and ANYTHING was good 🙂

And for all of you have problems with ie: have a look at microsoft.com!

good luck!!

Anon

At my end d/l works fine
i call it with a download?file=... link and so the downloaded file looks like download instead of what is should...
how can I set this

drakk0

i am also having a problem with the filedownload. i can get it to download the file, but it also puts the code from the rest of the page in the txt file. here is the code i am using:

<?php
header ("Content-type: application/force-download");
header ("Content-Disposition: $attachment; filename=Signuplist.txt");
$size = filesize("test.txt");
$fileData = fopen ("test.txt", "r");
fpassthru ($fileData);
?>

drakk0

i am also having a problem with the filedownload. i can get it to download the file, but it also puts the code from the rest of the page in the txt file. here is the code i am using:

Anon

you don`t have to put a "$" in front of the "attachment":

<?php
header ("Content-type: application/force-download");
header ("Content-Disposition: attachment; filename=Signuplist.txt");
$size = filesize("test.txt");
$fileData = fopen ("test.txt", "r");
fpassthru ($fileData);
?>

and for any other problems with downloading and ie5.5: use SP2, that solves the problems!!

drakk0

ive tried it both ways and i get the same results

wimvds

Just have a good look at this post in the same thread :

http://www.phpbuilder.com/forum/read.php3?num=2&id=143721&thread=104514

Maybe you 'd better just copy/paste it and then notice that there's no ; after the $attachment. It's all due to the stupid bug in IE, with Netscape there's no problem whatsoever.

drakk0

i think the biggest problem is that i have this code before any of the html code:

<?php
header ("Content-type: application/force-download");
header ("Content-Disposition: $attachment filename=Signuplist.txt");
?>

then later in there is an if statement used to verify a password. the file i want to automatically download is created by the code:

if ($vinepass==$passwd AND $passwd !=""){

$conn = mysql_connect("localhost", "username", "password");
$dbtxt = "database";
$querytxt = "SELECT * FROM testingsignups WHERE Band=\"$Band\"
AND showyear='$showyear' AND showmonth='$showmonth' AND showday='$showday'";
$rs = mysql_db_query($dbtxt,$querytxt,$conn);

$fp = fopen("$Band-$showyear-$showday-$showmonth.txt", "a");

while($myrow = mysql_fetch_array($rs))
{
$Name = $myrow["Name"];
$Street = $myrow["Street"];
$City = $myrow["City"];
$State = $myrow["State"];
$Zip = $myrow["Zip"];
$Email = $myrow["Email"];
$column = "$Name--$Street--$City--$State--$Zip--$Email\n";
$writefile = fputs($fp, $column);
}

fclose($fp);

and i only want the file to be downloaded if the if statement conditions are met. so after the above code i entered this code to download the file:

$size = filesize("$Band-$showyear-$showday-$showmonth.txt");
$fileData = fopen ("$Band-$showyear-$showday-$showmonth.txt", "r");
$str .= chop(fgets($fileData,$size))."\n ";
fpassthru ($fileData);

when the file is downloaded i don't get the contents of the file downloaded, i get the code of the next php script that is run.

any ideas on how to correct this problem??

drakk0

i got my document to get created properly, but how do i get it to popup a download prompt to download the file. i am using IE6. here is the code i am using:

if ($vinepass==$passwd AND $passwd !=""){

$fp = fopen("$Band-$showyear-$showday-$showmonth.txt", "a");

$FILE = fopen("$Band-$showyear-$showday-$showmonth.txt","r");
$NEWFILE = fopen("Signuplist.txt","w");
while ($BUFFER = fgets($FILE,4096)) {
$writefile = fputs($NEWFILE,$BUFFER);
}
fclose($FILE);
fclose($NEWFILE);

any help will be greatly appreciated.

Anon

I've just been playing around with downloading files and have developed this for downloading different files types. In this example it separates pdfs and others. It kind of works but when downloading pdf's if you just try and open them directly of the server they aren't recignised, also when saving the pdf's it doesn't automatically use the file name or extention. But uses the file name of the page it is called from.

ANy ideas anyone?

<?php
if (($REQUEST_METHOD != "GET") or empty($file))
{
Header("Location: /");
exit;
}

// Hack for IE-bug
if (strstr($HTTP_USER_AGENT, "MSIE"))
{
$attachment = "";
}
else
{
$attachment = " attachment;";
}

//check for file extention
$filename="$file";

$filetype = substr($filename,strrpos($filename,".")+1);

//if its got a pdf extention
if ($filetype == 'pdf')
{
$filename = "$label/$file";
$size = filesize($filename);

Header("Content-Type: application/x-ms-download");
Header("Content-Length: $size");
Header("Content-Disposition:$attachment; filename=$filename");

@readfile($filename);
exit;
}

else
//other wise do this, could be more checks but I knew the files would only ever be pdf or txt
{
$f = fopen("$label/$file", "r");
$size = filesize("$label/$file");

header("Content-Type: application/x-ms-download");
header("Content-Length: $size");
header("Content-Disposition:$attachment filename=$file");
header("Content-Transfer-Encoding: binary");

fpassthru($f);
exit;
}

Anon

an up date after reading the latest from drakko which I discovered whiule posting the last.

change the line

Header("Content-Disposition:$attachment; filename=$filename");

Header("Content-Disposition:$attachment filename=.$file");

partly solves the file name issue but still not recognised straight from server.

Anon

Just to finish it all I got the pdf to open simply by placing the file var between " " in the pdf script so the full working version is now.

<?php
if (($REQUEST_METHOD != "GET") or empty($file))
{
Header("Location: /");
exit;
}

// Hack for IE-bug
if (strstr($HTTP_USER_AGENT, "MSIE"))
{
$attachment = "";
}
else
{
$attachment = " attachment;";
}

//check for file extention
$filename="$file";

$filetype = substr($filename,strrpos($filename,".")+1);

//if its got a pdf extention
if ($filetype == 'pdf')
{
//get the file from the directory its in $label
$filename = "$label/$file";
$size = filesize($filename);

Header("Content-Type: application/x-ms-download");
Header("Content-Length: $size");
Header("Content-Disposition:$attachment filename=\".$file\"");

@readfile($filename);

}

else
//other wise do this, could be more checks but I knew the files would only ever be pdf or txt
{
$f = fopen("$label/$file", "r");
$size = filesize("$label/$file");

header("Content-Type: application/x-ms-download");
header("Content-Length: $size");
header("Content-Disposition:$attachment filename=$file");
header("Content-Transfer-Encoding: binary");

fpassthru($f);
exit;
}

Hope this can help someone at sometime.

Anon

Everything works well now, ie downloads everything, except for .mov files who seem to be overridden by the plugin, the thing is tho, the move doesn't work either...

when saving the .mov file, the movie is saved well.

Somebody knows how to override these types of plugins?

source I'm currently using:

if (strstr($HTTP_USER_AGENT, "MSIE")){
$mime="application/x-ms-download";
$attachment = "";
}
else {
$mime = $download["filetype"];
$attachment = "attachment";
}

header('Cache-Control: no-cache, must-revalidate');

header('Pragma: no-cache');

header("Content-type: $mime");
header("Content-length: ".(string)(filesize($download["filepath"])));
header("Content-Disposition: $attachment; filename=\"".basename($download["filepath"]));
header("Content-Transfer-Encoding: binary");

$downloadfile = fopen($download["filepath"],"rb");
fpassthru($downloadfile);
fclose($downloadfile);

fflush();

thanx,
Koen Antonissen

wimvds

After seeing David Wheeler's presentation on FOSDEM in Brussels I decided to check the security of scripts & scriptlets I published in the past and the download script as published here is very insecure. I only wanted it to be used as an example of how you could make forced file downloads work (at least for the majority of files/browsers). But since I see most people just copied the code and used it as is, I thought a word of warning would be in order.

As it is, you can download any file on the webserver that can be accessed by the web-user. I won't tell you how (just to prevent stupid crackers and script-kiddies abusing the information), but just believe me that it's possible - and it's trivial.

The very insecure part is the following :

$fh = fopen("/www/docs/$name", "r");

Especially since $name is a parameter that is passed to the script, so anything the user enters could end up in the fopen-call.

What can you do to make the script secure?

First of all you can check the $HTTP_REFERER, and see if it's a valid one (ie. from your own domain), if not it's someone with bad intentions.

If you really want to pass the filename to the script you could also check if the filename itself is in a valid path. Have a look at the dirname-function, this could be of help.

The best way IMHO would be to pass an identifier (a number, string or whatever that is used to lookup the filename in an array or database) that determines which file the user wants to download.

BTW I urge everyone to have a look at David Wheeler's site : http://www.dwheeler.com/secure-programs/

Best regards,

Wim Vandersmissen

Anon

Hi,

Everything works, but NS6.2 does not give any download dialog. It just closes the window with such headers!
Does anyone know what to do?

CALLING DOWNLOAD WINDOW:

echo("<a href=\"javascript:window.open('$PHP_SELF?zone=$zone&req=$num','download','toolbar=no,location=no,directories=no,status=no,menubar=no,scrollbars=0,resizable=no,width=1,height=1');void(0);\"
OnMouseOver=\"window.status='Download'; return true;\" OnMouseOut=\"window.status='';return true;\">");echo ($CurrentRec["name"]);echo "</a>";

DOWNLOADING ($data is the file content):
// Hack for IE-bug
if (strstr($HTTP_USER_AGENT, "MSIE"))
{
$attachment = "";
}
else
{
$attachment = "attachment;";
};
header("Content-type: application/force-download ");

//header("Content-type: $type");
header("Content-Length: $size");
header("Content-Disposition: $attachment; filename=$filename");
header("Content-Transfer-Encoding: binary");
echo $data;
exit;

Anon

Hi,

Everything works, but NS6.2 does not give any download dialog. It just closes the window with such headers!
Does anyone know what to do?

CALLING DOWNLOAD WINDOW:

DOWNLOADING ($data is the file content):
// Hack for IE-bug
if (strstr($HTTP_USER_AGENT, "MSIE"))
{
$attachment = "";
}
else
{
$attachment = "attachment;";
};
header("Content-type: application/force-download ");
//header("Content-type: $type");
header("Content-Length: $size");
header("Content-Disposition: $attachment; filename=$filename");
header("Content-Transfer-Encoding: binary");
echo $data;
exit;

Carl-Johan Kihlbom wrote:

I've got what seems to be the fairly standard problem of forcing the browser to download (save file-dialog) files of the types .txt, .doc, .xls, etc.

I've been browsing the forums for an answer but the ones provided didn't work for me. This is what I use:

<?PHP
if ($startdownload == "yes") {
header("Content-type: application/octet-stream");
header("Content-Disposition: attachment; filename=$dfilename");
header("Content-Transfer-Encoding: binary");
header("Location: http://kihlbom.com/afk/download/$dfilename");
exit;
}
?>

I've also tried using header("Content-type: application/x-ms-download"); as suggested by someone in this forum.

I really need this to work, so if you guys could help me I'd be grateful.

BTW, I'm using IE 5.0/MacOS 8.6 for testing, but I've also tested with IE 5.0/Win98.

Thanks,

CJ Kihlbom

Anon

When I use this code

$file = "php_download.txt";
$download_filename = "exempel.txt";

$mime = "application/octet-stream";
$size = filesize($file);

$IEBUG_attachment = "";

if( strpos($_SERVER["HTTP_USER_AGENT"], "MSIE")!==false )
$IEBUG_attachment = " attachment;";

header("Content-Disposition:$IEBUG_attachment filename=\"$download_filename\"");
header("Content-Length: $size");
header("Content-Type: $mime");
$fh = fopen($file, "r");
fpassthru($fh);
exit;
?>

With Mozilla 1.1a and Netscape 7 Preview 1 the suffix ".exe" is added after the filename! So in the above example it becomes "exempel.txt.exe" instead of just "exempel.txt"... How come?