Secure downloads

[rivka]

I'm trying to write a secure downloads script for zip files, and have run into a snag. Here's my code so far:

$file = $result[itempath];

header('Content-Description: File Transfer');
			header("Content-Type: application/octet-stream");
			header('Content-Length: ' . filesize($file));
			header('Content-Disposition: attachment; filename=' . basename($file)); 
		    readfile($file);

It's finding the file and trying to do something but all it's doing is printing out a bunch of gobblydegook to the screen. From my searching around and reading, code like this is supposed to make the file itself actual download. So...what am I doing wrong? I've tried a bunch of different variants of the above code from different sites, but it's all the same thing...just a bunch of gibberish to the screen.

[Weedpacket]

FYI: The appropriate MIME type for ZIP files is application/zip
You could try putting the Content-Disposition filename in quotes. What browsers have you tried (there tends to be differences from one browser to the next when downloading files for some reason).

[rivka]

Well, I'm back to trying to fix this problem (been busy lately). I've tried the above suggestions, and nothing's worked so far.

So far, I've tried it in IE and Firefox. As stated before, all I get is a bunch of gibberish to the screen...no downloadable file 🙁 Any suggestions are greatly appreciated.

[phpprogrammer]

hi,

In the header content type , you mention force download

and onemore thing is you should not send any out put before using header function

regards,
bvsureshbabu

[phpprogrammer]

<?php
$file = '/var/www/html/file-to-download.xyz';
header('Content-Description: File Transfer');
header('Content-Type: application/force-download');
header('Content-Length: ' . filesize($filename));
header('Content-Disposition: attachment; filename=' . basename($file));
readfile($file);
?>

[Weedpacket]

Originally posted by phpprogrammer
header('Content-Type: application/force-download');

No, application/octet-stream is the correct header (application/force-download isn't in the list, so clients ignore it and pretend that the header really said "application/octet-stream").

For my looking I still can't see anything wrong. If you get the livehttpheaders extension for Firefox you can look and see exactly what headers it is receiving. I'd also have a quick squizz at the binary, to make sure that it starts with PK\0x03\0x04 (the second two characters are probably illegible); just to check that you actually are getting a zip file.