How do I redirect to a page

[conjurer]

I am working on some simple authentication code where someone logs in with a name and password.

I have been testing out where it does the following on success:
{//variables match

		echo "<h3  class='loginmsg'>It worked!</h3>";
}

So now that I have it working if I wanted to bring up myfile.pdf when they succeed what would I need to replace the echo line with?

Sorry if this is a real basic question, I just don't have a clue what to look under in the manual.

[bradgrafelman]

Well, instead of displaying any output, you could send an HTTP header that forwards them to another page:

header('Location: http://mysite.com/path/to/newPage.htm');

[jazz_snob]

header("Location: my_pdf_page.php");

I would list the pdfs as links on my_pdf_page.php and have a download script to start them downloading when the link is clicked; this will build character! (meaning you get to find out browser-specific quirks).

If you just redirect to

http://somesite.com/my_file.pdf

then really my_file.pdf is not "password protected" at all. If someone knew its URL they could go straight to it. Really depends I guess on what you thinks is "satisfactory" means of accessing the pdf. my_pdf_page.php would first check that the user is logged in, otherwise redirect to login screen.

OK, didn't take me long to dig up this bit that forces the download of PDF, YMMV, use at your own risk 🙂

//$file is the name of the file i just carefully extracted from the request (ie $_GET most likely).
//its value is NOT TO BE TRUSTED

if( $file && preg_match( "/^\./", $file ) ) {
    //bogus, logout user
    header( "Location: rptlist.php?logout" );
    exit;
}

if( $file && file_exists( REPORT_REPOSITORY . "/$file" ) && preg_match( "/\.pdf$/", $file )) {
    //looks like a good filename

  # start download
  $path = REPORT_REPOSITORY . "/$file";

  header("Content-Type: application/zip\n"); 
  header( "Content-disposition: attachment; filename=\"$file\"\n" );
  header("Cache-Control: cache, must-revalidate");   

  header("Pragma: public");
  header( "Content-transfer-encoding: binary \n" );
  header( "Content-length: " . filesize( $path ) . "\n" );
  #header("Cache-control: private\n");
  //send file contents
  //should really check $fp isnt FALSE here:
  $fp = fopen( $path, "rb" );
  fpassthru( $fp );
  fclose( $fp );

  exit(0);
} else {
       //send back to the page listing the available PDFs
       header( "Location: rptlist.php" );
}

I just noticed i have application/zip in the code but this was definitely to download a pdf. Its been a while since I threw this together and most certainly its code I googled (for the most part).

[conjurer]

So I tried the following without success:

( $password == $set_password && $username == $set_username1 || $username == $set_username2)
			{//variables match


			include ("../Assessments/Interest Type Assessment.pdf");
			exit;
		}

And I get the following error messages/warnings:

Warning: Unexpected character in input: '' (ASCII=7) state=1 in C:\Documents and Settings\RLane\My Documents\Web Sites\Localhost\CCS Revisions 7-9-06\Assessments\Interest Type Assessment.pdf on line 407

Parse error: parse error in C:\Documents and Settings\RLane\My Documents\Web Sites\Localhost\CCS Revisions 7-9-06\Assessments\Interest Type Assessment.pdf on line 408

Any ideas on how to open up the pdf file from this part of the code?

Thanks

[bradgrafelman]

conjurer wrote:

Any ideas on how to open up the pdf file from this part of the code?

Yeah - follow either my or jazz_snob's suggestions. Now that I read your original post about this being inside an authentication system, I would go with his post.

Make sure the user is authenticated, and then output the file as a download from inside the PHP script. That way there is no direct linking of the .pdf itself. I would also recommend putting the .pdf and any other files you want to be kept secure inside a folder and use .htaccess to protect that folder ("Order allow,deny" and then "Deny from all").

[dr_bung]

header('Location: http://localhost/redirect_to_here.php');

That will work if no other output has been sent... I suppose you could turn on output buffering if output must be sent before the redirect. Probably not "best practice" but gets the job done 😃

[bradgrafelman]

Oops, just to clarify, I'd recommend following the 2nd half of his post (the large code snippet he posted), though that snippet could do with some tuneups here and there...

[conjurer]

I tried this but it is choking

<?php
 // Set the password variables
 	$set_username1 = "int123";
	$set_username2 = "per123";
	$set_password = "xyz123";

// check whether form has been submitted:
if(isset($_POST['Submit']))
{
		// check whether username and password match here
		$username = strtolower($_POST['username']);
		$password =  strtolower($_POST['password']);

		if($password == $set_password && $username == $set_username1 || $username == $set_username2  )

{//variables match
		# start download\
	$path = "Assessments/Interest.pdf";

	header("Content-Type: application/pdf\n");
	header( "Content-disposition: attachment; filename=\"$file\"\n" );
	header("Cache-Control: cache, must-revalidate");   
	header("Pragma: public");
	header( "Content-transfer-encoding: binary \n" );
	header( "Content-length: " . filesize( $path ) . "\n" );
	 #header("Cache-control: private\n");
	//send file contents
	 //should really check $fp isnt FALSE here:
	 $fp = fopen( $path, "rb" );
		fpassthru( $fp );
		fclose( $fp );

  exit(0); 

		}
		else 
		{ //variables failed
		echo "<h3  class='loginmsg'> You are not using the correct login information!</h3>" ; 
		die();
		}
}
else
 // form hasnt been submitted so ask them to login
{echo "<h3 class='loginmsg'>Please login</h3>";

}

?>

What I get now is a slew of warnings like these:

Warning: Cannot modify header information - headers already sent by (output started at C:\Documents and Settings\RLane\My Documents\Web Sites\Localhost\CCS Revisions 7-9-06\user authentication\TMPx48h52buvs.php:9) in C:\Documents and Settings\RLane\My Documents\Web Sites\Localhost\CCS Revisions 7-9-06\user authentication\TMPx48h52buvs.php on line 186

Warning: Cannot modify header information - headers already sent by (output started at C:\Documents and Settings\RLane\My Documents\Web Sites\Localhost\CCS Revisions 7-9-06\user authentication\TMPx48h52buvs.php:9) in C:\Documents and Settings\RLane\My Documents\Web Sites\Localhost\CCS Revisions 7-9-06\user authentication\TMPx48h52buvs.php on line 187

Warning: Cannot modify header information - headers already sent by (output started at C:\Documents and Settings\RLane\My Documents\Web Sites\Localhost\CCS Revisions 7-9-06\user authentication\TMPx48h52buvs.php:9) in C:\Documents and Settings\RLane\My Documents\Web Sites\Localhost\CCS Revisions 7-9-06\user authentication\TMPx48h52buvs.php on line 188

Warning: Cannot modify header information - headers already sent by (output started at C:\Documents and Settings\RLane\My Documents\Web Sites\Localhost\CCS Revisions 7-9-06\user authentication\TMPx48h52buvs.php:9) in C:\Documents and Settings\RLane\My Documents\Web Sites\Localhost\CCS Revisions 7-9-06\user authentication\TMPx48h52buvs.php on line 189

Warning: Cannot modify header information - headers already sent by (output started at C:\Documents and Settings\RLane\My Documents\Web Sites\Localhost\CCS Revisions 7-9-06\user authentication\TMPx48h52buvs.php:9) in C:\Documents and Settings\RLane\My Documents\Web Sites\Localhost\CCS Revisions 7-9-06\user authentication\TMPx48h52buvs.php on line 190

Warning: filesize(): Stat failed for Assessments/Interest.pdf (errno=2 - No such file or directory) in C:\Documents and Settings\RLane\My Documents\Web Sites\Localhost\CCS Revisions 7-9-06\user authentication\TMPx48h52buvs.php on line 191

Warning: Cannot modify header information - headers already sent by (output started at C:\Documents and Settings\RLane\My Documents\Web Sites\Localhost\CCS Revisions 7-9-06\user authentication\TMPx48h52buvs.php:9) in C:\Documents and Settings\RLane\My Documents\Web Sites\Localhost\CCS Revisions 7-9-06\user authentication\TMPx48h52buvs.php on line 191

Warning: fopen(Assessments/Interest.pdf): failed to open stream: No such file or directory in C:\Documents and Settings\RLane\My Documents\Web Sites\Localhost\CCS Revisions 7-9-06\user authentication\TMPx48h52buvs.php on line 195

Warning: fpassthru(): supplied argument is not a valid stream resource in C:\Documents and Settings\RLane\My Documents\Web Sites\Localhost\CCS Revisions 7-9-06\user authentication\TMPx48h52buvs.php on line 196

Warning: fclose(): supplied argument is not a valid stream resource in C:\Documents and Settings\RLane\My Documents\Web Sites\Localhost\CCS Revisions 7-9-06\user authentication\TMPx48h52buvs.php on line 197

[Weedpacket]

As dr_bung noted, you can't send any output before sending any headers (and if you're redirecting the user to another page, there's no point sending any output on this page anyway). As your error message states, something on line 9 of TMPx48h52buvs.php is generating output; so when the call to header() is reached on line 186, it's too late to send headers.