Why does readfile($filename) corrupt downloads?

deko

I need to allow users to download files from a directory that is not
publicly accessible. To do this, I use a download script:

header("Content-Type: application/octet-stream");
header("Content-Disposition: attachment; filename=".$filename);
readfile($fullpath);

I've also tried using header("Content-Type: application/force-download")
instead of header("Content-Type: application/octet-stream"), but get the
same results - the downloaded file gets corrupted and cannot be read.

If I move the same file to /public_html and point a link to
http://www.mysite.com/filename.zip, it downloads fine and does not get
corrupted.

Am I using readfile correctly? Is there a more reliable way to download
files from directories that are not publicly accessible?

Thanks in advance.

Jul 17 '05 #1

Subscribe Post Reply

14186

deko

> publicly accessible. To do this, I use a download script:

header("Content-Type: application/octet-stream");
header("Content-Disposition: attachment; filename=".$filename);
readfile($fullpath);

I've also tried using header("Content-Type: application/force-download")
instead of header("Content-Type: application/octet-stream"), but get the
same results - the downloaded file gets corrupted and cannot be read.

If I move the same file to /public_html and point a link to
http://www.mysite.com/filename.zip, it downloads fine and does not get
corrupted.

Am I using readfile correctly? Is there a more reliable way to download
files from directories that are not publicly accessible?

I may have discovered the problem. The page in which the link to the
download script resides is SSL-encrypted. So perhaps the download is going
over an encrypted connection or something. I discovered this by putting the
link to the download script in page that is not SSL-encrypted. The download
works fine from regular page. But this raises another question - how to
download over an SSL connection?

Jul 17 '05 #2

deko

> I may have discovered the problem. The page in which the link to the

download script resides is SSL-encrypted. So perhaps the download is going over an encrypted connection or something. I discovered this by putting the link to the download script in page that is not SSL-encrypted. The download works fine from regular page. But this raises another question - how to
download over an SSL connection?

Correction... with further testing, the issue clearly has something to do
with the download script.

Here is a non-SSL-encrypted page from which the download is initiated:

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01
Transitional//EN"http://www.w3.org/TR/html4/loose.dtd">
<html>
<head>
<meta http-equiv='Content-Type' content='text/html; charset=iso-8859-1'>
<link href='../../style.css' rel='stylesheet' type='text/css'>
<title>test</title>
</head>
<?php
echo "
<body>
<div id='bodyContent' style='height:800px'>
<table border='0' cellpadding='0' cellspacing='0' width='760'>
<tr>
<td><img src='../../images/headerbar/headerbar1.jpg</td>
<td><img src='../../images/headerbar/headerbar2.jpg'</td>
</tr>
</table>

<a href='dlcounter.php?file=myfile.zip'>myfile.zip</a>
</div>
</body>
</html>
";
?>

If I swap the commented line with the uncommented line, it works fine. The
way it is now, I get a corrupted download.

The three operative lines in the download script are:

header("Content-Type: application/octet-stream")
header("Content-Disposition: attachment; filename=".$filename);
readfile($fullpath);

Could the issue be the HTTP variable ?file=myfile.zip?
Perhaps the variables I'm using in the download script?
Some aberrant headers somewhere?

Jul 17 '05 #3

Alvaro G Vicario

*** deko wrote/escribió (Mon, 14 Mar 2005 04:32:27 GMT):

I need to allow users to download files from a directory that is not
publicly accessible. To do this, I use a download script:

header("Content-Type: application/octet-stream");
header("Content-Disposition: attachment; filename=".$filename);
readfile($fullpath);

I've also tried using header("Content-Type: application/force-download")
instead of header("Content-Type: application/octet-stream"), but get the
same results - the downloaded file gets corrupted and cannot be read.

Make you sure aren't adding any extra blanks. The <? and ?> tags should be
the first and last chars in the script file respectively.

Jul 17 '05 #4

Hans van Kranenburg

deko wrote:

I need to allow users to download files from a directory that is not
publicly accessible. To do this, I use a download script:

header("Content-Type: application/octet-stream");
header("Content-Disposition: attachment; filename=".$filename);
readfile($fullpath);

http://nl.php.net/manual/en/function.fpassthru.php

I used this yesterday for downloading a 100MB protected file (binary is
no problem) over https:

<?php

$file = '100mb.bin';
$fp = fopen($file, 'rb');

header("Content-Type: application/octet-stream");
header("Content-Length: " . filesize($file));

fpassthru($fp);
exit;

?>

--
"He who asks a question is a fool for five minutes;
he who does not ask a question remains a fool forever"

Jul 17 '05 #5

deko

> Make you sure aren't adding any extra blanks. The <? and ?> tags should be

the first and last chars in the script file respectively.

I may discovered the problem. I was trying to use the same download script
for "secure" and "public" downloads, like this:

<?php
session_start();
$filename = trim($_GET[file]);
if ($_SESSION['uid'])
{
$file = '/home/myacct/secure/'.$_SESSION['uid'].'/'.$filename;
}
else
{
$file = 'http://www.clearpointsystems.com/publicdownload/'.$filename;
}
header("Content-Disposition: attachment; filename=".$filename);
header("Content-Length: ".filesize($filename));
readfile($filename);
exit;

I just tried this, and it appeared to work:

<?php
header("Content-Disposition: attachment;
filename=/home/myacct/secure/test.zip");
header("Content-Length: ".filesize('home/myacct/secure/test.zip'));
readfile("home/myacct/secure/test.zip");
?>

Perhaps the problem was the headers getting screwed up with session_start.
Nevertheless, I'm wondering if readfile() will work the same with binary and
text files. Do I need to do anything differently for binary files?

Jul 17 '05 #6

Alvaro G Vicario

*** deko wrote/escribió (Thu, 17 Mar 2005 05:13:26 GMT):

<?php
session_start();
$filename = trim($_GET[file]);
if ($_SESSION['uid'])
{
$file = '/home/myacct/secure/'.$_SESSION['uid'].'/'.$filename;
}
else
{
$file = 'http://www.clearpointsystems.com/publicdownload/'.$filename;
}
header("Content-Disposition: attachment; filename=".$filename);
header("Content-Length: ".filesize($filename));
readfile($filename);
exit;

You don't use variable $file, do you?
--
-- Álvaro G. Vicario - Burgos, Spain
-- Don't e-mail me your questions, post them to the group
--

Jul 17 '05 #7

deko

> > <?php

session_start();
$filename = trim($_GET[file]);
if ($_SESSION['uid'])
{
$file = '/home/myacct/secure/'.$_SESSION['uid'].'/'.$filename;
}
else
{
$file = 'http://www.clearpointsystems.com/publicdownload/'.$filename;
}
header("Content-Disposition: attachment; filename=".$filename);
header("Content-Length: ".filesize($filename));
readfile($filename);
exit;

You don't use variable $file, do you?

air code error...

$filename should be $file in the last few lines.

In any case, I got it working. I wrote a download script just for secure
downloads and put the download script in cgi-bin and call it from the
SSL-encrypted private page. The private files are located outside of
document root, so I guess it's about as secure as it can get, or at least as
secure as it needs to be. Raj Shekhar sent me something about Pear - I
looked at the web page and tried to read the manual but I still have no idea
what Pear is or why I should use it.

Jul 17 '05 #8

by: Kornelius Finkenbein | last post by:

Hello folks! I've got a strange problem with my download-script in conjunction with M$ internet explorer, if the filename I want to link to includes more than one points. In Netscape the problem...

PHP

Force download WITHOUT readfile?

by: Matthew Sims | last post by:

Is it possible to force a download without using the readfile function? My website setup consists of my server that serves the web pages plus a high-speed file server elsewhere on the internet...

PHP

Does filename has to be the same as funtion name??

by: JS | last post by:

I am writing som C code and was wondering if I should call the filename the same as the name of my function. It compiles ok but should I make a file for each funtion just to keep it orderly or is...

C / C++

readfile and images

by: Jørn Dahl-Stamnes | last post by:

I'm trying to replace <IMG SRC="some image"> with the usage of readfile, but without luck. I have seen examples like this: header ('Content-length: ' .filesize($image_file)); header...

PHP

passing a filename & content type as image

by: B Squared | last post by:

I'm trying to pass a filename (which is a jpeg image) to a php function / file so that it will display. I know that its simple to get PHP to display an image hardcoding in the filename. For...

PHP

Question about readfile

by: defogm | last post by:

Hello everyone, I was woundering if PHP "readfile" method consume server bandwidth by the size of the file that is read. I am asking this because I am creating a download script for large file...

PHP

what is better : readfile, fpassthru, or header(" Location: ...")?

by: andre rodier | last post by:

Hello, I need to display or propose a jpeg image on a web page. When I need to display the image, I use this code : header("Content-Length: $fileSize") ; header("Content-Type: $type") ;...

PHP

scipy-0.6.0.win32-py2.5.exe does not install

by: Frank Moyles | last post by:

Hi, I want to use SciPy library. I am using W2k, and ActiveState Python 2.5. I have succesfully numpy, but when I run the scipy-0.6.0.win32-py2.5.exe (from the downloads section on the SciPy...

Python

PHP unable to unlink after readfile()

by: jlm699 | last post by:

On my site I have a file that I generate in /var/tmp so that the user can download it. The script is as follows: $file_path = '/var/tmp/up2606.csv'; header('Cache-Control: public,...

PHP

How to turn on java script in a villaon keypad mobile phone

by: Charles Arthur | last post by:

How do i turn on java script on a villaon, callus and itel keypad mobile phone

Java

Migrating Website to Cloud - Emmanuel Katto

by: emmanuelkatto | last post by:

Hi All, I am Emmanuel katto from Uganda. I want to ask what challenges you've faced while migrating a website to cloud. Please let me know. Thanks! Emmanuel

General

Navigating the Data Structures and Algorithms (DSA)

by: BarryA | last post by:

What are the essential steps and strategies outlined in the Data Structures and Algorithms (DSA) roadmap for aspiring data scientists? How can individuals effectively utilize this roadmap to progress...

Algorithms / Advanced Math

Looking to do Android software development, any suggestions? Is flutter better?

by: nemocccc | last post by:

hello, everyone, I want to develop a software for my android phone for daily needs, any suggestions?

General

Is that possible of reading the .csv file in column wise and the column have different lengths ?

by: Sonnysonu | last post by:

This is the data of csv file 1 2 3 1 2 3 1 2 3 1 2 3 2 3 2 3 3 the lengths should be different i have to store the data by column-wise with in the specific length. suppose the i have to...

C / C++

How to build RAID in BIOS?

by: Hystou | last post by:

There are some requirements for setting up RAID: 1. The motherboard and BIOS support RAID configuration. 2. The motherboard has 2 or more available SATA protocol SSD/HDD slots (including MSATA, M.2...

Computer Hardware

What is ONU?

by: marktang | last post by:

ONU (Optical Network Unit) is one of the key components for providing high-speed Internet services. Its primary function is to act as an endpoint device located at the user's premises. However,...

General

Problem With Comparison Operator <=> in G++

by: Oralloy | last post by:

Hello folks, I am unable to find appropriate documentation on the type promotion of bit-fields when using the generalised comparison operator "<=>". The problem is that using the GNU compilers,...

C / C++

Discussion: How does Zigbee compare with other wireless protocols in smart home applications?

by: tracyyun | last post by:

Dear forum friends, With the development of smart home technology, a variety of wireless communication protocols have appeared on the market, such as Zigbee, Z-Wave, Wi-Fi, Bluetooth, etc. Each...

General

Why does readfile($filename) corrupt downloads?

Similar topics