root/releases/0.6/_files/download.php

<?php

// Download script
// Usage: http://URL/{username}/files/{folder_id}/{file_id}/{filename}

// Run includes
require_once(dirname(dirname(__FILE__))."/includes.php");

// Initialise functions for user details, icon management and profile management
run("userdetails:init");
run("profile:init");
run("files:init");

// If an ID number for the file has been specified ...
$id = optional_param('id',0,PARAM_INT);
if (!empty($id)) {
    // ... and the file exists in the database ...
    if ($file = get_record('files','ident',$id)) {
        // ... and the owner of the file in the URL line hasn't been spoofed ...
        $files_name = optional_param('files_name');
        if (run("users:name_to_id",$files_name) == $file->owner
            || run("users:name_to_id",$files_name) == $file->files_owner) {
            
            // ... and the current user is allowed to access it ...
            
            if (run("users:access_level_check",$file->access) == true || $file->owner == $_SESSION['userid']) {
                
                // ... and the file exists on disk ...
                
                // Send 304s where possible, rather than spitting out the file each time
                $if_modified_since = preg_replace('/;.*$/', '', $_SERVER['HTTP_IF_MODIFIED_SINCE']);
                
                $tstamp = filemtime($CFG->dataroot . $file->location);
                $lm = gmdate("D, d M Y H:i:s", $tstamp) . " GMT";
                
                if ($if_modified_since == $lm) {
                    header("{$_SERVER['SERVER_PROTOCOL']} 304 Not Modified");
                    exit;
                }
                
                // Send last-modified header to enable if-modified-since requests
                if ($tstamp < time()) {
                    header("Last-Modified: " . $lm);
                }
                
                // Then output some appropriate headers and send the file data!
                require_once($CFG->dirroot.'/lib/filelib.php');
                $mimetype = mimeinfo('type',$file->location);
                
                // "Cache-Control: private" to allow a user's browser to cache the file, but not a shared proxy
                // Also to override PHP's default "DON'T EVER CACHE THIS EVER" header
                header("Cache-Control: private");
                
                header("Content-type: $mimetype");
                if ($mimetype == "application/octet-stream") {
                    header('Content-Disposition: attachment');
                }
                readfile($CFG->dataroot . $file->location);
            }
        }
    }
}

?>