php: force download from different domains?

Question

hey guys, i wonder if you guys come up with some awesome solutions for my problem. the normal way is not working!

Well, i'm trying to force-download any file on any website with the following php script. I just pass ?p=http://www.whatever.com/images/flowers/rose.jpg to my url and the download prompts.

    <?php
    error_reporting(E_ALL);

    if(isset($_GET['p'])) $path = $_GET['p'];
    else echo "no path set!";

    $file = $path;
    //header('Location:' . $file); //works perfect, opens the file in the browser
    //
    header("Cache-Control: no-cache");
    header("Expires: -1");
    header("Content-Type: application/octet-stream;");
    header("Content-Disposition: attachment; filename=\"" . basename($file) . "\";");
    header("Content-Transfer-Encoding: binary");
    header("Content-Length: " . filesize($file));
    echo readfile($file);
    ?> 

However, as I found out today filesize() just works with local files on my server not with an http request. The same applies to readfile()

Warning: filesize() [function.filesize]: stat failed for pathtofiles…/downloader/d.php on line 15

Warning: readfile(sphotos.ak.fbcdn.net/hphotos-ak-snc4/hs211.snc4/…) [function.readfile]: failed to open stream: HTTP request failed! HTTP/1.0 403 Forbidden in pathtofiles…/downloader/d.php on line 16

i wonder if there are creative coders out there who can help me out here. Is there any chance for me to make that script work? I just want to forcedownload whatever file and url you pass along.

thank you advance, regards matt

Answer 1

You cannot 'force-download' for a file that is NOT under your control (as a remote file). The 'force-download' tells the browser to download the file that is about to be transmitted. Location: some-path tells the browser to look for the new location, thus listening the new location, not your current page.

One option, but not optimal, would be to make a local copy of the file (at your server), then retrieve it to the user. If the file is big enough, this will give the impression of a frozen page. To avoid this, you can read chunks of the remote file, and deliver after each read command.

Be aware, your code does not restrict what $file can download, thus allowing users to download virtually any readable file at the server, this is a security flaw.

Answer 2

filesize() and readfile() can work with some protocols if your PHP settings allow.

The problem at hand is a more fundamental one, though:

HTTP request failed! HTTP/1.0 403 Forbidden in pathtofiles....

remember that when fetching a file using PHP, it does not have the user's login permissions available. The script instaince is acting like an independent browser. If a resource is password protected, you need to make your PHP script log in first.

Answer 3

The best way is to store filesize in your database if you have control over remote files and then use readfile function.

From PHP manual

readfile() You can use a URL as a filename with this function if the fopen wrappers have been enabled.