I’m trying to put together a function that receives a file path, identifies what it is, sets the appropriate headers, and serves it just like Apache would.
The reason I am doing this is because I need to use PHP to process some information about the request before serving the file.
Speed is critical
virtual() isn’t an option
Must work in a shared hosting environment where the user has no control of the web server (Apache/nginx, etc)
Here’s what I’ve got so far:
File::output($path);
<?php
class File {
static function output($path) {
// Check if the file exists
if(!File::exists($path)) {
header('HTTP/1.0 404 Not Found');
exit();
}
// Set the content-type header
header('Content-Type: '.File::mimeType($path));
// Handle caching
$fileModificationTime = gmdate('D, d M Y H:i:s', File::modificationTime($path)).' GMT';
$headers = getallheaders();
if(isset($headers['If-Modified-Since']) && $headers['If-Modified-Since'] == $fileModificationTime) {
header('HTTP/1.1 304 Not Modified');
exit();
}
header('Last-Modified: '.$fileModificationTime);
// Read the file
readfile($path);
exit();
}
static function mimeType($path) {
preg_match("|.([a-z0-9]{2,4})$|i", $path, $fileSuffix);
switch(strtolower($fileSuffix[1])) {
case 'js' :
return 'application/x-javascript';
case 'json' :
return 'application/json';
case 'jpg' :
case 'jpeg' :
case 'jpe' :
return 'image/jpg';
case 'png' :
case 'gif' :
case 'bmp' :
case 'tiff' :
return 'image/'.strtolower($fileSuffix[1]);
case 'css' :
return 'text/css';
case 'xml' :
return 'application/xml';
case 'doc' :
case 'docx' :
return 'application/msword';
case 'xls' :
case 'xlt' :
case 'xlm' :
case 'xld' :
case 'xla' :
case 'xlc' :
case 'xlw' :
case 'xll' :
return 'application/vnd.ms-excel';
case 'ppt' :
case 'pps' :
return 'application/vnd.ms-powerpoint';
case 'rtf' :
return 'application/rtf';
case 'pdf' :
return 'application/pdf';
case 'html' :
case 'htm' :
case 'php' :
return 'text/html';
case 'txt' :
return 'text/plain';
case 'mpeg' :
case 'mpg' :
case 'mpe' :
return 'video/mpeg';
case 'mp3' :
return 'audio/mpeg3';
case 'wav' :
return 'audio/wav';
case 'aiff' :
case 'aif' :
return 'audio/aiff';
case 'avi' :
return 'video/msvideo';
case 'wmv' :
return 'video/x-ms-wmv';
case 'mov' :
return 'video/quicktime';
case 'zip' :
return 'application/zip';
case 'tar' :
return 'application/x-tar';
case 'swf' :
return 'application/x-shockwave-flash';
default :
if(function_exists('mime_content_type')) {
$fileSuffix = mime_content_type($path);
}
return 'unknown/' . trim($fileSuffix[0], '.');
}
}
}
?>
Advertisement
Answer
My previous answer was partial and not well documented, here is an update with a summary of the solutions from it and from others in the discussion.
The solutions are ordered from best solution to worst but also from the solution needing the most control over the web server to the one needing the less. There don’t seem to be an easy way to have one solution that is both fast and work everywhere.
Using the X-SendFile header
As documented by others it’s actually the best way. The basis is that you do your access control in php and then instead of sending the file yourself you tell the web server to do it.
The basic php code is :
header("X-Sendfile: $file_name");
header("Content-type: application/octet-stream");
header('Content-Disposition: attachment; filename="' . basename($file_name) . '"');
Where $file_name is the full path on the file system.
The main problem with this solution is that it need to be allowed by the web server and either isn’t installed by default (apache), isn’t active by default (lighttpd) or need a specific configuration (nginx).
Apache
Under apache if you use mod_php you need to install a module called mod_xsendfile then configure it (either in apache config or .htaccess if you allow it)
XSendFile on XSendFilePath /home/www/example.com/htdocs/files/
With this module the file path could either be absolute or relative to the specified XSendFilePath.
Lighttpd
The mod_fastcgi support this when configured with
"allow-x-send-file" => "enable"
The documentation for the feature is on the lighttpd wiki they document the X-LIGHTTPD-send-file header but the X-Sendfile name also work
Nginx
On Nginx you can’t use the X-Sendfile header you must use their own header that is named X-Accel-Redirect. It is enabled by default and the only real difference is that it’s argument should be an URI not a file system. The consequence is that you must define a location marked as internal in your configuration to avoid clients finding the real file url and going directly to it, their wiki contains a good explanation of this.
Symlinks and Location header
You could use symlinks and redirect to them, just create symlinks to your file with random names when a user is authorized to access a file and redirect the user to it using:
header("Location: " . $url_of_symlink);
Obviously you’ll need a way to prune them either when the script to create them is called or via cron (on the machine if you have access or via some webcron service otherwise)
Under apache you need to be able to enable FollowSymLinks in a .htaccess or in the apache config.
Access control by IP and Location header
Another hack is to generate apache access files from php allowing the explicit user IP. Under apache it mean using mod_authz_host (mod_access) Allow from commands.
The problem is that locking access to the file (as multiple users may want to do this at the same time) is non trivial and could lead to some users waiting a long time. And you still need to prune the file anyway.
Obviously another problem would be that multiple people behind the same IP could potentially access the file.
When everything else fail
If you really don’t have any way to get your web server to help you, the only solution remaining is readfile it’s available in all php versions currently in use and work pretty well (but isn’t really efficient).
Combining solutions
In fine, the best way to send a file really fast if you want your php code to be usable everywhere is to have a configurable option somewhere, with instructions on how to activate it depending on the web server and maybe an auto detection in your install script.
It is pretty similar to what is done in a lot of software for
- Clean urls (
mod_rewriteon apache) - Crypto functions (
mcryptphp module) - Multibyte string support (
mbstringphp module)