webEdition - Forum

Code: Alles auswählen

/**
 * check, if passed key is a valid integer
 */

$file_id = filter_var(key($_GET), FILTER_SANITIZE_NUMBER_INT);

if(empty($file_id) === false)
{
    /**
     * get file information from database
     * Crits: Searchable, no folder, published
     */
    
    $sql = '
    SELECT
        *
    FROM
        `tblFile`
    WHERE
        `ID` = ' . $db->real_escape_string($file_id) . '
    AND
        `IsSearchable` = 1
    AND
        `IsFolder` = 0
    AND
        `Published` != 0
    LIMIT 1;';
    
    $result = $db->query($sql);
    
    
    /**
     * check, if entry exists
     */
    
    if($result->num_rows === 1)
    {
        $data = $result->fetch_assoc();
        
        $file = $_SERVER['DOCUMENT_ROOT'] . $data['Path'];
        
        /**
         * check if file exists
         */
        
        if(is_file($file))
        {
            $contentType = $data['ContentType'];

            if(substr($contentType, -1) === '*')
            {
                $contentType = substr($contentType, 0, -1) . substr($data['Extension'], 1);
            }

            /**
             * output the file
             */
            
            header('Content-Type: ' . $contentType);
            header('Content-Transfer-Encoding: binary');
            header('Content-Length:' . filesize($file));
            header('Content-Disposition: attachment; filename=' . $data['Filename']);
            
            readfile($file);
        }
        else 
        {
            echo 'file not found.';
        }
    }
    else 
    {
        echo 'file not found.';
    }
}

Code: Alles auswählen

/**
 * check, if passed key or value of index file is a valid integer
 * example: download.php?123 || download.php?file=123
 */

$file_id = filter_var(key($_GET), FILTER_VALIDATE_INT) !== false 
           ? key($_GET) 
           : filter_input(INPUT_GET, 'file', FILTER_SANITIZE_NUMBER_INT);

if(empty($file_id) === false)
{
    /**
     * get file information from database
     * Crits: Searchable, no folder, published, no webEdition page
     */
    
    $sql = '
    SELECT
        IF(RIGHT(`ContentType`, 1) = "*", CONCAT(SUBSTRING_INDEX(`ContentType`, "*", 1), SUBSTR(`Extension`, 2)), `ContentType`) AS `ContentType`,
        CONCAT("' . $_SERVER['DOCUMENT_ROOT'] . '", `Path`) AS `File`,
        `Filename`
    FROM
        `tblFile`
    WHERE
        `ID` = ' . $db->real_escape_string($file_id) . '
    AND
        `ContentType` != "text/webedition"
    AND
        `IsSearchable` = 1
    AND
        `IsFolder` = 0
    AND
        `Published` != 0
    LIMIT 1;';

    $result = $db->query($sql);
    
    
    /**
     * check, if entry exists
     */
    
    if($result->num_rows === 1)
    {
        $data = $result->fetch_assoc();

        /**
         * check, if file exists
         */
        
        if(is_file($data['File']))
        {
            header('Content-Description: File Transfer'); 
            header('Content-Type: ' . $data['ContentType']);
            header('Content-Transfer-Encoding: binary');
            header('Content-Length:' . filesize($data['File']));
            header('Content-Disposition: attachment; filename=' . $data['Filename']);
            
            readfile($data['File']);
        }
        else 
        {
            echo 'file not found.';
        }
    }
    else 
    {
        echo 'file not found.';
    }
}