* Thus wrote pete M ([EMAIL PROTECTED]):
> thsi si a nighmare area..... and loast days on same problem
Its a nightmare area cause so many things can go wrong with your
script.
>
> This works for me.. hope it does for you
>
> $file = $_GET['file'];
> $path = '/www/cgi-bin/docu/personal/'.$file;
very insecure, no de-tainting of the string or ensuring the file
isn't accessing bad things ie:
?file=../../../../etc/passwd
> //force download dialog
> header("Content-type: application/octet-stream\n");
New lines are ignore and stripped so its unneeded, besides that
http headers should have \r\n.
> header("Content-disposition: attachment; filename=\"$file\"\n");
> header("Content-transfer-encoding: binary\n");
> header("Content-length: " . filesize($path) . "\n");
$path was never checked for existance, you'll confuse the client by
sending a wrong content-length.
>
> //send file contents
> $fp=fopen($path, "r");
> fpassthru($fp);
Again $path wasn't checked to see if it was a valid file.
Curt
--
"My PHP key is worn out"
PHP List stats since 1997:
http://zirzow.dyndns.org/html/mlists/
--
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php
