file download code have a problem

[ralph03]

Hi, I need help with file downloading. I aim to click the download button (refer 1.jpeg) and the system displays the file that needs to be downloaded. However, I have a problem to do that. When I click the download button, it appears warning: <a href="download.php?file=<br /><b>Warning</b>:  Undefined array key 1 in <b>C:\xampp\htdocs\bercuitmsarawak\adminview4.php</b> on line <b>43</b><br />
" class="btn btn-primary"><span class="glyphicon glyphicon-download"></span> Download</a>. The problem is the code for fetching data in the attribute file in the database (refer 2.jpeg) is not working. So I need help you guys to looked for my code. TQSM

interface code

<table class="table table-bordered" border=5 cellpadding=5 cellspacing=0>
    <tr>
        <th>appno
        <th>flowchart
        <th>gantt
        <th>proposal
        <th>questionnaire
        <th>Action
    </tr>

    <?php
    require 'conn.php';
    $stmt = $con->prepare("SELECT * FROM applicantabove18att");
    $stmt->execute();
    $result = $stmt->get_result();

    while($fetch = $result->fetch_assoc()) {
      $filename = explode('/', $fetch['file']);
    ?>
        <tr>
            <td><?php echo $fetch['appno']; ?></td>
            <td><?php echo $fetch['flowchart']; ?></td>
            <td><?php echo $fetch['gantt']; ?></td>
            <td><?php echo $fetch['proposal']; ?></td>
            <td><?php echo $fetch['questionnaire']; ?></td>
            <td><a href="download.php?file=<?php echo $filename[1]?>" class="btn btn-primary"><span class="glyphicon glyphicon-download"></span> Download</a></td>
            
        </tr>
    <?php
}

?>

</table>

 

download.php code

 

<?php

if (isset($_GET['file'])) {

  $file = $_GET['file'];

  $file_path = "dokumen/" . $file; // Modify path if needed

 

  if (file_exists($file_path)) {

    // Set download headers and read the file

    header("Content-Disposition: attachment; filename=" . $file);

    header("Content-Type: application/octet-stream;");

    readfile($file_path);

  } else {

    echo "Error: File not found!"; // Display error message

  }

}

?>

[requinix]

None of those rows have a value for the "file".

[ralph03]

1 hour ago, requinix said:

None of those rows have a value for the "file".

True based on the warning. Do you have any idea how to solve this?or any code that you want to share much appreciated.

[requinix]

You don't have a filename for any of those files. Is there supposed to be a filename for all of those files?

If so then you need to fix that. If not then you need to change your code so that it doesn't try to show a download button if there is no file to download.

[mac_gyver]

also, don't use the actual filename in the download link, as this will allow directory traversal, with the current download.php code, to be used to download any file off of the server, such as your database connection credentials. instead, use an id in the link, then in the download.php code, query to find the actual filename, if any, based on the id. it's an error if the submitted id doesn't match a row of data or if there's no defined file for that id.