Need help with a PHP file download script

[GrdLock]

My website uses a PHP download script called phpATM.

It downloads a file by calling:

/index.php?action=downloadfile?filename=blah&directory=blah

My problem is this: my files get direct linked from other websites. I don't mind this, but I would like people to be redirected to my main page when they click on that link from another website, rather than simply just downloading the file.

This is the code for the downloadfile case from index.php. (I removed some of the pre-download checks for the sake of saving space here)

	case 'downloadfile';

	$filename = getGetVar('filename');
	$directory = getGetDir('directory');


	$current_dir = $uploads_folder_name;
	if ($directory != '')
	{ $current_dir.="/$directory"; }

	$filename = basename($filename);

	header("Content-Type: application/force-download; name=\"$filename\"");
	header("Content-Transfer-Encoding: binary");
	header("Content-Length: $size");
	header("Content-Disposition: attachment; filename=\"$filename\"");
	header("Expires: 0");
	header("Cache-Control: no-cache, must-revalidate");
	header("Pragma: no-cache");


	if ($encrypt_filecontent)
	{ decrypt_file("$current_dir/$filename", true); }
	else
	{ readfile_chunked("$current_dir/$filename"); }


	exit;
	break;

What I was trying to do was just add header("Location: http://mainpage.com"); after the last header, but I quickly learned that doesn't work. I'm sure there would have been better ways to write this had I done it from scratch, but I'm very limited in PHP so that's not an option, neither is heavily modifying this site. Even better would be if when downloadfile case is called, that it displayed the entire site, but at the very top of the screen said "Downloading file: filename.zip"

I can't come up with any way to really do it that works and is simple to accomplish.
If anyone could point me in the right direction I'd appreciate it. Keep in mind that I know very little about PHP and coding in general.

[johanafm]

An easy way to deal with this would be to do this at the top of your script

if (strpos($_SERVER['HTTP_REFERER'], 'http://example.com') !== 0) {
	# if you want them to go to your main page
	 header('location: http://example.com');
	# or this if you want them to get to the file directly
	# I exchanged the second '?' for '&' (not & here)
        header('location: http://example.com/index.php?action=downloadfile&filename=blah&directory=blah');
	exit;
}

But, since it's up to the client to set the HTTP_REFERER, you can't count on it being there, or being correct for that matter. So this solution is simple, but not perfect.

Another way would be to use sessions and a random token for each user.

session_start();
if (!isset($_SESSION['user_token']) || $_SESSION['user_token'] != $_GET['token']) {
	$_SESSION['user_token'] = MD5(time());    # or however you wish to create this
        # add the token as well if you want to redirect directly to the download
	header('as above');
	exit;
}

# where you generate your file link, add $_SESSION['user_token'] to the query string like this
# Also, while you're at it, exhange the second '?' to '&' if that was actually in your code. Here you should use '&' rather than &
# and not just a post error
$downloadlink = '/index.php?action=downloadfile&filename=blah&directory=blah&'.$_SESSION['user_token'];