Deliver an exe file via php

[Vero44]

Hi.  Basically, I have a C++ program run locally on a user's PC that I need to look at my server and deliver an exe file.  The problem is, for security, these exe files need to be outside of the root of the server.  I have root access to the server.

 

Does anyone know a way I can get my program to look at a public php script on my server which then offers the correct file from the server?  I have seen this code a few minutes ago and wonder if this is the best approach:

 

<?php
$filepath='/somewhere/outside/docroot/';
$filename='download.zip';
header('Content-Disposition:attachment; filename="'.$filename.'"');
header('Content-type:application/octet-stream');
header('Pragma:no-cache');
header('Expires:0');
if ($file=fopen($filepath.$filename,'r')) {
fpassthru($file);
fclose($file);
}
?>

 

I need to use .exe and not .zip.  Is this code suitable if I change the filename to an exe and change pathnames?

 

Thanks in advance.

[BlueSkyIS]

the only way to know is to try.

[Vero44]

Now that wasn't very helpful was it BlueSky?  :'(

 

I am in the process of trying a few things but I'm a basic level php programmer and I was hoping that maybe somebody here has managed to do this before and can help me to achieve what I need to.  Especially given the security required I wouldn't like to guess at this.

 

 

 

[phpfreak]

It looks like you're on the right track to me... be sure to look up those functions in the PHP Manual to get a better understanding of what they do.

[BlueSkyIS]

Now that wasn't very helpful was it BlueSky?  :'(

 

Well, your question, "Is this code suitable if I change the filename to an exe and change pathnames?" is very open-ended. I assumed you were asking "will this work?" The only way to know if that will work is to try. Now, either you can try or we can try for you. I just meant that you should try instead of asking us to try it for you.

[Vero44]

I can get the file to download and it runs fine.

 

I have root/home/username/download/ as my download directory and the php file publicly accessible.  2 questions:

 

1.  What do I need to look out for security-wise?

 

2.  If I incorporate a download counter into this can you recommend a good script, non database preferably?

[premiso]

1: Security wise, nothing. You are defining your variables and not allowing the user to set anything. So it is fine.

 

2: To incorperate a download counter, non-database driven, simply write it to a text file and just open / increment it each time. This is really trivial:

 

$fh = fopen('counter.dat', 'w');
$counter = fread($fh, 1024);
$counter++;
fwrite($fh, $counter);
fclose($fh);

 

Should do it for you.

[Vero44]

That's great thanks.  I tried it but when I requested the file via the browser it created counter.dat and set it to 1 as expected.  Requesting the file again does nothing, ie it is still set to 1, even after a refresh.  I went from 644 permissions to 777 on counter.dat to test it as well.

 

Any idea why?

[premiso]

Seems like it is because of the w flag, try this:

 

$counter = file_get_contents('counter.dat');
$counter += 1;
$fh = fopen('counter.dat', 'w');
fwrite($fh, $counter);
fclose($fh);

 

Should work.

[Vero44]

That's got it, thanks Premiso

 

If I have several php files for different exes, can I share a text file or is this going to cause access problems when different users download different files at the same time?  Perhaps, if so, I could use a master 'report' file that reads in the individual files.

[premiso]

You can use one file or multiple. If you use one file you would need a way to identify the file. If you use individual files, well you just name them differently. The shared text potentiality could cause problems, but it depends on how accurate you want it to be.

[chintansshah]

Hello Vero44, I have one suggestion to download ZIP file, before click on download just check user is human being or automated script. Put CAPTCHA to avoid automated script problem.

[Vero44]

It's sort of working...

 

I have this:

 

<?php
$filepath='/home/mydomain/download/pf003/';
$filename='filename_1.1.9.exe';
header('Content-Disposition:attachment; filename="'.$filename.'"');
header('Content-type:application/octet-stream');
header('Pragma:no-cache');
header('Expires:0');
if ($file=fopen($filepath.$filename,'r')) {
fpassthru($file);
fclose($file);
}

 

There is one other file in that directory, a version.txt file with version number inside.  If I rename the .exe in that directory to, say, file001.exe, it still downloads it as filename_1.1.9.exe but the file is corrupt.

 

How does it know which file to pick out of that directory, ie the text file or the exe?

[Vero44]

OK.  I have moved the version.txt file out of the directory so there is just a single exe in there.  When I download the file which is 1MB I get a resulting exe that is only 259 Bytes.  Doubtless to say, the exe does not work.

 

Something is very wrong here, any ideas?