Php, error with readfile, downloaded files do not open - php

Question

I am using the following code to download files that are stored outside of the public folder.
$mime_type = mime_content_type("{$_GET['file']}");
define("IMG_LOC","/var/www/domain.com/upload/");
$filename = $_GET['file'];
header('Content-Description: File Transfer');
header('Content-Type: '.$mime_type);
header('Content-Disposition: attachment; filename='.basename(IMG_LOC.$filename));
header('Expires: 0');
header('Cache-Control: must-revalidate');
header('Pragma: public');
header('Content-Length: ' . filesize($filename));
readfile($filename);
exit;
The problem is, file downloaded using this script is not usable. Excel is opening empty, powerpoint tells "there is an error reading" and word tells its missing a converter. Whereas, if I download the same files using ftp and open them manually, the files open properly, showing that the files are not corrupt.
For info, this is getting called from another page as : file.php?file='. $filename
Any help will be welcome. Thanks for your time.

Answer 1

You seem to be missing the path to your file:
header('Content-Length: ' . filesize(IMG_LOC . $filename));
readfile(IMG_LOC . $filename);
You should also add validation for the filename to avoid security problems.
If you still have a problem, you should also check the exact output of the script, perhaps there are php warnings or messages before your file.

Answer 2

I'm deducing that $filename is not the absolute path to the file you're seeking and hence why you define the IMG_LOC constant with a path. It's clear from there that filesize($filename)and readfile($filename) will not likely give you what you want.
Try concatenating the constant before the $filename variable like so...
header('Content-Length: ' . filesize(IMG_LOC . $filename));
readfile(IMG_LOC . $filename);
Also, consider that this code is susceptible to header-injection attacks as well as other security issues such as the user supplying you with a filename on your server that you may not want them to see. For example if I call your script with the query string ?file=yourscript.php I will be able to download your actual PHP code and potentially see any sensitive information you might not want exposed like your database password, or worse.
Also, mime_content_type is a deprecated function and should be replaced with the Fileinfo extension instead.

Answer 3

You script has various issues which all in all will prevent it from properly working. I roughly go through the lines and leave some comments, write a little summary then and offer another code-example with the comments incorporated:
$mime_type = mime_content_type("{$_GET['file']}");
You don't need to wrap the $_GET superglobal in curly brackets and then into double quotes. It's just not necessary for that parameter. You seem to be distracted at this point.
Anyway, this mime-type thing isn't necessary as the mime-type is not interesting if you want to offer the download. You take application/octet-stream instead and you can take care later on for a more specific mime-type:
$mime_type = "application/octet-stream";
Then at the wrong position you define the IMG_LOC constant:
define("IMG_LOC", "/var/www/domain.com/upload/");
This belongs at the very top of the script instead as you define the configuration by that.
In the line:
$filename = $_GET['file'];
you don't do any further error checking this opens up your script to directory traversal and path injection attacks which actually turns the script as you have it into a backdoor. Any file the script has access to on that server can be downloaded.
The next two lines are more or less correct then:
header('Content-Description: File Transfer');
header('Content-Type: '.$mime_type);
For the next header:
header('Content-Disposition: attachment; filename='.basename(IMG_LOC.$filename));
I would extract the basename earlier and just pass a variable here. Same for the content-length header later:
header('Content-Length: ' . filesize($filename));
Then you have this block of caching headers, as you serve the file from disk I don't think those are actually necessary, so I would remove them:
header('Expires: 0');
header('Cache-Control: must-revalidate');
header('Pragma: public');
The readfile line seems ok, you could do some error checking however:
readfile($filename);
And the last line I don't understand, as the script is at the end anyway, why exit?
exit;
My suggestions after this little review:
Gather the information which files should be served and how they must be named. Gathering such information will allow you to close the directory traversal issue which you have to close first.
Second putting the logic part above the output (and the configuration above the logic) should allow you to order the script in a more useful manner allowing you to handle issues with the mime-type for example easier when you maintain the script (or the caching if it is really an issue).
<?php
/**
* download a file
*
* parameter:
*
* file - name of the relative to upload folder
*/
const IMG_LOC = "/var/www/domain.com/upload";
// validate filename input
if (!isset($_GET['file'])) {
return;
}
$filename = $_GET['file'];
$path = realpath(IMG_LOC . '/' . $filename);
if (0 !== strpos($path, IMG_LOC)) {
return;
}
if (!is_readable($filename)) {
return;
}
// obtain data
$basename = basename($filename);
$mime_type = "application/octet-stream"; # can be improved later
$size = filesize($path);
// output
header('Content-Description: File Transfer');
header('Content-Type: ' . $mime_type);
header('Content-Disposition: attachment; filename=' . $basename);
header('Content-Length: ' . $size);
readfile($filename);