header(“Content-Type: application/zip”) and header(“Content-Disposition: attachment; filename=$fileName”) not working in wordpress?

Question

The above two function not working in wordpress. I want to download file and i am running wordpress in xampp also i have tried it in another online server with wordpress framework still not working.

but this is working in another online server where i have not used wordpress framework.

Is there is problem with wordpress using the above two function?

(below code just take get request which is the path to the file to be downloaded from the server and after validating token the path is given from database)

<?php 
ini_set('display_errors', -1 );
require('wp-blog-header.php');
require('wp-config.php');
$token = ($_GET["token"]);
$platform = ($_GET["platform"]);
$resolution = ($_GET["resolution"]);
$assetName =($_GET["assetName"]);
$currentTime = date("ymdHi" , time());
if($wpdb->query("SELECT * FROM wp_token_table WHERE token='$token'")){
    $result = $wpdb->get_results("SELECT (path) FROM wp_path_table WHERE os='$platform' AND res = '$resolution' AND bundle_name= '$assetName'");
    if($result){
    $path = $result[0]->path;
    $fileName = basename($assetName);
    $filePath = $path;
        if(!empty($fileName) && file_exists($filePath)){
            header("Cache-Control: public");  
            header("Content-Description: File Transfer");
            header("Content-Type: application/zip");
            header("Content-Length:".filesize($filePath));
            header("Content-Disposition: attachment; filename=$fileName");
            header("Content-Transfer-Encoding: binary");   
            readfile($filePath);        
            exit;
        }

    }
}else echo "false";

?>

Answer 1

first of all lets verify my assumption is correct. In the wordpress index.php file, right at the top add this ( obviously after the <?php tag though )

ini_set('display_errors', -1 );

Let me know what that says when you try to download the file.

SQL Injection would let me do this with your url

 $token="'; SELECT * FROM wp_token_table WHERE 1 LIMIT 1; --";

And then your query would be this

"SELECT * FROM wp_token_table WHERE token=''; SELECT * FROM wp_token_table WHERE 1 LIMIT 1; --'"

The -- is start of comment to discard the ending ' then i would essentially select the first entry from that table. Or worse.

It's very important to prevent that.

For the error, I would do this

 <?php
  echo "hello";
  /* -- rest of code */

And make sure the page works first. Once you know that you can rule out problems with the url, then uncomment bits of the code tell it breaks. That will show you where the error is. Unfortunately error reporting wont generally work if its on a page with a syntax error, because php cant even parse the page, so it cant run anything on it.