Downloads won’t work

Oh, and here’s a page where you can try it yourself:

https://www.womenonfire.com/valerie-young-interview-open/

Hi Peggy,

The error message you are getting says that your server is not setting the session-cookie (probably a server configuration). You can try commenting line 16 and 17; that way the cookie block is removed and the file should download.

//if(!isset($_SESSION['maphost']) || $_SESSION['maphost'] != $_SERVER['HTTP_HOST'])
//  die ('<b>Something goes wrong, you don\'t have permission to use this page, sorry.</b>');

Although this could solve the issue I strongly suggest to ask to your server administrator why the cookie is not available and restore the code to prevent possible attack using that page.

Remember that with the next update this code will be reverted to the original one and you’ll need to change it again.

Let me know if that solve your problem.
All the best,
Matteo

As I said, I already tried commenting out those lines. That’s when I got “The file doesn’t exist; check the URL”. Notice that the file URL that’s supposed to be in that error message is empty.

As I said, I don’t think the file URL is being set properly in this code.

I’d really rather not have to swap out to use a different audio plugin across the dozens of pages where I’m using yours, but I need this functionality to work. Suggestions?

Peggy

Hi Peggy,
I thought you commented the lines above (11 & 12) sorry.

Probably you have two problems with your server:

1. it doesn’t set the SESSION COOCKIE so you need to comment the two lines I told you.

2. it doesn’t return either the $_SERVER[‘HTTP_HOST’] or the $_SERVER[“DOCUMENT_ROOT”] or both. So you can try if commenting from line 34 to line 50 will solve your problem:

/*
if($pos){

  if (isset($_SERVER['HTTPS']) &&
    ($_SERVER['HTTPS'] == 'on' || $_SERVER['HTTPS'] == 1) ||
    isset($_SERVER['HTTP_X_FORWARDED_PROTO']) &&
    $_SERVER['HTTP_X_FORWARDED_PROTO'] == 'https') {
    $protocol = 'https://';
  }
  else {
    $protocol = 'https://';
  }

  $file_url = str_replace ($protocol. $web_address .'/', '', $file_url);
  $file_url = $web_root ."/". $file_url;
  $file_url = str_replace('//', '/', $file_url);

}
*/

Doing that it will try downloading the file via HTTP instead of using the system path.

Let me know if that works for you.

All the best,
Matteo

• This reply was modified 8 years ago by pupunzi.

Matteo,
I think my CuteFTP editor is numbering the lines differently than whatever editor you’re using. For instance, in my editor, the if($pos){ code is on line 29. No worries. I can adjust.

So, I commented out the SESSION/maphost test as well as the additional lines you suggest and I still get the same result: “The file doesn’t exist; check the URL”.

I don’t think it’s the full path name or where it’s trying to download from that’s the problem. I think it’s the $file_url variable. It should be putting that value in the error message I’m getting and it’s not. So it would also have a hard time downloading the file if it doesn’t have the name right, correct?

Peggy

I am having the same download problem as @pchamp. It doesn’t seem to be a cookie issue, or if it is, giving permission for cookies doesn’t fix the problem. I have commented out lines 11 and 12, and this works, but if it opens up my site to vulnerabilities, I’d like to find a more permanent and safe solution. Any other ideas? (This is a new issue, BTW. The plugin has been working fine until recently).

• This reply was modified 8 years ago by bcripps.

I’ve been trying this in my Chrome browser. Just to make sure it’s not some strange browser issue, I also tried it in Firefox and got the same exact results.

Do you have anything else I can try, or should I just give up on this plugin?

Peggy

@pchamp: it’s true that the “fileurl” should be filled…It’s quite strange as the fileurl is defined on the query-string you send me in the first message…

This issue is not browser dependent but I presume is something related to the server…

To debug your issue you can try adding:
die("fileurl= " . $file_url . "filename= " . $file_name);

just after:

$file_name = $_GET["filename"];
$file_url = $_GET["fileurl"];
$file_url = str_replace(" ", "%20", $file_url);

And see if the fileurl is printed out on the map_download.php page

• This reply was modified 8 years ago by pupunzi.

And yes, just like bcripps, I’ve been successfully using this plugin for years. Unlike him/her, commenting out those couple of lines hasn’t resolved the problem, vulnerability or not.

Peggy

@pchamp: As from your first message you said that you grab the URL and it was:

https://www.womenonfire.com/wp-content/plugins/wp-miniaudioplayer/map_download.php?filename=2017-03-March-ValerieYoung.mp3&fileurl=https://www.womenonfire.com/wp-content/uploads/2017/03/2017-03-March-ValerieYoung.mp3

As you can see the fileurl is present on the query-string… so the $_GET[“fileurl”] should have worked…

• This reply was modified 8 years ago by pupunzi.

Added that line and got:

fileurl= filename=

In other words, those variables don’t seem to be defined.

Here’s what the entire file looks like for me now:

<?php
/**
* Download file.
*/

if (!session_id())
session_start();

/* Check if there is the cookie that allow the download */
/*!isset($_COOKIE[“mapdownload”]) || $_COOKIE[“mapdownload”] !== “true” || */
/*if(!isset($_SESSION[‘maphost’]) || $_SESSION[‘maphost’] != $_SERVER[‘HTTP_HOST’])
die (‘<b>Something goes wrong, you don\’t have permission to use this page, sorry.</b>’) ;*/

/*session_unset($_SESSION[‘host’]);
session_write_close();*/

unset($_COOKIE[‘mapdownload’]);
setcookie(‘mapdownload’, ‘false’, time() – 3600, ‘/’);

$file_name = $_GET[“filename”];
$file_url = $_GET[“fileurl”];
$file_url = str_replace(” “, “%20”, $file_url);

die(“fileurl= ” . $file_url . “filename= ” . $file_name);

$web_root = $_SERVER[“DOCUMENT_ROOT”];
$web_address = $_SERVER[‘HTTP_HOST’];

$pos = strrpos($file_url, $web_address);

/* if($pos){

if (isset($_SERVER[‘HTTPS’]) &&
($_SERVER[‘HTTPS’] == ‘on’ || $_SERVER[‘HTTPS’] == 1) ||
isset($_SERVER[‘HTTP_X_FORWARDED_PROTO’]) &&
$_SERVER[‘HTTP_X_FORWARDED_PROTO’] == ‘https’) {
$protocol = ‘https://&#8217;;
}
else {
$protocol = ‘https://&#8217;;
}

$file_url = str_replace ($protocol. $web_address .’/’, ”, $file_url);
$file_url = $web_root .”/”. $file_url;
$file_url = str_replace(‘//’, ‘/’, $file_url);

}*/

$filename = basename ($file_url) ;
$file_extension = strtolower(substr (strrchr ($filename, ‘.’), 1));

function getFileSize($url) {
if (substr($url,0,4)==’http’) {
$x = array_change_key_case(get_headers($url, 1),CASE_LOWER);
if ( strcasecmp($x[0], ‘HTTP/1.1 200 OK’) != 0 ) { $x = $x[‘content-length’][1]; }
else { $x = $x[‘content-length’]; }
}
else { $x = @filesize($url); }
return $x;
}

$fileSize = getFileSize($file_url);

function fileExists($path){
return (@fopen($path,”r”)==true);
}

if(!fileExists($file_url))
die(“<br> The file <b>” .$file_url. “</b> doesn’t exist; check the URL”);

//This will set the Content-Type to the appropriate setting for the file
switch ($file_extension)
{

case ‘mp3’:
$content_type = ‘audio/mpeg’ ;
break ;
case ‘mp4a’:
$content_type = ‘audio/mp4’ ;
break ;
case ‘wav’:
$content_type = ‘audio/x-wav’ ;
break ;
case ‘ogg’:
$content_type = ‘audio/ogg’ ;
break ;
default:
die (‘<b>You can\’t access ‘. $file_extension .’ files!</b>’) ;
}

header (‘Pragma: public’) ;
header (‘Expires: 0’) ;
header (‘Cache-Control: must-revalidate, post-check=0, pre-check=0’) ;
header (‘Cache-Control: private’) ;
header (‘Content-Type: ‘ . $content_type);
header(“Content-Description: File Transfer”);
header(“Content-Transfer-Encoding: Binary”);
header(“Content-disposition: attachment; filename=\””.$filename.”\””);
header(‘Content-Length: ‘.$fileSize);
header(‘Connection: close’);

if($fp=@fopen($file_url,’rb’)){
sleep(1);
ignore_user_abort();
set_time_limit(0);
while(!feof($fp))
{
echo (@fread($fp, 1024*8));
ob_flush();
flush();
}
fclose ($fp);

}else if(function_exists(‘curl_version’)){
$ch = curl_init();
curl_setopt ($ch, CURLOPT_URL, $file_url);
curl_setopt ($ch, CURLOPT_RETURNTRANSFER, 1);
$contents = curl_exec($ch);
// display file
echo $contents;
curl_close($ch);

}else{
// ob_end_flush();
ob_clean();
flush();
@readfile ($file_url) ;
}

clearstatcache();

exit;

I don’t understand why this isn’t working for me when it does for others. The file clearly exists and the code to play the file works fine. The file URL in the download URL is correct, as you say. So…? Help!

Do you have any cache plugin active on your WordPress?
If yes you should exclude the map_download.php file from being cached…

if that file get cached any parameters passed on the query-string would be removed

• This reply was modified 8 years ago by pupunzi.

However, if you take that download URL, which does appear to be formed properly, and put it into your browser, you’ll see the that diagnostic ‘die’ you had me add comes back with no file name and no file URL. ???

There is no caching plugin installed on this site.

I just googled to find out why you’ve empty $_GET parameters and there are some possibilities that you can check:

1. Make sure your php.ini file doesn’t set max_input_vars to 0
2. Do you have mode rewrite set up that removes them or you are using a framework, such as CodeIgniter that moves them elsewhere.

3. Can you try if die($_REQUEST) return something?

For some reasons the query string is removed when you call the map_download.php page…