php readfile URL problem with URL variable

[peter321]

I am quiet novice with php and sql so please bear with me if these are stupid simple questions. These two problems have troubled me for several days now.

 

I want to let authorized users to download pdf files from my website so I adapted a php password scripts (articles.php) to check the user id and password. If a user click on the name of a file, it will invoke the the link http://xxxxxxx/articles.php?name=filename, which opens a login page. If the user supply correct info, the login page is supposed to close and popup a download window givig the user options to save or open the pdf file. The login part is

 

<form action="<?=$_SERVER['PHP_SELF']?>" method="post">

<table>

<TR>

<TD> User ID: </TD>

<TD>  <input type="text" name="uname"></TD>

</TR>

<TR>

<TD>Password: </TD>

<TD><input type="password" name="upass"></TD>

</TR>

<TR>

<TD><input type="submit"  value="login" ></TD>

</table>

<BR>

<BR>

<p align="center"> <INPUT TYPE='BUTTON' VALUE='Close Window' onClick='window.close()'> </P>

</form>

 

The problem is that the login window does not close after the download page is opened, so I had to add a button to ask users to manually close it. How can I fix this.

 

The 2nd problem is the download part, the scripts is like:

 

<?php

$name =$_GET['name'];

$theFile="http://xxxxxx.com/files/$name";

 

header('Cache-Control: maxage=3600');

header('Pragma: public');

        header ("Content-Type: application/pdf");

        header ('Content-Disposition: attachment; filename=$name');

        readfile($theFile);

?>

 

The readfile() can not get the url correctly so the download fails. However, if I replace the $name in the URL with a file name, download works okay. So I guess the problem is with the URL variable $name. Anybody could tell me how to fix it? Also the "filename=$name" in the header does not work while replacing $name with filename.pdf works fine. Thanks in advance.

[ucffool]

For the second part, it is grabbing the name of the file from the GET variable. Are you passing this properly (probably not because the login script is getting in the way)? In other words, for the download page, assuming download.php, the URL bar should be showing http:///xxxxx.com/download.php?name=filenamegoeshere

 

My guess is you need to have the login page, after verification, pass the querystring on to the next page through GET, or even by POST and change the download.php file to $_POST instead of $_GET.