###############################################################
# File Download 1.3
###############################################################
# Visit [url=http://www.zubrag.com/scripts/]:: Free PHP Scripts[/url] for updates
###############################################################
# Sample call:
# download.php?f=phptutorial.zip
#
# Sample call (browser will try to save with new file name):
# download.php?f=phptutorial.zip&fc=php123tutorial.zip
###############################################################
// Allow direct file download (hotlinking)?
// Empty - allow hotlinking
// If set to nonempty value (Example: example.com) will only allow downloads when referrer contains this text
define('ALLOWED_REFERRER', '');
// Download folder, i.e. folder where you keep all files for download.
// MUST end with slash (i.e. "/" )
define('BASE_DIR','sample/');
// log file name
define('LOG_FILE','downloads.log');
// Allowed extensions list in format 'extension' => 'mime type'
// If myme type is set to empty string then script will try to detect mime type
// itself, which would only work if you have Mimetype or Fileinfo extensions
// installed on server.
$allowed_ext = array (
####################################################################
### DO NOT CHANGE BELOW
####################################################################
// If hotlinking not allowed then make hackers think there are some server problems
if (ALLOWED_REFERRER !== ''
&& (!isset($_SERVER['HTTP_REFERER']) || strpos(strtoupper($_SERVER['HTTP_REFERER']),strtoupper(ALLOWED_REFERRER)) === false)
)
{
die("Internal server error. Please contact system administrator.");
}
// Make sure program execution doesn't time out
// Set maximum script execution time in seconds (0 means no limit)
set_time_limit(0);
if (!isset($_POST['f']) || empty($_POST['f'])) {
die("Please specify file name for download.");
}
// Get real file name.
// Remove any path info to avoid hacking by adding relative path, etc.
$fname = basename($_POST['f']);
// Check if the file exists
// Check in subfolders too
function find_file ($dirname, $fname, &$file_path) {
$dir = opendir($dirname);
while ($file = readdir($dir)) {
if (empty($file_path) && $file != '.' && $file != '..') {
if (is_dir($dirname.'/'.$file)) {
find_file($dirname.'/'.$file, $fname, $file_path);
}
else {
if (file_exists($dirname.'/'.$fname)) {
$file_path = $dirname.'/'.$fname;
return;
}
}
}
}
}
// find_file
// get full file path (including subfolders)
$file_path = '';
find_file(BASE_DIR, $fname, $file_path);
if (!is_file($file_path)) {
die("Album you have selected is currently unavailable..");
}
// file size in bytes
$fsize = filesize($file_path);
// check if allowed extension
if (!array_key_exists($fext, $allowed_ext)) {
die("Not allowed file type.");
}
// get mime type
if ($allowed_ext[$fext] == '') {
$mtype = '';
// mime type is not set, get from server settings
if (function_exists('mime_content_type')) {
$mtype = mime_content_type($file_path);
}
else if (function_exists('finfo_file')) {
$finfo = finfo_open(FILEINFO_MIME); // return mime type
$mtype = finfo_file($finfo, $file_path);
finfo_close($finfo);
}
if ($mtype == '') {
$mtype = "application/force-download";
}
}
else {
// get mime type defined by admin
$mtype = $allowed_ext[$fext];
}
// Browser will try to save file with this filename, regardless original filename.
// You can override it if needed.
if (!isset($_POST['fc']) || empty($_POST['fc'])) {
$asfname = $fname;
}
else {
// remove some bad chars
$asfname = str_replace(array('"',"'",'\\','/'), '', $_POST['fc']);
if ($asfname === '') $asfname = 'NoName';
}
At first sight; other than some spaghetti in the code, I'd imagine the recursive call to: find_file() might be the culprit. The recursion depth of PHP is very shallow and I don't recommend doing recursion on directories. It's ineffiecient and a resource gorilla. A deeply descending & dying recursive loop will bring a server to its knees exhibiting the symptoms you've described.
Darrell
modified: On another note, I'll review it more before giving the thumbs down - maybe there's something else not so obvious. But my general "rule of thumb" regarding recursive directory scans still stands.
Also, if the files are quite large; and I have to assume they are, you'd probably want to use another browser to do other stuff. Also again, if you're pulling the file in while trying to do something else, that might be saturating your local system resources and internet bandwidth. You are trying to move mp3's and/or wma's after all...
echo 'Reached the point where the file names are read';
var_dump($aVariables);
exit();
The echo lets you know what is happening, the var_dump can be used to view the contents of some variables (aVariables is an example), and exit stops the script - so you can assume everything is okay, until you find a point that isn't reached. Then, backtrack until you can see what is wrong.
Linear Mode
