Question

im working on a content management system for that i have to download a php file using php code without executing. any one can help me on this

it is some thing like ftp. i have added the options to upload, edit and download a file. it is working fine. but while downloading a php file it is executed instead of downloading…

What i tried is:

<?php
$file = $_REQUEST['file_name'];

if (file_exists($file)) {
    header('Content-Description: File Transfer');
    header('Content-Type: application/octet-stream');
    header('Content-Disposition: attachment; filename='.basename($file));
    header('Content-Transfer-Encoding: binary');
    header('Expires: 0');
    header('Cache-Control: must-revalidate, post-check=0, pre-check=0');
    header('Pragma: public');
    header('Content-Length: ' . filesize($file));

    include_once($file);
    exit;
}
?>

Answer 1

You have to load the files content, write the content to the request and set the headers so that it’s parsed as force download or octet stream.

For example:

http://server.com/download.php?name=test.php

Contents of download.php:

  <?php 
  $filename = $_GET["name"]; //Obviously needs validation
  ob_end_clean();
  header("Content-Type: application/octet-stream; "); 
  header("Content-Transfer-Encoding: binary"); 
  header("Content-Length: ". filesize($filename).";"); 
  header("Content-disposition: attachment; filename=" . $filename);
  readfile($filename);
  die();
  ?>

This code works without any modification. Although it needs validation and some security features.