Yikes ... this is an INSANELY INSECURE script.  No error checking
whatsoever, it seems to work just fine and that's trouble; essentially
you can pass any filename you want to this and it will send it back to
you ... I used /etc/passwd to illustrate; presto, your server's password
file was sent back to me.

Remove the script from your server until you can tighten it up.

On Wed, Feb 09, 2005 at 10:17:24PM -0600, David Kendall wrote:
> Although while it comes to HTML, I at least like to think of my self 
> as "intermediate" (probably somewhere between "intermediate" and 
> "advanced"), when it comes to PHP programming, I am a complete 
> novice.  Thanks to the advice of a few here on the board 
> (especially Jens!) I have tried downloading a few PHP scripts and 
> tinkering with them to try to make them work.  I think I've gotten 
> pretty far (especially for someone who a week ago hasn't written 
> one single line of PHP), but I am looking for help from the list to get 
> "over the hump"
> 
> I copied two PHP scripts for downloading media files, and set up a 
> test page to link to them ( http://david.national-
> anthems.net/test/index.html )  Clicking on the top one in Firefox 
> brings me to the 404 page for the site (yes, that's the 404 page, I 
> am not the site maintainer, I only lease space from it), and in IE 
> plays the file instead of downloads it.  The bottom one just brings a 
> blank screen for both Firefox and IE.  The intended result is to 
> bring up a dialogue box to download the file, like I mentioned in an 
> earlier post on how it's done at bravenet.com.
> 
> The code is more or less what was found on the net (the first one at 
> http://elouai.com/force-download.php , the second at 
> http://de.php.net/header if you want to check the original), but I 
> can't understand why they don't work!  (again, being an utter novice 
> with PHP, it's probably something simple for you PHP gurus out 
> there.)
> 
> Thanks in advance!
>  
> --
> David Kendall - president / chief web designer
> Home Pages Plus! 
> http://www.homepagesplus.com
> david(at)homepagesplus.com
> 
> 

-- 
Hank Marquardt <hank(at)yerpso.net>
GPG Id: 2BB5E60C
Fingerprint: D807 61BC FD18 370A AC1D  3EDF 2BF9 8A2D 2BB5 E60C
*** Web Development: PHP, MySQL/PgSQL - Network Admin: Debian/FreeBSD

• Web Designer Courses
• Off the Shelf Training Courses

HWG hwg-techniques mailing list archives, maintained by Webmasters @ IWA