受保护下载的HTTP标头

Question

So I'm using this article to generate and protect some download links on my website

The problem I'm having is the script works, just not with huge files. For example, a 1GB file downloads perfectly, whilst a 7GB one doesn't.

Someone in the comments mentioned large downloads might cause this.

My headers looks like this at the moment:

header('Content-Description: File Transfer');
header('Content-Type: application/octet-stream');
header('Content-Disposition: attachment; filename="' . basename($fakefilename) . '"');
header('Content-Transfer-Encoding: binary');
header('Expires: 0');
header('Cache-Control: must-revalidate');
header('Pragma: public');
header('Content-Length: ' . filesize($realfilename));
ob_clean();
flush();
readfile($realfilename);
exit;

And this guide is suggesting they should look more like this:

header("Content-Disposition: attachment; filename=" . urlencode($file));    
header("Content-Type: application/force-download");
header("Content-Type: application/octet-stream");
header("Content-Type: application/download");
header("Content-Description: File Transfer");             
header("Content-Length: " . filesize($file));
flush(); // this doesn't really matter.

$fp = fopen($file, "r"); 
while (!feof($fp))
{
    echo fread($fp, 65536); 
    flush(); // this is essential for large downloads
}  
fclose($fp); 

For the life of me, I can't get this to work. Anyone here that is familar with HTTP headers and while large but not small files can't be downloaded?

Any help is appreciated. Thanks in advance!

Answer 1

This error is caused by the filesize call overflowing the systems PHP_MAX_INT which yields a length less then that of the entire file. (Which is about 2GB on a 32bit machine)

Only browsers that trust the content-length header over the size of the file itself appear to be afflicted.

Solution is to change

header("Content-Length: " . filesize($file));

to

header("Content-Length: " . exec("stat -c %s ".escapeshellarg($filename)));