• Hi

    A client of ours is using the User Access Manager plugin on their corporate site and so far it has been fantastic. However, I have noticed a problem with linked documents where instead of ‘yourdomain.com/wp-content/uploads/something.whatever’ the URL is changed to ‘yourdomain.com?getfile=123’. I understand that this is done in order to apply an HTACCESS restriction to the file request so that unauthorised users may not download the file. However, I believe this requires the PHP fopen() function to do its job, which in turn requires safe mode to be turned off. Unfortunately, we cannot disable safe mode on our servers for security reasons and so clicking on a link which passes a ‘getfile’ query string fails to retrieve the file.

    I was wondering if any PHP gurus know of an alternate way of implementing this functionality so that the files are still restricted by HTACCESS but do not require safe mode to be turned off in order to access them?

    Thanks!

    Chris

Viewing 5 replies - 1 through 5 (of 5 total)
  • Have you try setting “Download type” to “Normal”? If this don’t work I will see what I can do and will lock for a different way.

    Thread Starter chris27

    (@chris27)

    Hi Alex

    Thanks for your reply. I’ve set download type to “Normal” but this hasn’t worked. However, I now think that perhaps my original diagnosis was wrong as the code seems to be dying at:

    if(file_exists($file))
    	{
    		$len = filesize($file);
    		header('content-type: '.$cur_post->post_mime_type);
    		header('content-length: '.$len);
    
    		if(wp_attachment_is_image($cur_id))
    		{
    			readfile($file);
    			exit;
    		}
    		else
    		{
    			header('content-disposition: attachment; filename='.basename($file));
    			if($uamOptions['download_type'] == 'fopen')
    			{
    				$fp=fopen($file, 'rb');
    
    				while ( ! feof($fp) )
    				{
    					set_time_limit(30);
    					$buffer = fread($fp, 1024);
    					echo $buffer;
    				}
    				exit;
    			}
    			else
    			{
    				readfile($file);
    				exit;
    			}
    		}
     	}
     	else
     	{
    		echo 'Error: File not found';
    	}

    It is always returing “Error: File not found”. I’m debugging the code now to see what else it may be – the only thing I’ve noticed is that the $filename seems to have lost its file extension, maybe that’s why it never passes the “file_exists” statement?

    Regards

    Chris

    Thread Starter chris27

    (@chris27)

    OK, an update:

    The file_exists() function can not be reliably used with HTTP requests, it is intended for direct filepaths only (ie. C:/Program Files/something.txt). I changed if(file_exists($file)) to if(url_exists($file)) and added this function declaration:

    function url_exists($url){
            $url = str_replace("https://", "", $url);
            if (strstr($url, "/")) {
                $url = explode("/", $url, 2);
                $url[1] = "/".$url[1];
            } else {
                $url = array($url, "/");
            }
    
            $fh = fsockopen($url[0], 80);
            if ($fh) {
                fputs($fh,"GET ".$url[1]." HTTP/1.1\nHost:".$url[0]."\n\n");
                if (fread($fh, 22) == "HTTP/1.1 404 Not Found") { return FALSE; }
                else { return TRUE;    }
    
            } else { return FALSE;}
        }

    Now I can get past the “File not found” error, as it prompts me to download the file, however it is still missing its file extension and so will not download correctly. Have you noticed any problems with the file extension being stripped at any point in the code?

    Cheers

    Chris

    Can you please try this:

    Replace (ca. line 3200)

    $file = str_replace($cur_url[0], "", $cur_post->guid);

    with

    $file = str_replace($cur_url[0], "", wp_get_attachment_url($cur_id));

    This could be work. If it works for you I will fix it at the next release.

    Thread Starter chris27

    (@chris27)

    Hi Alex

    Thanks for this. I’m so sorry to give you the runaround – I just realised that half of the files my clients have uploaded to the site don’t even have file extensions in the first place! I don’t think this has anything to do with the plugin and so the original line of code ($file = str_replace($cur_url[0], "", $cur_post->guid);) works no problem.

    Now I’ve almost got it working – the only problem that remains is that neither the fopen() or readfile() functions are allowed on the production server we use for PHP! I’m trying to find a workaround and will let you know if I do but don’t stress, the plugin all seems to be working great now.

    Cheers

    Chris

Viewing 5 replies - 1 through 5 (of 5 total)
  • The topic ‘[Plugin: User Access Manager] PHP getfile() not retrieving documents’ is closed to new replies.