What is the potential issue with the PHP code provided for downloading files from a website?

The potential issue with the PHP code provided for downloading files from a website is that it is vulnerable to directory traversal attacks. This means that an attacker could potentially access and download sensitive files outside of the intended directory. To solve this issue, it is important to sanitize user input and validate the file path before allowing the download to occur. 

<?php
$filename = isset($_GET['filename']) ? $_GET['filename'] : null;

if ($filename) {
    $file_path = '/path/to/files/' . basename($filename);
    
    if (file_exists($file_path)) {
        header('Content-Type: application/octet-stream');
        header('Content-Disposition: attachment; filename="' . basename($file_path) . '"');
        readfile($file_path);
        exit;
    } else {
        echo 'File not found.';
    }
} else {
    echo 'Invalid file request.';
}
?>

Keywords

file_get_contents fopen download HTTP headers content-length

Related Questions