Question

The script below is a quick and dirty attempt to provide a means of protecting my files that I’m selling on PayDotCom and Paypal.

If anyone has experience with these services, I have a few questions…

1) Is there a token that I can set at either of these pay sites that I can then check for in the script below before executing the download?

2) In the script below, the file that is retrieved is correct, however, the filename it wants to save it to is the same as the PHP processing page (secure-download.php). How can I change the saved file’s filename? e.g. it will be a zip file.

3) There’s a few notes in the code below, I need some advice on…

<?php

    $file = basename(urldecode($_GET['file']));
    $fileDir = dirname(dirname( dirname( __FILE__ ) ) )."/secure/";

// The secure directory is outside of www root

    if (file_exists($fileDir . $file))
    {
        // Note: Need advice here to do some more checks 
        // on the filetype, size, etc.
        $contents = file_get_contents($fileDir . $file);

        // Note: Need to implement some kind 
        // of check on filetype
        header('Content-type: application/zip');

        echo $contents;
                    //currently the filename is same as the processing file, need to change it to [somefile].zip

    }

?>

Answer 1

Hy im not sure i understand your uestion but i think you hae a problem with downloading the file? right if so here is your fixed code:

<?php

    $file = basename(urldecode($_GET['file']));
    $fileDir = dirname(dirname( dirname( __FILE__ ) ) )."/secure/";

// The secure directory is outside of www root

    if (file_exists($fileDir . $file))
    {
        $contents = file_get_contents();
        header("Content-Type: x-type/subtype");
        header("Content-Disposition: attachment; filename=\""$fileDir.$file"\"");
    }

?>