CODEWITHSUNDEEP
phpfiledownload
3pic
3pic

Reputation: 1219

PHP link/request to download file then delete it immediately

I face a case I never did, and I dont know how to properly do it.

I have a php script which generate files for clients. At the end of the script, I echo the path for them to download the file, simply.

How can I do to provide the file - or the path or any what - for downloading it, and be sure to delete the file once downloaded.

Widely, I'd like to make the file available for one/unique download only. How to ?

EDIT I cannot use headers

Upvotes: 0

Views: 286

Answers (2)

Vegard Larsen
Vegard Larsen

Reputation: 13047

There are a few components to getting this to work. Without knowing which framework you use, I'll use comments as placeholders.

There is no way to do it without using the header function, though.

Here is the source for a file that outlines the process:

<?php
$fileid = $_GET['fileid'];
$key = $_GET['key'];

// find the file in the database, and store it in $file
if ($keyMatches) {
   // it is important for security to only use file paths from the database
   $actualPath = $file->getPathOnDisk();

   $fileInfo = finfo_open(FILEINFO_MIME_TYPE);
   $mime = finfo_file($fileInfo, $actualPath);

   $fp = fopen($actualPath, 'rb');
   header("Content-Type: " . $mime);
   header("Content-Length: " . filesize($actualPath));
   fpassthru($fp);
}
else 
{
   http_response_code(403); // forbidden
}

You'll use this by linking to download.php?fileid=1234&key=foobar, and generating the URL at the same time you generate the key and store it in the database.

For security, you'll keep the files outside of the web root, meaning they cannot be accessed through the web server without going through a script.

fpassthru is reasonably fast, and will not likely have a performance impact.

Upvotes: 1

Laurent Levasseur
Laurent Levasseur

Reputation: 56

You must do a download file gateway, like download.php?id=XXX

Where XXX is the unique ID of each file you will store in DB. And of course, the file to be downloaded. Then, each time a user will visit the page, you can : - Check if he has already downloaded the file - If no, redirect it to the real path of file - If yes, display 403 message.

When a user download a file, update the DB, generate or copy the file to a new name, you play with headers, and delete file upon download or after a small timeout.

Upvotes: 0

Related Questions