force_download codeigniter

[geewebid]

hi master,
i have problem with my ci web, i use force_download in my controller but why redirect() cannot work, please tell me what my problem.

$filedown = $this->input->post('filedown');
            $datas = file_get_contents(base_url() . "down/" . $filedown); // Read the file's contents
            $name = "$filedown";

            force_download($name, $datas);

i have error, if i has wrong path file_get_content(path), can you tell me what my problem.

thank for your help

[cereal]

Hi,
If the directory down/ is not directly accessible by web use $this->input->server('DOCUMENT_ROOT') instead of base_url().

Also, use file_exists() to be sure about the requested file and pathinfo() to grab the filename from $this->input->post('filedown'), otherwise a user can execute ../../../random_file:

$filedown = pathinfo($this->input->post('filedown'),PATHINFO_BASENAME);
$datas = $this->input->server('DOCUMENT_ROOT').'/down/'.$filedown;
if(file_exists($datas))
{
    force_download($filedown, $datas);
}
else
{
    // error action
}

• http://php.net/manual/en/function.file-exists.php
• http://php.net/manual/en/function.pathinfo.php

[Dani]

Wow, you learn something new every day. I didn't know about force_download(). I was manually setting http headers and such for post attachments on DaniWeb that can't be viewed through a browser (Word documents, etc.)

[cereal]

Yup, it works fine. It's loaded by the download_helper.php in system/core/helpers.

A tip: when using $config['compress_output'] = TRUE add @ob_end_clean() above of force_download(). Otherwise, in some cases, it returns corrupted files.

[Dani]

Thanks for the tip. I don't do that because I let Apache GZIP my stuff up.