PHP Forced download not working correctly

[Mitchey-Welch]

Hello,

 

Recently I have been coding a system for an upload/sharing file site of mine. However I have come across an issue that I have tried to resolve, but can't.

 

This is the downloadnow.php (The tab closes instantly, but the download correctly starts.)

 

<?PHP
include_once('global.php');

$id = mysql_real_escape_string($_GET['id']);

$query = mysql_query("SELECT * FROM uploads WHERE uniq_id = '" . $id . "'");
$mainrow = mysql_fetch_array($query);

$dir = "uploads";
$file = $dir . "/" . $mainrow['file_name'];
$filename = $dir . "/" . $mainrow['file_name'];

if(file_exists($file)) {
	header('Content-Description: File Transfer');
	header('Content-Disposition: attachment; filename=' . basename($file));
	header('Content-Transfer-Encoding: binary');
	header('Expires: 0');
	header('Cache-Control: must-revalidate');
	header('Pragma: public');
	ob_clean();
	flush();
	readfile($file);
}else{
	die("I'm sorry, this file either does not exist or has been deleted by the user.");
}
?>
<script>
window.close();
</script>

 

However, if I visit downloadnow.php WITHOUT an ID, such as downloadnow.php?id=612j2dh71, then it downloads the directory.htm, in this case uploads.htm. It's really frustrating, and I hope someone can help me out!

 

Thanks.

[PeoMachine]

Try to send a header with "Content-type"... something like:

 

header('Content-type: application/pdf');

[Mitchey-Welch]

But it isn't necessarily a type, it's any format. So it could be JPG, PNG, EXE, GIF, PDF, anything.

[Christian F.]

The most common MIME type to send for forced downloads is "application/octet-stream".

[Mitchey-Welch]

That has just made it instead of .htm, it's made it just the filename uploads with no extension.

 

In the file, it shows the <script>

window.close();

</script>

 

which is placed after the PHP.. Should I put the script to close the window into the PHP?

 

Also, when I hit the download button on my site it actually downloads both now?

 

[Mitchey-Welch]

<?php 
header("content-type: application/x-javascript"); 
echo "window.close();";
?>

 

Tried that, still downloads and in the uploads file that it downloads, its now only the window.close();

 

Any ideas?!

[Mitchey-Welch]

Now I'm confused.. 

 

It sometimes downloads the upload with the file, and sometimes does not.. Why does it download uploads.htm?

[Christian F.]

When making a download manager script, you need to only send the headers and data for the file itself. No other content should be sent to the browser, or you will have problems.

The browser itself will take care of closing the "window", if it notices that it's only a downloadable file. If not, then its on your browser and not your code.