Why does readfile($filen ame) corrupt downloads?

deko

I need to allow users to download files from a directory that is not
publicly accessible. To do this, I use a download script:

header("Content-Type: application/octet-stream");
header("Content-Disposition: attachment; filename=".$fil ename);
readfile($fullp ath);

I've also tried using header("Content-Type: application/force-download")
instead of header("Content-Type: application/octet-stream"), but get the
same results - the downloaded file gets corrupted and cannot be read.

If I move the same file to /public_html and point a link to
http://www.mysite.com/filename.zip, it downloads fine and does not get
corrupted.

Am I using readfile correctly? Is there a more reliable way to download
files from directories that are not publicly accessible?

Thanks in advance.

Jul 17 '05 #1

Subscribe Reply

14253

deko

> publicly accessible. To do this, I use a download script:

header("Content-Type: application/octet-stream");
header("Content-Disposition: attachment; filename=".$fil ename);
readfile($fullp ath);

I've also tried using header("Content-Type: application/force-download")
instead of header("Content-Type: application/octet-stream"), but get the
same results - the downloaded file gets corrupted and cannot be read.

If I move the same file to /public_html and point a link to
http://www.mysite.com/filename.zip, it downloads fine and does not get
corrupted.

Am I using readfile correctly? Is there a more reliable way to download
files from directories that are not publicly accessible?

I may have discovered the problem. The page in which the link to the
download script resides is SSL-encrypted. So perhaps the download is going
over an encrypted connection or something. I discovered this by putting the
link to the download script in page that is not SSL-encrypted. The download
works fine from regular page. But this raises another question - how to
download over an SSL connection?

Jul 17 '05 #2

deko

> I may have discovered the problem. The page in which the link to the

download script resides is SSL-encrypted. So perhaps the download is going over an encrypted connection or something. I discovered this by putting the link to the download script in page that is not SSL-encrypted. The download works fine from regular page. But this raises another question - how to
download over an SSL connection?

Correction... with further testing, the issue clearly has something to do
with the download script.

Here is a non-SSL-encrypted page from which the download is initiated:

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01
Transitional//EN"http://www.w3.org/TR/html4/loose.dtd">
<html>
<head>
<meta http-equiv='Content-Type' content='text/html; charset=iso-8859-1'>
<link href='../../style.css' rel='stylesheet ' type='text/css'>
<title>test</title>
</head>
<?php
echo "
<body>
<div id='bodyContent ' style='height:8 00px'>
<table border='0' cellpadding='0' cellspacing='0' width='760'>
<tr>
<td><img src='../../images/headerbar/headerbar1.jpg</td>
<td><img src='../../images/headerbar/headerbar2.jpg' </td>
</tr>
</table>

<a href='dlcounter .php?file=myfil e.zip'>myfile.z ip</a>
</div>
</body>
</html>
";
?>

If I swap the commented line with the uncommented line, it works fine. The
way it is now, I get a corrupted download.

The three operative lines in the download script are:

header("Content-Type: application/octet-stream")
header("Content-Disposition: attachment; filename=".$fil ename);
readfile($fullp ath);

Could the issue be the HTTP variable ?file=myfile.zi p?
Perhaps the variables I'm using in the download script?
Some aberrant headers somewhere?

Jul 17 '05 #3

Alvaro G Vicario

*** deko wrote/escribió (Mon, 14 Mar 2005 04:32:27 GMT):

I need to allow users to download files from a directory that is not
publicly accessible. To do this, I use a download script:

header("Content-Type: application/octet-stream");
header("Content-Disposition: attachment; filename=".$fil ename);
readfile($fullp ath);

I've also tried using header("Content-Type: application/force-download")
instead of header("Content-Type: application/octet-stream"), but get the
same results - the downloaded file gets corrupted and cannot be read.

Make you sure aren't adding any extra blanks. The <? and ?> tags should be
the first and last chars in the script file respectively.

Jul 17 '05 #4

Hans van Kranenburg

deko wrote:

I need to allow users to download files from a directory that is not
publicly accessible. To do this, I use a download script:

header("Content-Type: application/octet-stream");
header("Content-Disposition: attachment; filename=".$fil ename);
readfile($fullp ath);

http://nl.php.net/manual/en/function.fpassthru.php

I used this yesterday for downloading a 100MB protected file (binary is
no problem) over https:

<?php

$file = '100mb.bin';
$fp = fopen($file, 'rb');

header("Content-Type: application/octet-stream");
header("Content-Length: " . filesize($file) );

fpassthru($fp);
exit;

?>

--
"He who asks a question is a fool for five minutes;
he who does not ask a question remains a fool forever"

Jul 17 '05 #5

deko

> Make you sure aren't adding any extra blanks. The <? and ?> tags should be

the first and last chars in the script file respectively.

I may discovered the problem. I was trying to use the same download script
for "secure" and "public" downloads, like this:

<?php
session_start() ;
$filename = trim($_GET[file]);
if ($_SESSION['uid'])
{
$file = '/home/myacct/secure/'.$_SESSION['uid'].'/'.$filename;
}
else
{
$file = 'http://www.clearpoints ystems.com/publicdownload/'.$filename;
}
header("Content-Disposition: attachment; filename=".$fil ename);
header("Content-Length: ".filesize($fil ename));
readfile($filen ame);
exit;

I just tried this, and it appeared to work:

<?php
header("Content-Disposition: attachment;
filename=/home/myacct/secure/test.zip");
header("Content-Length: ".filesize('hom e/myacct/secure/test.zip'));
readfile("home/myacct/secure/test.zip");
?>

Perhaps the problem was the headers getting screwed up with session_start.
Nevertheless, I'm wondering if readfile() will work the same with binary and
text files. Do I need to do anything differently for binary files?

Jul 17 '05 #6

Alvaro G Vicario

*** deko wrote/escribió (Thu, 17 Mar 2005 05:13:26 GMT):

<?php
session_start() ;
$filename = trim($_GET[file]);
if ($_SESSION['uid'])
{
$file = '/home/myacct/secure/'.$_SESSION['uid'].'/'.$filename;
}
else
{
$file = 'http://www.clearpoints ystems.com/publicdownload/'.$filename;
}
header("Content-Disposition: attachment; filename=".$fil ename);
header("Content-Length: ".filesize($fil ename));
readfile($filen ame);
exit;

You don't use variable $file, do you?
--
-- Álvaro G. Vicario - Burgos, Spain
-- Don't e-mail me your questions, post them to the group
--

Jul 17 '05 #7

deko

> > <?php

session_start() ;
$filename = trim($_GET[file]);
if ($_SESSION['uid'])
{
$file = '/home/myacct/secure/'.$_SESSION['uid'].'/'.$filename;
}
else
{
$file = 'http://www.clearpoints ystems.com/publicdownload/'.$filename;
}
header("Content-Disposition: attachment; filename=".$fil ename);
header("Content-Length: ".filesize($fil ename));
readfile($filen ame);
exit;

You don't use variable $file, do you?

air code error...

$filename should be $file in the last few lines.

In any case, I got it working. I wrote a download script just for secure
downloads and put the download script in cgi-bin and call it from the
SSL-encrypted private page. The private files are located outside of
document root, so I guess it's about as secure as it can get, or at least as
secure as it needs to be. Raj Shekhar sent me something about Pear - I
looked at the web page and tried to read the manual but I still have no idea
what Pear is or why I should use it.

Jul 17 '05 #8

Similar topics

4013

Download-Script: strange "[1]." in Filename

by: Kornelius Finkenbein | last post by:

Hello folks! I've got a strange problem with my download-script in conjunction with M$ internet explorer, if the filename I want to link to includes more than one points. In Netscape the problem doesn't exist. For example: input: ... download.php?name=virtualdub_1.4.9.zip

PHP

5243

Force download WITHOUT readfile?

by: Matthew Sims | last post by:

Is it possible to force a download without using the readfile function? My website setup consists of my server that serves the web pages plus a high-speed file server elsewhere on the internet that servers my files. I'm currently using header("Location: abc.com") to redirect my users to this other site but can't force a download. I can get it to work using readfile() but that means the file moves from the high-speed server through my...

PHP

1715

Does filename has to be the same as funtion name??

by: JS | last post by:

I am writing som C code and was wondering if I should call the filename the same as the name of my function. It compiles ok but should I make a file for each funtion just to keep it orderly or is there no tradition for this? JS

C / C++

9447

readfile and images

by: Jørn Dahl-Stamnes | last post by:

I'm trying to replace <IMG SRC="some image"> with the usage of readfile, but without luck. I have seen examples like this: header ('Content-length: ' .filesize($image_file)); header ('Content-type: image/jpeg'); readfile ($image_file); This works OK unless you have modified the header before. What I like to do is to display the image *within* HTML codes, something like:

PHP

2506

passing a filename & content type as image

by: B Squared | last post by:

I'm trying to pass a filename (which is a jpeg image) to a php function / file so that it will display. I know that its simple to get PHP to display an image hardcoding in the filename. For example, an href to this: <?php header("content-type:image/jpeg"); $filename = "image_file.jpg"; $im=ImageCreateFromJPEG($filename); ImageJPEG($im);

PHP

1358

Question about readfile

by: defogm | last post by:

Hello everyone, I was woundering if PHP "readfile" method consume server bandwidth by the size of the file that is read. I am asking this because I am creating a download script for large file like this ... header("Pragma: public"); header("Expires: 0"); header("Cache-Control: must-revalidate, post-check=0, pre-check=0"); header("Cache-Control: private",false);

PHP

9173

what is better : readfile, fpassthru, or header(" Location: ...")?

by: andre rodier | last post by:

Hello, I need to display or propose a jpeg image on a web page. When I need to display the image, I use this code : header("Content-Length: $fileSize") ; header("Content-Type: $type") ; header("Content-disposition: inline") ; header("Location: $imageURL"); And when I need to propose the image to save, I use this one :

PHP

2748

scipy-0.6.0.win32-py2.5.exe does not install

by: Frank Moyles | last post by:

Hi, I want to use SciPy library. I am using W2k, and ActiveState Python 2.5. I have succesfully numpy, but when I run the scipy-0.6.0.win32-py2.5.exe (from the downloads section on the SciPy page), nothing happens - i.e. no information is printed on the console, and the setup application simply quits with no warning/error message. has anyone managed to succesfully install SciPy using scipy-0.6.0.win32-py2.5.exe & ActiveState Python on...

Python

4794

PHP unable to unlink after readfile()

by: jlm699 | last post by:

On my site I have a file that I generate in /var/tmp so that the user can download it. The script is as follows: $file_path = '/var/tmp/up2606.csv'; header('Cache-Control: public, must-revalidate'); header('Pragma: hack'); header('Content-Type: application/vnd.ms-excel'); header('Content-Length: '.(string)(filesize($file_path))); header('Content-Transfer-Encoding: binary\n');

PHP

9000

What is ONU?

by: marktang | last post by:

ONU (Optical Network Unit) is one of the key components for providing high-speed Internet services. Its primary function is to act as an endpoint device located at the user's premises. However, people are often confused as to whether an ONU can Work As a Router. In this blog post, we’ll explore What is ONU, What Is Router, ONU & Router’s main usage, and What is the difference between ONU and Router. Let’s take a closer look ! Part I. Meaning of...

General

8838

Changing the language in Windows 10

by: Hystou | last post by:

Most computers default to English, but sometimes we require a different language, especially when relocating. Forgot to request a specific language before your computer shipped? No problem! You can effortlessly switch the default language on Windows 10 without reinstalling. I'll walk you through it. First, let's disable language synchronization. With a Microsoft account, language settings sync across devices. To prevent any complications,...

Windows Server

9396

Maximizing Business Potential: The Nexus of Website Design and Digital Marketing

by: jinu1996 | last post by:

In today's digital age, having a compelling online presence is paramount for businesses aiming to thrive in a competitive landscape. At the heart of this digital strategy lies an intricately woven tapestry of website design and digital marketing. It's not merely about having a website; it's about crafting an immersive digital experience that captivates audiences and drives business growth. The Art of Business Website Design Your website is...

Online Marketing

9339

The easy way to turn off automatic updates for Windows 10/11

by: Hystou | last post by:

Overview: Windows 11 and 10 have less user interface control over operating system update behaviour than previous versions of Windows. In Windows 11 and 10, there is no way to turn off the Windows Update option using the Control Panel or Settings app; it automatically checks for updates and installs any it finds, whether you like it or not. For most users, this new feature is actually very convenient. If you want to control the update process,...

Windows Server

9256

Discussion: How does Zigbee compare with other wireless protocols in smart home applications?

by: tracyyun | last post by:

Dear forum friends, With the development of smart home technology, a variety of wireless communication protocols have appeared on the market, such as Zigbee, Z-Wave, Wi-Fi, Bluetooth, etc. Each protocol has its own unique characteristics and advantages, but as a user who is planning to build a smart home system, I am a bit confused by the choice of these technologies. I'm particularly interested in Zigbee because I've heard it does some...

General

8260

AI Job Threat for Devs

by: agi2029 | last post by:

Let's talk about the concept of autonomous AI software engineers and no-code agents. These AIs are designed to manage the entire lifecycle of a software development project—planning, coding, testing, and deployment—without human intervention. Imagine an AI that can take a project description, break it down, write the code, debug it, and then launch it, all on its own.... Now, this would greatly impact the work of software developers. The idea...

Career Advice

6081

Couldn’t get equations in html when convert word .docx file to html file in C#.

by: conductexam | last post by:

I have .net C# application in which I am extracting data from word file and save it in database particularly. To store word all data as it is I am converting the whole word file firstly in HTML and then checking html paragraph one by one. At the time of converting from word file to html my equations which are in the word document file was convert into image. Globals.ThisAddIn.Application.ActiveDocument.Select();...

C# / C Sharp

4713

Trying to create a lan-to-lan vpn between two differents networks

by: TSSRALBI | last post by:

Hello I'm a network technician in training and I need your help. I am currently learning how to create and manage the different types of VPNs and I have a question about LAN-to-LAN VPNs. The last exercise I practiced was to create a LAN-to-LAN VPN between two Pfsense firewalls, by using IPSEC protocols. I succeeded, with both firewalls in the same network. But I'm wondering if it's possible to do the same thing, with 2 Pfsense firewalls...

Networking - Hardware / Configuration

2225

Comprehensive Guide to Website Development in Toronto: Expert Insights from BSMN Consultancy

by: bsmnconsultancy | last post by:

In today's digital era, a well-designed website is crucial for businesses looking to succeed. Whether you're a small business owner or a large corporation in Toronto, having a strong online presence can significantly impact your brand's success. BSMN Consultancy, a leader in Website Development in Toronto offers valuable insights into creating effective websites that not only look great but also perform exceptionally well. In this comprehensive...

General