DIR : /home/kozerus/public_html/go/eidogo/tourney/downloads.php

/home/kozerus/public_html/go/eidogo/tourney

<?php
/**
 * Download Prompt for any file using PHP Header Function
 *
 * @author Swashata <swashata4u@gmail.com>
 * @link https://www.intechgrity.com/?p=537
 * @license GPLv2 or Higher
 *
 */
// Name of the directory where all the sub directories and files exists
# $file_directory = 'files';
$file_directory = '/Volumes/ka1tbr2/ht/eidogo/tourney/sgf';
print( "file_directory=$file_directory<br>\n" );

// Get the file from URL variable
$file = @$_GET['file'];
// No request parameter set?
if ( empty( $file ) ) {
    // Set response code
    http_response_code( 400 ); // Bad Request
    exit( 'Invalid Request' );
}
// Try to seperate the folders and filename from the path
$file_array = explode( DIRECTORY_SEPARATOR, $file );
// Count the result
$file_array_count = count( $file_array );
// Trace the filename
$filename = basename( $file_array[ $file_array_count - 1 ] );
// Set the file path w.r.t the download.php...
// It could be different for you
$file_path = dirname( __FILE__ ) . DIRECTORY_SEPARATOR . $file_directory . DIRECTORY_SEPARATOR . $file;
// Sanitize and check for valid path
// Prevent directory traverse attacks
// We whitelist this path only
$valid_directory = dirname( __FILE__ ) . DIRECTORY_SEPARATOR . $file_directory;
// Let us see the actual path of the file being requested
// Attacker could use ../ to perform a directory traverse attack
$actual_path = realpath( $file_path );
// Calculate the filepath from the actual path
$calculated_file_path = substr( $actual_path, strlen( $valid_directory . DIRECTORY_SEPARATOR ) );
// Make it compatible with Windows
$calculated_file_path = str_replace( array( '/', '\\' ), array( DIRECTORY_SEPARATOR, DIRECTORY_SEPARATOR ), $calculated_file_path );
$file = str_replace( array( '/', '\\' ), array( DIRECTORY_SEPARATOR, DIRECTORY_SEPARATOR ), $file );
// Check if the request file is within valid directory
if ( $file != $calculated_file_path || ! file_exists( $file_path ) || is_dir( $file_path ) ) {
    // Error
    http_response_code( 404 );
    exit( 'The request URL was not found.' );
} else {
    // Tell the filename to the browser
    header( "Content-disposition: attachment; filename={$filename}" );
    // Stream as a binary file! So it would force browser to download
    header( 'Content-type: application/octet-stream' );
    // Read and stream the file
    readfile( $file_path );
}