3

Many users of my site have reported problems downloading a large file (80 MB). I am using a forced download using headers. I can provide additional php settings if necessary. I am using the CakePHP framework, but this code is all regular php. I am using php 5.2 with apache on a dedicated virtual server from media temple, CentOS Linux. Do you see any problems with the following code:

        set_time_limit(1500);
        header("Content-Type: application/octet-stream");
        header("Content-Disposition: attachment; filename=\"" . basename($file_path) . "\"");
        header("Content-Length: ".$content_length);
        header("Content-Transfer-Encoding: binary");
        header('Cache-Control: must-revalidate, post-check=0, pre-check=0');
        header('Cache-Control: private', false);
        header('Pragma: public');
        header('Expires: 0');

        //Change this part
        $handle = fopen($file_path, 'rb');
        while (!feof($handle))
        {
            echo fread($handle, 4096);
            ob_flush();
            flush();
        }
        fclose($handle);
        exit;

Basically, the problem being reported is that the download starts and then stops in the middle. I was thinking it was a problem with the time limit, so I add the set_time_limit code. I was using the php readfile function before, but that also did not work smoothly.

11
  • What about set_time_limit(0) ?
    – alex
    Dec 13, 2010 at 1:48
  • What's the point of the loop to output the file, if you don't mind me asking?
    – El Yobo
    Dec 13, 2010 at 1:49
  • @ElYobo My guess so it doesn't consume too much memory at once.
    – alex
    Dec 13, 2010 at 1:51
  • 1
    But something like readfile would avoid putting in to memory at all (unless output buffering is enabled - but that will have the same problem even if you read it chunk by chunk).
    – El Yobo
    Dec 13, 2010 at 2:01
  • 1
    I'd be inclined to avoid using PHP to echo large file data and instead use it to manage the creation/deletion of randomly named symlinks to a "hidden" storage path, Unless you need security of course :)
    – Scuzzy
    Dec 13, 2010 at 2:05

2 Answers 2

4

The problem with PHP-initiated http transfers is that they seldomly support partial requests:

GET /yourfile HTTP/1.1
Range: bytes=31489531-79837582

Whenever a browser encounters a transmission problem, it will try to resume the download. Your php script does not accomodate for that (it's not trivial, so nobody does).

So really avoid that. Redirect users to a static file and let your webserver handle it. If you need to handle authorization, use tricks like symlinks or rewriterules that check for session cookies or even a static permission file (./allowed/178.224.2.55-file-1). Any required extra HTTP headers can be injected likewise, or with a .meta file.

8
  • Interesting idea; do you know of a concrete example of this somewhere?
    – El Yobo
    Dec 13, 2010 at 2:50
  • 1
    @ElYobo: For the .htaccess permission trick a simple RewriteCond -f ./allow-%{REMOTE_ADDR} might suffice. Byte-Range support is in Nanoweb and PEAR HTTP_Server IIRC. But a quick google gives: coneural.org/florian/papers/04_byteserving.php
    – mario
    Dec 13, 2010 at 2:54
  • Cool, thanks. I'd need more security than the RewriteCond example (e.g. multiple users behind a proxy), but the paper is interesting.
    – El Yobo
    Dec 13, 2010 at 2:58
  • @ElYobo: Yes, that's really only workable for the simplest of cases. But it might be possible to use a RewriteCond on %{HTTP_COOKIE} and check against a session-stampfile. But never tried that :]
    – mario
    Dec 13, 2010 at 3:01
  • Do you think it would be the same thing if I just put the static file somewhere that can be read and just limit access by IP address in the .htaccess file for the file's directory? I could probably use PHP to write to a whitelist with Allow from 100.100.100.100 and just keep appending to it.
    – jimiyash
    Dec 13, 2010 at 3:58
1

I don't see any trouble, but for S&G's try placing the set_time_limit inside the while loop. This ensures they don't hit a hard limit and (as long as the client's taking the information) the time-limit gets extended.

4
  • You could just use set_time_limit(0) to impose no time limit.
    – alex
    Dec 13, 2010 at 1:49
  • I tend to find that a band idea, in case an operation hands (for whatever reason). I try to always give PHP an opportunity to cut the tie, otherwise (for whatever reason) something goes wrong and you have a thread just sitting there dormant. Dec 13, 2010 at 1:51
  • how many seconds do you think i should extend by? maybe 5-10?
    – jimiyash
    Dec 13, 2010 at 2:01
  • How long does it take you to download 4096_bytes_? ;-) you could just use 30 seconds to be safe. Allows for hiccups in-between and still not over-doing it. Dec 13, 2010 at 2:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.