是否可以从提交中获取实际的链接文件？

Question

For example, I use this form submit to download a file.

if(!isset($hasError) {
  //some code here.
$file_url = "http://example.com/files/download/file.pdf";
header("Expires: 0");
                  header("Cache-Control: no-cache, no-store, must-revalidate"); 
                  header('Cache-Control: pre-check=0, post-check=0, max-age=0', false); 
                  header("Pragma: no-cache");   
                  header("Content-type: {$content_type}");
                  header("Content-Disposition:attachment; filename={$file_new_name}");
                  header("Content-Type: application/force-download");
                  flush();
                  readfile("{$file_url}");
                  exit();
}

With the submit form above, it will return downloadable file to save. As I see on Chrome (Ctrl + J), the download link is not displayed. It shows only form link with action. But is possible for visitor to know the actual link like this: "http://example.com/files/download/file.pdf".

If they can find that link, any solution to prevent this?

Thank you so much.

Answer 1

You can add .htaccess with Deny from all in files/download/ to forbid direct access (= HTTP request) but with readfile you will can read the file.

---

NB : You need to use readfile function and stream your request (for big file) like that : https://www.media-division.com/the-right-way-to-handle-file-downloads-in-php/ & https://www.media-division.com/php-download-script-with-resume-option/