Unique hidden downloads

[therealwesfoster]

Here's the concept.

 

A user registers, receives an email with an URL like http://site.com/download.php?id=#####. The number will be unique to each person that registers.

 

Once the user (or anyone) accesses that download, I will mark that ID in the database and make the link not work anymore.

 

My question is, on the download.php page.. how can I access the download file so that the user can download it, but WITHOUT revealing the URL of the actual file?

 

Thanks

 

Wes

[Jabop]

A user will always be able to see what they're downloading.

[therealwesfoster]

Well what would be the safest way of doing this? As in, the way that will be the hardest for the user to get the direct file URL.

 

Wes

[Jabop]

Created a page, for example download.php?file=(encrypted string or hash here), and spit out the file with its relative headers.

 

That's one way, at least.

[therealwesfoster]

Are you talking about something like this? (i found this online somewhere)

 

<?php
$content_len=@filesize("file.zip");

Header("Content-type: application/zip");
Header("Content-type: octet-stream");
Header('Content-Disposition: attachment; filename="file.zip"');

if($content_len)
{
  Header("Content-length: $content_len");
}

readfile("file.zip");
?>

[LooieENG]

Found this for you

 

<?php

function force_download($filename, $name ) {
      $filesize = filesize($filename);
      if($filesize) {
          ini_set('zlib.output_compression', 'Off');
   
          /* IE FIX : FireFox Compatible */
          header("Content-Type: application/application/octet-stream\n");
          header("Content-Disposition: attachment; filename=\"$name\"");
          /* Read It */
          $contents = fread(fopen($filename, "rb"), filesize($filename));
          /* Print It */
          echo $contents;
          exit;
      } else {
          return 0;
      }
   }

?>

[therealwesfoster]

Awesome, I'll give it a try as soon as i get a chance.

 

Wes

[discomatt]

Store file outside of webroot, bring it in using readfile or the function below if the file is large and causing memory errors

 

<?php
function readfile_chunked($filename,$retbytes=true) {
   $chunksize = 1*(1024*1024); // how many bytes per chunk
   $buffer = '';
   $cnt =0;
   // $handle = fopen($filename, 'rb');
   $handle = fopen($filename, 'rb');
   if ($handle === false) {
       return false;
   }
   while (!feof($handle)) {
       $buffer = fread($handle, $chunksize);
       echo $buffer;
       ob_flush();
       flush();
       if ($retbytes) {
           $cnt += strlen($buffer);
       }
   }
       $status = fclose($handle);
   if ($retbytes && $status) {
       return $cnt; // return num. bytes delivered like readfile() does.
   }
   return $status;

}
?> 

[therealwesfoster]

Found this for you

 

<?php

function force_download($filename, $name ) {
      $filesize = filesize($filename);
      if($filesize) {
          ini_set('zlib.output_compression', 'Off');
   
          /* IE FIX : FireFox Compatible */
          header("Content-Type: application/application/octet-stream\n");
          header("Content-Disposition: attachment; filename=\"$name\"");
          /* Read It */
          $contents = fread(fopen($filename, "rb"), filesize($filename));
          /* Print It */
          echo $contents;
          exit;
      } else {
          return 0;
      }
   }

?>

 

I got an error:

Warning: filesize() [function.filesize]: stat failed for http://site.com/PMSE_2.5.zip in /home/my/path/to/dl.php on line 46

 

 

 

-----------------------------

 

 

 

Store file outside of webroot, bring it in using readfile or the function below if the file is large and causing memory errors

 

<?php
function readfile_chunked($filename,$retbytes=true) {
   $chunksize = 1*(1024*1024); // how many bytes per chunk
   $buffer = '';
   $cnt =0;
   // $handle = fopen($filename, 'rb');
   $handle = fopen($filename, 'rb');
   if ($handle === false) {
       return false;
   }
   while (!feof($handle)) {
       $buffer = fread($handle, $chunksize);
       echo $buffer;
       ob_flush();
       flush();
       if ($retbytes) {
           $cnt += strlen($buffer);
       }
   }
       $status = fclose($handle);
   if ($retbytes && $status) {
       return $cnt; // return num. bytes delivered like readfile() does.
   }
   return $status;

}
?> 

 

Well, kind of worked. But instead of downloading the file, it just outputted alot of weird characters.. what should i do to get around this?

I tried it with the second argument being both true and false..

 

 

 

Thanks

[DarkWater]

You need to set the headers and you can probably just use readfile().

[therealwesfoster]

Hey looie, i removed the entire filesize function and it's now working

 

Thanks and topic solved