PHP:强制下载 header 不会显示总大小和速度

Question

每当我使用此脚本下载文件时，下载时看不到总大小和速度...我想让它看起来更像“直接下载链接”。该脚本的目的是隐藏直接下载链接，限制直接下载和其他下载行为，如僵尸程序。想想 mediafire、rapidshare、megaupload 等。

我们现在的脚本可以运行，但不会像您从普通下载链接下载时那样显示，我将发布发生的情况的屏幕截图:

我希望这张截图能有所帮助，因为我已经在互联网上搜索了几个小时，但似乎找不到解决这个问题的方法:(。

if (isset($_GET['file'])){
   $file = $_GET['file'];
   $path = '/home/user/domains/domain.com/files/upload/';
   $filepath = $path.$file;

   if (file_exists($filepath)){

    set_time_limit(0); // for slow connections

    header('Content-Description: File Transfer');
    header("Content-Disposition: attachment; filename=\"$file\"");
    header('Content-Type: application/octet-stream');
    header('Content-Transfer-Encoding: binary');
    header('Content-Length: ' . filesize($filepath));
    header('Cache-Control: must-revalidate, post-check=0, pre-check=0');
    header('Pragma: public');
    header('Expires: 0');

    readfile($filepath); // send file to client 
   } 
   else{
    header($_SERVER["SERVER_PROTOCOL"]." 404 Not Found", true, 404); 
   }
  }else{
   header($_SERVER["SERVER_PROTOCOL"]." 404 Not Found", true, 404); 
  }

Answer 1

内容是否在服务器级别使用 mod_deflate 或类似的东西压缩？

这里已经回答了这个问题: Sending correct file size with PHP download script

"If you compress files with Zlib, mod_deflate and so on the Content-Length header won't be accurate so you'll end up seeing "Unknown size" and "Unknown time remaining" when downloading files."

"You can easily disable it for a single script using the following line in an applicable .htaccess file:

SetEnvIfNoCase Request_URI ^/download.php no-gzip dont-vary where download.php is here assumed to be in the download script located in the server's root directory path (e.g. www.crimsonbase.com/download.php). (That's because the regular expression is ^/download.php.)"

另外，请注意您的脚本是不安全的。有人可以有效地为 _GET['file'] 发送以下 get 参数

../../../../../Documents/MyStuff

它将完全覆盖您的 $path 限制。

建议删除路径中的任何 .. 引用。