For security issue, I choose post method to download file whicn in linux server. I know using a href=.... filename is a simple method to download file. But hacker can find the file postion.
Here is my html code:
<div ><b class='filename'>1.jpg</b><span class='dwlimg' rel='1.jpg'>downloadFile</span></div>
Here is my js code:
$(document).on('click',".dwlimg",function(){
var pic = $(this).attr("rel");
$.post("action.php?act=dwlimg",{imagename:pic},function(msg){
if(msg==1){
}else{
alert(msg);
}
});
});
Here is my action.php code:
if($action=='dwlimg')
{
$file_name = $_POST['imagename'];
$file_dir = "files/";
if (! file_exists ( $file_dir . $file_name ))
{
echo "file is not exist";
exit ();
}
else
{
$file = fopen ( $file_dir . $file_name, "r" );
Header ( "Content-type: application/octet-stream" );
Header ( "Accept-Ranges: bytes" );
Header ( "Accept-Length: " . filesize ( $file_dir . $file_name ) );
Header ( "Content-Disposition: attachment; filename=" . $file_name );
echo fread( $file, filesize( $file_dir . $file_name ));
fclose ( $file );
exit ();
}
}
I know $.post function(msg) is wrong, but i don't know how to fix it. When downloadFile is clicked, there is nothing appears in my website.
So who can help me ?