How to protect php files and download file links - php

Question

I am using below codes to protect direct download links of zip files
<?php
$filename = $_GET["id"];
$path = "directory/{$filename}.zip";
$mm_type="application/octet-stream";
header("Pragma: public");
header("Expires: 0");
header("Cache-Control: must-revalidate, post-check=0, pre-check=0");
header("Cache-Control: public");
header("Content-Description: File Transfer");
header("Content-Type: " . $mm_type);
header("Content-Length: " .(string)(filesize($path)) );
header('Content-Disposition: attachment; filename="'.basename($path).'"');
header("Content-Transfer-Encoding: binary\n");
readfile($path);
exit();
?>
Is the code enough to protect direct download links. I dont want link to be visible via IDM or other download manager.
Now if I dont enter id while calling above php code or enter wring code, server sends php file with some errors stating specified file not found. But that file uncovers the actual location of the file. How to protect php files in such case. Is there anything I can do in htaccess file?
I am newbie in php.
Thanks

Answer 1

best I think if you move the directory out from the apache document root (if you can)
or you can disable the directory with .htaccess too in the directory/.htaccess
deny from all
like here: deny direct access to a folder and file by htaccess
if you would like to hide error messages, you can use error_reporting(0) in you php (or the # sign before a function)
or just check the file with file_exists(...)
but first you have to parse your input data for security,
because if you have url like this: ?id=../../filename anyone can download any file from your server
for example you have to remove at least the .. strings from the input:
$filename = str_replace('..', '', $filename);
if you do not this, ant the $_GET['id'] == '../filename.ext', than you $path is going to be 'directory/../filename.ext', and this can be dangerous

Answer 2

I'd suggest modifying your existing code so that once you have built up the file name you check if the file exists, if not serve up a HTTP 404 error.
Here's a rough outline of a change to your code above to work from:
$path = "directory/{$filename}.zip";
if(!file_exists($root . '/' . $path)) {
header('HTTP/1.0 404 Not Found');
echo "<h1>404 Not Found</h1>";
echo "The page that you have requested could not be found.";
exit();
}
You'll note I've added a $root variable in there. This needs to be set with the full path to the document root of your site as the file_exists function needs a full file-system path to work from (not just a relative path).