Forced downloads of many files, through only one php file

[teapot]

Hi, I came to this forum to ask a question about forcing a pdf download when a link is clicked.

I saw this thread right on top of the forum:
http://www.phpbuilder.com/board/showthread.php?t=10365067

Asking the same thing.

I just tried that solution, and it works, but it's not practical if you have lots of files and a page with lots of links to all these files, because then you have to make a php file for every pdf file you want to force a download for. (Unless I got something wrong...?)

What I wanted to ask about was a different piece of code.
I bumped into this tip on another site today:
http://www.kirupa.com/forum/showpost.php?p=426238&postcount=6

It says to use this code:

<?php
header("Content-Type:application/octet-stream");
header("Content-Disposition:attachment;");
$fName = basename($_GET['file']);
fpassthru($fName);
?> 

Save it as a file, for example, filedownload.php, in the same folder with all the files for downloading, and then to download for example "ramdom.wmv", call it through a simple link like this:

<a href="filedownload.php?file=random.wmv">Video!</a>  

This would be ideal for me, because then I could use only one php file and just change the links, however I tried it on my server and it's not working. It gives me a "save as..." dialogue but it offers me to download filedownload.php, not the pdf.

Anyone know why? Is it the script or might it be my php settings?

I've tried changing the Content-type header to

header('Content-type: application/pdf'); 

but it made no difference. :queasy:

---

ps. :eek: just realised you can download ANY file from the server with that code. This is not good. Even if it worked, is there a way to limit downloads to just one folder?

bahh, many questions in one post, I know.

[bpat1434]

Your best bet is to utilize some sort of database (either in an XML format or in a real RDBMS system (mySQL, PostgreSQL, Oracle, Drizzle, whatever)). Then do two things:

1. Store the type (mime-type) of the file that it is (image/jpeg, application/pdf, plain/text, audio/mp3)

2. Store the name of the file

Then when someone requests filename.wmv, you can look up both items. If it's not found, you can force a 404 (or just send a plain-text document stating the download was not found).

THen if it is found you can make your application smarter 😉 By knowing the filename and the type of the file, not everything will be downloaded as an octet-stream (meaning the catchall for a download). PDFs should be sent as application/pdf. So you could write your code to do something like:

header('Content-Type: '.$file['type']);
header('Content-Disposition: attachment; filename="'.$file['name'].'"');
echo file_get_contents($file['name']);