Problem with antileech code

finditmax

Have been working on this code.....

<?php
//your domain
$domain="www.testuse.finditmax.com";
//folder that the hidden Downloads files are in, no lead or trailing slashes
$folder="hid";
$filename=stripslashes(urldecode($QUERY_STRING));
if ($filename==""){readfile("http://www.testuse.finditmax.com/invalidfile.html");exit;}
$refr=getenv("HTTP_REFERER");
list($remove,$stuff)=split('//',$refr,2);
list($home,$stuff)=split('/',$stuff,2);
if ($home!=$domain){readfile("http://www.testuse.finditmax.com/leecher.html");exit;
}else{
$fp=@fopen("http://".$domain."/".$folder."/".$filename,"r");
if($fp){
if (ereg(".mp3",$filename)){$xtype="audio/mpeg";}
elseif(ereg(".zip",$filename)){$xtype="application/x-zip-compressed";}
elseif(ereg(".exe",$filename)){$xtype="application/x-msdownload";}
else{$xtype="application/octet-stream";}
Header("Content-Type: $xtype");
Header("Accept-Ranges: bytes");
Header("Content-Disposition: ; attachment; Filename=$filename");
while (!feof($fp)) {
$buffer = fgets($fp, 4096);
echo $buffer;
}
fclose ($fp);
}else{
readfile("http://www.testuse.finditmax.com/filenotfound.html");exit;
die("file not found");
}}
?>
it opens and downloads the zip file Ok...but the Zip file os 0Kb and empty when I open it......Is there a reason why it is not downloading the contents of the Zip file also..

SuperCam

Accept-Ranges might have something to do with it?

finditmax

Hi SuperCam

thanks for the reply

Ye tried different variation in that area...made no difference...

it is opening the file from the hidden folder Ok and downloads to the desktop...but when you open the file it is empty...It is like it is creating an empty ghost copy of the existing file in the downloads folder 😕

drawmack

It's your content disposition header, make it

Content-Disposition: attached; Filename=$filename

finditmax

hmmmm

This is daft....still pulling empty file

A link to the page for an example

finditmax

Hmmmm this is a real head scratcher...

Have tha above code as a download.php file..in a folder call download...have the downloads in a folder called hid....
call the downloads using

http://www.domain.com/download/download.php?leech.zip

downloads the named file...but the zip file is empty and is 0Kb in size...So I know it is finding the file in the hid folder...but why is it not including the contents of the zip file 😕

drawmack

you aren't echoing the contents of the file to the browser.

finditmax

How and where would I put this in the script...as I have errors saying header already sent

Sorry to be such a pain😕

drawmack

right after you send out the headers then send out the content of the file.

use http://www.php.net/get_file_contents to get the contents of the file

then use http://www.php.net/echo to write the contents of the file out to the browser.

finditmax

Thanks for the help....

Managed to correct the code...have updated the posted code on the first post (do not like to fill a forum with loads of posts of code)
Can a better coder than me look over it to check the syntax for me...to make sure I have found an answer...and not made a problem...as I did not use the:
file_get_contents
or
echo

many thanks for all your help

drawmack

you just did it a different way, that's fine, but since you're filling buffer before echoing it a hacker could use that to dos you by requesting a large file or requesting a small file a bunch of times and filling up your ram.

finditmax

Hi drawmack

thanks for the pointer....what would you suggest...clear the buffer after each download?

As I had a lot of trouble trying to figure out how to use the file_get_contents...did not know how to use it in my code...I'm stupid i guess..

Would be very greatfull for any code suggestion (or small example)...that would do the same job

all the best

Richard 😃

finditmax

Is thier anybody that can offer an example to make this script hacker secure...or how to use the:
file_get_contents
without just a link to the php site, as this offers little help in this area

all the best

drawmack

Here ya go I minimized variable use, you could also do away with some of the if statements and opening the files locally would be a good idea to:

you may want to read this: http://www.suryvial.com/articles/1/3

<?php 
//your domain 
define('DOMAIN',"www.testuse.finditmax.com"); 

//folder that the hidden Downloads files are in, no lead or trailing slashes 
define('FOLDER',"hid"); 
define('FILENAME',stripslashes(urldecode($QUERY_STRING)));

//if the filename is blank display an error page
if(FILENAME==""){
    header ("Location: h ttp://" . DOMAIN . "/invalidfile.html");
    exit;
} 

list($remove,$stuff)=split('//',getenv("HTTP_REFERER"),2); 
list($home,$stuff)=split('/',$stuff,2); 

if ($home!=$domain){
    header("Location: h ttp://" . DOMAIN . "/leecher.html");
    exit; 
}else{ 
    $fp=@fopen("h ttp://" . DOMAIN . "/" . FOLDER ."/".$filename,"r"); 
    if($fp){ 
        if (ereg(".mp3",$filename)){header("Content-Type: audio/mpeg";} 
        elseif(ereg(".zip",$filename)){header("Content-Type: application/x-zip-compressed";} 
        elseif(ereg(".exe",$filename)){header("Content-Type: application/x-msdownload";} 
        else{header("Content-Type: application/octet-stream";} 
        header("Accept-Ranges: bytes"); 
        header("Content-Disposition: ; attachment; Filename=$filename"); 
        while (!feof($fp)) { 
            echo(fgets($fp, 4096)); 
        } //end while
        fclose ($fp); 
    }else{ 
        header('Location: h ttp://' . DOMAIN . "/filenotfound.html");
        exit; 
    } //end else
} //end else
?>