@jpadie: the problem with your script, is that users can bookmark/publish the url and then suddenly google has indexed the download-page.<?
session_start();
if(!isset($_SESSION['canDownload'])) $_SESSION['canDownload'] = false;
$filesAvailableForDownload =
array(
array(
"filename"=>"somefile.doc",
"description"=>"a decent description of the file"
),
array(
"filename"=>"someotherfile.doc",
"description"=>"an equally good description"
)
);
$validEmails=array();
if (isset($_GET['action']) && $_GET['action'] == "download"):
if (canDownload()):
$err = serveFile();
if (!$err):
die ("there has been a problem");
endif;
else:
header("Location=".$_SERVER['PHP_SELF']);
exit;
endif;
endif;
$msg = validateForm();
if($msg === true):
writeaddressestolist();
setSessionUID();
showDownloadLinks();
exit;
else:
displayForm($msg);
exit;
endif;
function displayForm($msg=""){
$email =array("","","","","","");
if (isset($_POST['email'])) $email=$_POST['email'];
$form = "<form action=\"{$_SERVER['PHP_SELF']}\" method=\"post\">\r\n";
if (!isset($_SESSION['uid'])) setSessionUID();
for ($i=1; $i<=5; $i++):
$form .= <<<EOL
Email Address $i <input type="text" name="email[]" value="{$email[$i-1]}" /><br/>
EOL;
endfor;
$form .= "<input type=\"hidden\" name=\"uid\" value=\"".$_SESSION['uid']."\" />";
$form .= "<input type=\"submit\" name=\"submit\" value=\"upload\"/>\r\n</form>";
echo $msg;
echo $form;
}
function alreadyPosted(){
if (!isset($_POST['uid'])) return true;
if (!isset($_SESSION['uid'])) return true;
if ($_POST['uid'] === $_SESSION['uid']):
return false;
else:
return true;
endif;
}
function setSessionUID(){
$_SESSION['uid'] = uniqid("uid_", true);
}
function validateForm(){
$msg = "";
global $validEmails;
if (!isset($_POST['email'])) return "";
if (alreadyPosted()):
setSessionUID();
unset($_POST);
return "You have already posted this form or there has been an error. You may not submit the same data twice";
endif;
foreach($_POST['email'] as $key=>$email):
if (empty($email)):
$msg .= "You have not filled in Email Address ". ($key + 1) ."<br/>";
elseif(!isValidEmail($email)):
$msg .= "Email Address " . ($key + 1) . " is invalid<br/>";
elseif(in_array($email, $validEmails)):
$msg .= "Email Address " . ($key + 1) . " is a duplicate of an email you have already included<br/>";
else:
$validEmails[] = $email;
endif;
endforeach;
if(empty($msg)):
return true;
else:
return $msg;
endif;
}
function writeAddressesToList(){
global $validEmails;
$list = "list.txt";
$fh = fopen($list, "a+");
$emails = implode("\r\n", $validEmails);
fwrite($fh, $emails);
fclose($fh);
}
function isValidEmail($email){
//this function is taken from the php manual, user notes.
$p = '/^[a-z0-9!#$%&*+-=?^_`{|}~]+(\.[a-z0-9!#$%&*+-=?^_`{|}~]+)*';
$p.= '@([-a-z0-9]+\.)+([a-z]{2,3}';
$p.= '|info|arpa|aero|coop|name|museum)$/ix';
return preg_match($p, $email);
}
function showDownloadLinks(){
global $filesAvailableForDownload;
foreach ($filesAvailableForDownload as $file):
echo "<a href=".$_SERVER['PHP_SELF']."?action=download&file=".$file['filename'].">".$file['description']."</a><br/>";
endforeach;
$_SESSION['canDownload'] = true;
}
function canDownload(){
if ($_SESSION['canDownload'] === true):
return true;
else:
return false;
endif;
}
function serveFile(){
global $filesAvailableForDownload;
$path = "./";
if (!isset($_GET['file'])) return false;
$test=false;
foreach($filesAvailableForDownload as $file):
if (in_array($GET['file'], $file)):
$test=true;
break(0);
endif;
endforeach;
if ($test === true) return false;
header('Content-type: application/octet-stream');
header('Content-Disposition: attachment; filename="'.$_GET['file'].'"');
header('Content-Length: ' . filesize($path.$filename));
readfile($path.$filename) or die("cannot open file");
$_SESSION['canDownload'] = false;
return true;
}
?><?php
// connect to the database
mysql_connect ('host', 'user', 'password');
// select database
mysql_select_db ("database");
if (isset($lid)) {
/*
This is a function that corresponds the id to a filename. You
may get the filename from the db or whatever..
*/
$filename = getFilenameFromID($lid, $user);
// let's strip the filename, to get a real name without path
$fnam = substr($filename, (strrpos($filename, "/") + 1), strlen($filename));
$furl = substr($filename, 0, (strrpos($filename, "/") + 1)); // returns real filename
// now set the right headers...
header("Content-type: application/octet-stream");
header("Content-Disposition: attachment; filename=$fnam");
header("Content-Location:$furl" );
header("Content-Transfer-Encoding: binary");
if (is_file($furl. $fnam)) {
$handle = fopen($furl . $fnam, "rb");
$content = fread($handle, filesize($furl . $fnam));
fclose($handle);
}
else {
if ($fnam == "404.txt") {
$content = "Download no longer active, please request new download.";
}
else {
$content = "Missing or corrupt file, please let us know which file you tried to download";
}
}
// now print the file..
print $content;
exit();
}
session_start();
if (isset($_POST['from_name'])) {
$_SESSION['from_name'] = $from_name;
}
if (isset($_POST['from_company'])) {
$_SESSION['from_company'] = $from_company;
}
if (isset($_POST['from_phone'])) {
$_SESSION['from_phone'] = $from_phone;
}
if (isset($_POST['from_email'])) {
$_SESSION['from_email'] = $from_email;
}
function getFilenameFromID($file_id, $from)
{
// kjør query mot db, WHERE id = '$file_id'
$result = mysql_query("SELECT * from tbl_attatchment, tbl_downloads WHERE
att_lid = d_id_f_id AND d_by_email = '" . $from . "' AND
d_active = 1 AND att_lid = '$file_id'");
if (mysql_num_rows($result) == 1) {
while($row = mysql_fetch_array($result)) {
$f = $row['att_url'];
}
}
else {
$f = "/404.txt";
}
$resupdt = mysql_query("UPDATE `tbl_downloads` SET `d_dt` = NOW( '20050820135738' ) ,
`d_active` = '0' WHERE `d_id_f_id` = '$file_id' AND
d_by_email = '" . $from . "' AND d_active='1' LIMIT 1");
return $f;
}
if ($rf != "") {
$_POST['key'] = $_SESSION['key'];
if( $_POST['action'] == "Send") {
$res = mysql_query("SELECT * FROM `tbl_downloads` WHERE d_by_email = '". $_SESSION['from_email'] . "'
AND d_active = '1' AND `d_id_f_id` = '". $rf . "'");
if (mysql_num_rows($res) < 1) {
$results = mysql_query("INSERT INTO `tbl_downloads` ( `d_id` , `d_id_f_id` , `d_dt` , `d_by_name` , `d_by_phone` , `d_by_company_name` , `d_by_email` , `d_active` )
VALUES (
'', '" . $rf ."', NOW( ) , '" . $_SESSION['from_name'] . "', '" . $_SESSION['from_phone'] . "', '" . $_SESSION['from_company'] . "', '" . $_SESSION['from_email'] . "', '1');") OR DIE ("foo");
// send mail with link
$toname = $_SESSION['from_name'];
$toadress = $_SESSION['from_email'];
$subject = "YourCompanyName - Requested Download Link";
$message = "Hi, " . $_SESSION['from_name'] .
" / " . $_SESSION['from_company'] .
"\n\nThe file you requested for download, can be accessed here: " .
"\n[URL unfurl="true"]http://www.yourdomain.tld/downloads/?lid="[/URL] . $rf . "&user=" . $_SESSION['from_email'] .
"\n\n The download url can only be used once.";
mail($_SESSION['from_email'], $subject, $message);
}
$rf = "";
$_POST['key'] = $_SESSION['key'];
}
}
?>
<?php
echo $_SESSION['fubar'];
if (isset($submit)) {
if ($submit == "logout") {
unset($_SESSION['key']);
}
}
if ($_SESSION['key'] != $_POST['key'] || (!($_SESSION['key']))) {
$_SESSION['key'] = substr(md5(time()), 0, 6);
echo "<p>To access our contact-form, enter the security-code as seen below:</p>
<form action=\"\" method=\"post\">
<p>
<strong>Security-Code:</strong><br />
<img src=\"/sec.jpg\" />
</p>
<p>
<strong>Type Security-Code, as seen above:</strong><br />
<input type=\"text\" name=\"key\" />
<input type=\"submit\" name=\"submit\" value=\"submit\" />
</p>
</form>";
exit();
}
else {
if ($from_email != "" && $enquery != "" || !isset($rf) || $rf == "") {
// session_destroy();
if (isset($from_name)) {
$_SESSION['from_name'] = $from_name;
}
if (isset($from_company)) {
$_SESSION['from_company'] = $from_company;
}
if (isset($from_phone)) {
$_SESSION['from_phone'] = $from_phone;
}
if (isset($from_email)) {
$_SESSION['from_email'] = $from_email;
}
$_POST['key'] = $_SESSION['key'];
$toname = "yourCompanyName";
$toadress = "reply.Adress@yourdomain.tld";
$subject = "YourCompanyName - Feedback form";
$message = "Name: " . $from_name .
"\nCompany: " . $from_company .
"\nPhone: " . $from_phone .
"\nEmail: " . $from_email .
"\n\n\n" . $enquery;
/*if (mail($toadress, $subject, $message)) {
echo "Thank you for your enquery!<br />We will get back to your shortly.";
}
else {
echo "Oops! Something went wrong!";
}*/
// start download
$result = mysql_query("SELECT * from tbl_attatchment
ORDER BY att_title ASC") or die (mysql_error());
while($row = mysql_fetch_array($result)) {
// let's strip the filename, to get a real name without path
$fnam = substr($filename, (strrpos($filename, "/") + 1), strlen($filename));
$furl = substr($filename, 0, (strrpos($filename, "/") + 1)); // returns real filename
echo $furl . $fnam;
?>
<p>
<strong>Title: </strong><?=$row['att_title'] ?><br />
<strong>Description: </strong> <?=$row['att_description'] ?><br />
<a href="?rf=<?=$row['att_lid'] ?>">Request File</a></td>
</p>
<?
}
?>
</table>
<?php
// end download
}
if ($rf != "") { // show form
$_POST['key'] = $_SESSION['key'];
?>
<strong>Information:</strong>
After requesting file-download, please look in your mail inbox.<br />
You will recieve an e-mail with a download URL.
<form action="?" method="post">
<table border="1">
<tr><td>
<p>
Your name:<br />
<input type="text" name="from_name" value="<?=$_SESSION['from_name']?>" />
</p>
<p>
Company Name:<br />
<input type="text" name="from_company" value="<?=$_SESSION['from_company']?>" />
</p>
<p>
Phone#:<br />
<input type="text" name="from_phone" value="<?=$_SESSION['from_phone']?>" />
</p>
<p>
<strong>Your e-mail adress*:</strong><br />
<input type="text" name="from_email" value="<?=$_SESSION['from_email']?>" />
<input type="hidden" name="rf" value="<?=$rf?>" />
</p>
</td>
<td></td>
</tr>
<tr>
<td colspan="2">
<p>
<strong>Comments / Questions*:</strong><br />
<textarea name="enquery" cols="45" rows="10"><?=$enquery?></textarea><br />
<strong>* Required fields</strong>
</p>
<input type="hidden" name="key" value="<?=$key?>" />
<input type="submit" name="action" value="Send" />
<input type="reset" value="Clear" />
</td>
</tr>
</table>
</form>
<?php
}
}
?><?php
require("path_to/login.php");
// connect to the database
mysql_connect ('host', 'username', 'password');
// select database
mysql_select_db ("database");
// ####################################
// start download
$result = mysql_query("SELECT * from tbl_attatchment") or die (mysql_error());
while($row = mysql_fetch_array($result)) {
$dbfiles .= " " . $row['att_url'];
}
$dbfiles = explode(" ", ltrim($dbfiles));
// ####################################
if (isset($_POST['insert'])) {
$result = mysql_query("INSERT INTO `tbl_attatchment`
(`att_lid` , `att_title` , `att_description` ,
`att_text` , `att_url` , `att_type_id_id_type` )
VALUES ('', '" . $_POST['title'] . "', '" . $_POST['description'] . "',
'', '" . $_POST['file'] . "', '0');") OR DIE ("foo");
header("HTTP/1.1 301 Moved Permanently");
header("location: upload.php");
header("Connection: close");
}
$dir = "pub/download/";
// Open a known directory, and proceed to read its contents
if (is_dir($dir)) {
if ($dh = opendir($dir)) {
while (($file = readdir($dh)) !== false) {
if ($file != ".." && $file != ".") {
$hdfiles .= " $dir$file";
//echo "filename: $dir$file\n<br />";
}
//echo mysql_num_rows($result);
}
closedir($dh);
}
}
$hdfiles = explode(" ", ltrim($hdfiles));
$result = array_diff($hdfiles, $dbfiles);
if (count($result) > 0) {
for ($i = 0; $i < count($result); $i++) {
if ($i == 0) {
$foo = current($result);
echo "<form action=\"\" method=\"post\">
File: <a href=\"$foo\" target=\"_blank\">$foo</a><br />
Title: <input type=\"text\" name=\"title\" /><br />
Description: <br /><textarea name=\"description\" rows=\"5\" cols=\"30\" /></textarea><br />
<input type=\"hidden\" name=\"file\" value=\"{$foo}\" />
<input type=\"submit\" name=\"insert\" value=\"Insert\" />
<hr /></form>";
}
else {
$foo = next($result);
echo "<form action=\"\" method=\"post\">
File: <a href=\"$foo\" target=\"_blank\">$foo</a><br />
Title: <input type=\"text\" name=\"title\" /><br />
Description: <br /><textarea name=\"description\" rows=\"5\" cols=\"30\" /></textarea><br />
<input type=\"hidden\" name=\"file\" value=\"{$foo}\" />
<input type=\"submit\" name=\"insert\" value=\"Insert\" />
<hr /></form>";
}
}
}
?><?php
session_start();
if ($_SESSION['key']) {
header("Content-type: image/png");
$string = $_SESSION['key'];
$im = imagecreatefrompng("images/bg.png");
$white = $white = imagecolorallocate($im, 192, 255, 0);
$px = (imagesx($im) - 7.5 * strlen($string)) / 2;
$h = (imagesy($im) - 7.5) / 2;
imagestring($im, 4, $px, $h, $string, $white);
imagepng($im);
imagedestroy($im);
}
?>