alessiaass Posted March 3, 2015 Share Posted March 3, 2015 (edited) Is there any way that every user must wait before clicking on a direct link. For example, they click on mysite.com/downloads/file.zip . With no modification, file.zip will start downloading. But i want to redirect users to a wait time page. And I want this to be on every file inside a folder. For example, I want all files inside public_html/directory/downlaods to have wait time and not affect other files in public_html/directory or public_html/. Edited March 3, 2015 by alessiaass Quote Link to comment https://forums.phpfreaks.com/topic/295050-force-direct-link-to-wait-time-page/ Share on other sites More sharing options...
joel24 Posted March 3, 2015 Share Posted March 3, 2015 use .htaccess to block the /public_html/directory/downloads directory with a 'block from all, allow from 127.0.0.1' or the apache user and then deliver the file to the user using readfile... though this will use up some resources if you're delivering large files... http://php.net/manual/en/function.readfile.php here's a few stack overflow posts which should help http://stackoverflow.com/questions/14024877/deny-direct-download-of-file-using-php http://stackoverflow.com/questions/10834196/secure-files-for-download Quote Link to comment https://forums.phpfreaks.com/topic/295050-force-direct-link-to-wait-time-page/#findComment-1507415 Share on other sites More sharing options...
alessiaass Posted March 4, 2015 Author Share Posted March 4, 2015 (edited) use .htaccess to block the /public_html/directory/downloads directory with a 'block from all, allow from 127.0.0.1' or the apache user and then deliver the file to the user using readfile... though this will use up some resources if you're delivering large files... http://php.net/manual/en/function.readfile.php here's a few stack overflow posts which should help http://stackoverflow.com/questions/14024877/deny-direct-download-of-file-using-php http://stackoverflow.com/questions/10834196/secure-files-for-download Well, first stackoverflow is good, but i dont get the download-file.php and where should .htaccess file should be. And how to make it for 3 seconds. Can i do it with 3 html files where: 1st file: <html> <head> <title>Redirect</title> </head> <body style="background-color:cyan;"> <a href="zz.html">Click here to download file</a> </body> </html> 2nd file <meta http-equiv="refresh" content="5;URL=zzz.html" /> <html> <head> <title>Waiting</title> </head> <body style="background-color:pink;"> Wait 5 seconds before download the file (in the meantime, enjoy our publicity) </body> </html> 3rd file <html> <head> <title>Downloading</title> <script type="text/javascript"> setTimeout( "window.location='myfile'",1000 ); </script> </head> <body style="background-color:yellow;"> Downloading </body> </html> and if yes, how can i get filename a user requested? Edited March 4, 2015 by alessiaass Quote Link to comment https://forums.phpfreaks.com/topic/295050-force-direct-link-to-wait-time-page/#findComment-1507499 Share on other sites More sharing options...
joel24 Posted March 5, 2015 Share Posted March 5, 2015 you'll need a php script delivering the file if you want to ensure security... though if security isn't a huge issue (i.e. someone could copy the direct download link and send it to someone else and that's okay), then just have a javascript which disables the download button for x seconds... are you just wanting to advertise before the file is downloaded? then just have two html files, or even just the one... set setTimeout() in your javascript and you can have a countdown on whichever page before activating the download link. check this jsfiddle on this stackoverflow post; http://stackoverflow.com/a/6146437 Quote Link to comment https://forums.phpfreaks.com/topic/295050-force-direct-link-to-wait-time-page/#findComment-1507607 Share on other sites More sharing options...
alessiaass Posted March 5, 2015 Author Share Posted March 5, 2015 (edited) you'll need a php script delivering the file if you want to ensure security... though if security isn't a huge issue (i.e. someone could copy the direct download link and send it to someone else and that's okay), then just have a javascript which disables the download button for x seconds... are you just wanting to advertise before the file is downloaded? then just have two html files, or even just the one... set setTimeout() in your javascript and you can have a countdown on whichever page before activating the download link. check this jsfiddle on this stackoverflow post; http://stackoverflow.com/a/6146437 Yes, i want for advertising purposes. But users will click in direct link, then they will be redirected in wait time and advertisement page, after x seconds download button appears. I cant make a php, html wait time page for every file. there will be thousands of files in site.com/directory/downloads . And every user who clicks in any file inside this folder or any subfolder (site.com/directory/downloads/movie/horror/archive.zip) will see ads and after sometime he will download file. Edited March 5, 2015 by alessiaass Quote Link to comment https://forums.phpfreaks.com/topic/295050-force-direct-link-to-wait-time-page/#findComment-1507614 Share on other sites More sharing options...
alessiaass Posted March 8, 2015 Author Share Posted March 8, 2015 (edited) When i click on direct link www.mysite.com/downloads/download.zip I get this error Warning: fopen(downloadsdownload.zip): failed to open stream: No such file or directory in /home/username/public_html/gamefiles/download.php on line 11 So, there is no / . when i click on www.mysite.com/downloads/download.php?download_file=download.zip file starts downloading. Here is htaccess RewriteEngine On # you can add whatever extensions you want routed to your php script RewriteCond %{REQUEST_URI} \.(doc|zip|pdf)$ [NC] RewriteRule ^(.*)$ /download.php?download_file=$1/ [L] and here is download.php <?php sleep(3); ignore_user_abort(true); set_time_limit(0); // disable the time limit for this script $path = ""; // change the path to fit your websites document structure $dl_file = preg_replace("([^\w\s\d\-_~,;:\[\]\(\].]|[\.]{2,})", '', $_GET['download_file']); // simple file name validation $dl_file = filter_var($dl_file, FILTER_SANITIZE_URL); // Remove (more) invalid characters $fullPath = $path.$dl_file; if ($fd = fopen ($fullPath, "r")) { $fsize = filesize($fullPath); $path_parts = pathinfo($fullPath); $ext = strtolower($path_parts["extension"]); switch ($ext) { case "pdf": header("Content-type: application/pdf"); header("Content-Disposition: attachment; filename=\"".$path_parts["basename"]."\""); // use 'attachment' to force a file download break; // add more headers for other content types here default; header("Content-type: application/octet-stream"); header("Content-Disposition: filename=\"".$path_parts["basename"]."\""); break; } header("Content-length: $fsize"); header("Cache-control: private"); //use this to open files directly while(!feof($fd)) { $buffer = fread($fd, 2048); echo $buffer; } } fclose ($fd); exit; EDITED: Found out that if I click on www.mysite.com/downloads/download.php?download_file=downloads/download.zip gives the above error. Edited March 8, 2015 by alessiaass Quote Link to comment https://forums.phpfreaks.com/topic/295050-force-direct-link-to-wait-time-page/#findComment-1507869 Share on other sites More sharing options...
joel24 Posted March 8, 2015 Share Posted March 8, 2015 The error you're seeing is because you're sanitizing the $_GET['download_file'] URL which is good, though the / is being removed. This should not be in there, read below. straight away i see a security risk, you need to jail the downloads to a single folder - if you have that someone could change the link to be www.mysite.com/downloads/download.php?download_file=index.php and then follow that code to download each file in your site and view the code to hack. You need to remove the directory from the download link and just pass a filename... or even an ID linked to a list of files in your database, then you can increase a counter each time one is downloaded so you know how many times it's downloaded.. For now if you don't want a database with each file, just change your code to have the download directory written into the code so it's not passed in the URL. Quote Link to comment https://forums.phpfreaks.com/topic/295050-force-direct-link-to-wait-time-page/#findComment-1507908 Share on other sites More sharing options...
alessiaass Posted March 9, 2015 Author Share Posted March 9, 2015 I actually solved the security problem using this code <?php ############################################################### # File Download 1.31 ############################################################### # Visit http://www.zubrag.com/scripts/ for updates ############################################################### # Sample call: # download.php?f=phptutorial.zip # # Sample call (browser will try to save with new file name): # download.php?f=phptutorial.zip&fc=php123tutorial.zip ############################################################### // Allow direct file download (hotlinking)? // Empty - allow hotlinking // If set to nonempty value (Example: example.com) will only allow downloads when referrer contains this text define('ALLOWED_REFERRER', ''); // Download folder, i.e. folder where you keep all files for download. // MUST end with slash (i.e. "/" ) define('BASE_DIR','/home/user/downloads/'); // log downloads? true/false define('LOG_DOWNLOADS',true); // log file name define('LOG_FILE','downloads.log'); // Allowed extensions list in format 'extension' => 'mime type' // If myme type is set to empty string then script will try to detect mime type // itself, which would only work if you have Mimetype or Fileinfo extensions // installed on server. $allowed_ext = array ( // archives 'zip' => 'application/zip', // documents 'pdf' => 'application/pdf', 'doc' => 'application/msword', 'xls' => 'application/vnd.ms-excel', 'ppt' => 'application/vnd.ms-powerpoint', // executables 'exe' => 'application/octet-stream', // images 'gif' => 'image/gif', 'png' => 'image/png', 'jpg' => 'image/jpeg', 'jpeg' => 'image/jpeg', // audio 'mp3' => 'audio/mpeg', 'wav' => 'audio/x-wav', // video 'mpeg' => 'video/mpeg', 'mpg' => 'video/mpeg', 'mpe' => 'video/mpeg', 'mov' => 'video/quicktime', 'avi' => 'video/x-msvideo' ); #################################################################### ### DO NOT CHANGE BELOW #################################################################### // If hotlinking not allowed then make hackers think there are some server problems if (ALLOWED_REFERRER !== '' && (!isset($_SERVER['HTTP_REFERER']) || strpos(strtoupper($_SERVER['HTTP_REFERER']),strtoupper(ALLOWED_REFERRER)) === false) ) { die("Internal server error. Please contact system administrator."); } // Make sure program execution doesn't time out // Set maximum script execution time in seconds (0 means no limit) set_time_limit(0); if (!isset($_GET['f']) || empty($_GET['f'])) { die("Please specify file name for download."); } // Nullbyte hack fix if (strpos($_GET['f'], "\0") !== FALSE) die(''); // Get real file name. // Remove any path info to avoid hacking by adding relative path, etc. $fname = basename($_GET['f']); // Check if the file exists // Check in subfolders too function find_file ($dirname, $fname, &$file_path) { $dir = opendir($dirname); while ($file = readdir($dir)) { if (empty($file_path) && $file != '.' && $file != '..') { if (is_dir($dirname.'/'.$file)) { find_file($dirname.'/'.$file, $fname, $file_path); } else { if (file_exists($dirname.'/'.$fname)) { $file_path = $dirname.'/'.$fname; return; } } } } } // find_file // get full file path (including subfolders) $file_path = ''; find_file(BASE_DIR, $fname, $file_path); if (!is_file($file_path)) { die("File does not exist. Make sure you specified correct file name."); } // file size in bytes $fsize = filesize($file_path); // file extension $fext = strtolower(substr(strrchr($fname,"."),1)); // check if allowed extension if (!array_key_exists($fext, $allowed_ext)) { die("Not allowed file type."); } // get mime type if ($allowed_ext[$fext] == '') { $mtype = ''; // mime type is not set, get from server settings if (function_exists('mime_content_type')) { $mtype = mime_content_type($file_path); } else if (function_exists('finfo_file')) { $finfo = finfo_open(FILEINFO_MIME); // return mime type $mtype = finfo_file($finfo, $file_path); finfo_close($finfo); } if ($mtype == '') { $mtype = "application/force-download"; } } else { // get mime type defined by admin $mtype = $allowed_ext[$fext]; } // Browser will try to save file with this filename, regardless original filename. // You can override it if needed. if (!isset($_GET['fc']) || empty($_GET['fc'])) { $asfname = $fname; } else { // remove some bad chars $asfname = str_replace(array('"',"'",'\\','/'), '', $_GET['fc']); if ($asfname === '') $asfname = 'NoName'; } // set headers header("Pragma: public"); header("Expires: 0"); header("Cache-Control: must-revalidate, post-check=0, pre-check=0"); header("Cache-Control: public"); header("Content-Description: File Transfer"); header("Content-Type: $mtype"); header("Content-Disposition: attachment; filename=\"$asfname\""); header("Content-Transfer-Encoding: binary"); header("Content-Length: " . $fsize); // download // @readfile($file_path); $file = @fopen($file_path,"rb"); if ($file) { while(!feof($file)) { print(fread($file, 1024*); flush(); if (connection_status()!=0) { @fclose($file); die(); } } @fclose($file); } // log downloads if (!LOG_DOWNLOADS) die(); $f = @fopen(LOG_FILE, 'a+'); if ($f) { @fputs($f, date("m.d.Y g:ia")." ".$_SERVER['REMOTE_ADDR']." ".$fname."\n"); @fclose($f); } ?> Now i have everything i need, But, is there any way to download file by clicking "DOWNLOAD HERE" and start downloading? because this script downloads file automatically. Quote Link to comment https://forums.phpfreaks.com/topic/295050-force-direct-link-to-wait-time-page/#findComment-1507944 Share on other sites More sharing options...
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.