0

For security issue, I choose post method to download file whicn in linux server. I know using a href=.... filename is a simple method to download file. But hacker can find the file postion.

Here is my html code:

 <div ><b class='filename'>1.jpg</b><span class='dwlimg' rel='1.jpg'>downloadFile</span></div>  

Here is my js code:

$(document).on('click',".dwlimg",function(){
    var pic = $(this).attr("rel");
    $.post("action.php?act=dwlimg",{imagename:pic},function(msg){
        if(msg==1){

        }else{
            alert(msg);
        }
    });
});

Here is my action.php code:

if($action=='dwlimg')
{   
  $file_name = $_POST['imagename'];  
  $file_dir = "files/";      
  if (! file_exists ( $file_dir . $file_name ))
  {    
    echo "file is not exist";    
    exit ();    
  }
  else 
  {    
    $file = fopen ( $file_dir . $file_name, "r" );            
    Header ( "Content-type: application/octet-stream" );    
    Header ( "Accept-Ranges: bytes" );    
    Header ( "Accept-Length: " . filesize ( $file_dir . $file_name ) );    
    Header ( "Content-Disposition: attachment; filename=" . $file_name );    

    echo fread( $file, filesize( $file_dir . $file_name ));    
    fclose ( $file );    
    exit ();    
  }    
 }

I know $.post function(msg) is wrong, but i don't know how to fix it. When downloadFile is clicked, there is nothing appears in my website.

So who can help me ?

Snow
  • 71
  • 1
  • 11

0 Answers0