Trying to mimic "Save Target As..."

WATYF

Hi there... I've got a Flash mp3 player on my site that I've added a "download" button to. The problem is, if they are using IE and Windows Media Player, then instead of downloading the mp3, it starts playing it. So I'm trying to mimic the action of a user clicking "Save Target As..." so that it immediately asks them where to save the file.

Now... I can't tell the user to click on "Save Target As..." because this is a Flash button, so there is no right-clicking that they can do... so I'm trying to do this using php. This is what I have at the moment that I've gotten from around the net.

<?php
//Set this to the base of where files
//can be downloaded from for security measures.
$basedir = "";
if(!$GET['file']) {
print "Sorry that file does not exist";
exit;
}
elseif(!file_exists($basedir.$GET['file'])) {
print "Sorry that file does not exist";
exit;
}
else {
$file = $basedir.$_GET['file'];
header("Content-Type: application/octet-stream");
header("Content-Length: " . filesize($file));
header("Content-Disposition: attachment; filename=\"$file\"");
echo file_get_contents($file);
}
?>

In Firefox, this works fine... but in IE, the first time you click, it says "to protect your security, Internet Explorer has stopped this site from downloading files to your computer." (obviously, I don't want to force a download, I just want to force the initiation of a download). So if you right click on that message and hit "Download File..." (to allow the file download), it does nothing (the screen flashes and then you're right back at the same page). Then, if you click the same button again, it finally opens a prompt for a "save as" download, but the filename is wrong (it's the name of the php file, instead of the actual file to be downloaded), but the file being downloaded really is the mp3 you clicked on.

Anyway... at the moment, it's a mess in IE, so I'm trying to find a better bit of code to do this so that I don't have so many problems between browsers.... has anyone found a way to do this successfully?

WATYF

drew010

you can try
header("Content-Type: application/force-download");
but it seems that this is just another example of microsoft ruining things for programmers. it would never force the person to download the file, only prompt, but it seems to them even a prompt is too much.
i think its also a service pack 2 thing because i dont have that installed and that same code works just as expected, and the filename is set to whatever is given in the filename header.

just another side note, with basedir left empty, the person can basically tell that script to download any file from your webserver, even if its outside the webroot.

Mistah_Roth

I find with IE that headers like to be the first thing loaded on the page, perhaps try putting it into a seperate file and link to that file with variables for the path and the file name/extention.

WATYF

Well, I found another script and it works "better". IE still blocks the download and asks for approval, but I guess that's the best I'm gonna get.

The issue now is the question of security. The download.php file is in my root (because I have to pass the mp3 paths to the mp3player starting from the root folder as well).

The place I got the new script from also mentioned that it would be very bad if you allowed the file to be visible in a URL, so I'm guessing I should do something about it. 😛

The thing is... this script is being called from a flash file, and since I'm not opening a new window (since that didn't work so well) it never actually shows you the path to the download.php file.... so does that mean I'm safe?

Btw, would putting the php file in a lower subdirectory take care of the problem as well?

WATYF

btw... here's the script, in case anyone else has this problem.

<?php

$filename = $_GET['file'];

if(ini_get('zlib.output_compression'))
  ini_set('zlib.output_compression', 'Off');
$file_extension = strtolower(substr(strrchr($filename,"."),1));

if( $filename == "" ) 
{
  echo "<html><body>ERROR: download file NOT SPECIFIED. USE force-download.php?file=filepath</body></html>";
  exit;
} elseif ( ! file_exists( $filename ) ) 
{
  echo "<html><body>ERROR: File not found. USE force-download.php?file=filepath</body></html>";
  exit;
};
switch( $file_extension )
{
  case "pdf": $ctype="application/pdf"; break;
  case "exe": $ctype="application/octet-stream"; break;
  case "zip": $ctype="application/zip"; break;
  case "doc": $ctype="application/msword"; break;
  case "xls": $ctype="application/vnd.ms-excel"; break;
  case "ppt": $ctype="application/vnd.ms-powerpoint"; break;
  case "gif": $ctype="image/gif"; break;
  case "png": $ctype="image/png"; break;
  case "jpeg":
  case "jpg": $ctype="image/jpg"; break;
  default: $ctype="application/force-download";
}
header("Pragma: public"); // required
header("Expires: 0");
header("Cache-Control: must-revalidate, post-check=0, pre-check=0");
header("Cache-Control: private",false); // required for certain browsers 
header("Content-Type: $ctype");
header("Content-Disposition: attachment; filename=".basename($filename).";" );
header("Content-Transfer-Encoding: binary");
header("Content-Length: ".filesize($filename));
readfile("$filename");
exit();

?>

WATYF

drew010

just do something like
$filename = "/full/path/to/downloads/" . $_GET['file'];

that way its secure since you are hardcoding the base path.

also im not really sure you will want the switch statement for file extensions, because this will invoke the default behaviour of the browser to use a plugin to handle the file. for example with my browser, if its type is application/pdf adobe acrobat plugin will open in my browser, but if you always use application/octet-stream it will prompt a download but my computetr knows to use adobe to read this pdf file.

WATYF

that's ok.. the switch statement isn't doing anything, since all I'll ever use this for is mp3's. If I ever need it for something else, I'll just hack up the switch statement.

btw... I can't append a string to $filename, since 'file' already has the full path from the root in it (that's how the mp3 player requires it), so what I'm thinking of doing is checking to make sure that $filename starts with the folder path that I expect it to, and if it doesn't, then exit the code... so how would I do that...

...in VB.NET it would be: If Not $filename.StartsWith("folder1/subfolder2/subfolder3/") then Exit Sub.

I'm basically looking for the php equivalent of that.

WATYF

drew010

$basefolder = preg_quote("whatever/downloads/");
$file = preg_quote($_GET['file']);

if (!preg_match("/^$basefolder/i", $file)) {
  echo "wrong directory";
} else {
  //download
}

edit:
or this alternative might be faster:

$basefolder = "whatever/downloads/";

if (strpos($_GET['file'], $basefolder) !== 0) {
  echo "wrong directory";
} else {
 //download
}

WATYF

absolutely perfect man... you rock! 😃

WATYF