0

I have a site with my hiking-tours: https://pknudsen.net/gps/gpxviewer.php?gpstur=777 The routes are shown on a Google map. Google requires filetype "xml". I want to make a download-function so the users can get the tours to their gps. It requiers "gpx" file types. The download code is:

function myFunction($navn) {
    $path = $navn;
    $mm_type="application/octet-stream";
    header("Pragma: public");
    header("Expires: 0");
    header("Cache-Control: must-revalidate, post-check=0, pre-check=0");
    header("Cache-Control: public");
    header("Content-Description: File Transfer");
    header("Content-Type: " . $mm_type);
    header("Content-Length: " .(string)(filesize($path)) );
    header('Content-Disposition: attachment; filename="'.basename($path).'"');
    header("Content-Transfer-Encoding: binary\n");

    readfile($path); // outputs the content of the file
    exit();
}

if (isset($_GET['name'])) {
    $navn = $_GET['name'];
    myFunction($navn);
}

How do i change the extension to "gpx"? I don't want to write the gpx-file on my server. Just to the user.

RiggsFolly
  • 93,638
  • 21
  • 103
  • 149
pknudsen
  • 7
  • 4
  • 1
    You can call the download file what ever you want. Just change it in `filename="'.basename($path).'"`. However, your application is wide open for [path traversal attacks](https://owasp.org/www-community/attacks/Path_Traversal). Basically, anyone can download what ever file they want (as long as the web server has read access to it) by passing the absolute path in the `name`-parameter. Read up on how to [protect yourself](https://stackoverflow.com/questions/4205141/preventing-directory-traversal-in-php-but-allowing-paths) from those kind of attacks. – M. Eriksson Oct 11 '21 at 15:00
  • The proctection may i create later. But now my question is: I have xml-file to download. How do I change it so the user get is as a gpx-file.? It can be done just width a rename, but i want to make a download to the user, and he need to get the gpx-file. – pknudsen Oct 11 '21 at 18:02
  • Your question is unclear. If the format of the file is correct, then the name is all you need to change. If the format is incorrect, then you need to reformat the file, but we can't possibly tell you how to do that since we have _no idea_ what your current file looks like. Please edit your question to give us more specifics about your actual issue. – M. Eriksson Oct 11 '21 at 20:17
  • It is just the filename that should be changed (fileextension). The format is correct. The file must not be changed on my own server, just the downloaded file. The file have to be a gpx-file because it is need to tour-apps. – pknudsen Oct 12 '21 at 19:38
  • So change the name in the header as I mentioned in my first comment: `header('Content-Disposition: attachment; filename="what-ever-you-want.gpx"');` That is what decides what the downloaded filename will be and it won't change anything on your server. – M. Eriksson Oct 12 '21 at 21:17
  • Thank you, Now i hope you will help me with the correct syntax: header('Content-Disposition: attachment; filename=$path ".".gpx'); -does not work – pknudsen Oct 14 '21 at 18:55
  • `header('Content-Disposition: attachment; filename="' . $path . '.gpx"');` https://www.php.net/manual/en/language.types.string.php – M. Eriksson Oct 14 '21 at 19:13

0 Answers0