FileDownload R missing folder in download URL

mediengaarage · May 4, 2021, 10:01am

The download path is generated incorrectly. A folder is missing.
Correct ULR: www.domain.de/assets/upload/pdf/filename.pdf
generated URL: www.domain.de/upload/pdf/filename.pdf.
The “assets/” folder is missing.
This means that the file cannot be downloaded.

MODX 2.8.1
PHP 7.4
FileDownlad R 2.0.0pl

halftrainedharry · May 4, 2021, 11:48am

It would probably help if you could provide your snippet call to figure out what the problem is.

mediengaarage · May 4, 2021, 12:30pm

You are right! Here is my snippet-call:

    [[!FileDownload?
	&dateFormat=`d.m.Y`
    	&getDir=`../filesIntern`
	&countDownloads=`1`
	&tplWrapper=`wrapperTpl`
	&sortBy=`date`
	&sortOrder=`asc`
	&saltText=`xyz`	
]]

chunk: wrapperTpl:

<table class="fd-table">
    [[+fd.path:notempty=`<tr[[+fd.classPath]]>
        <td colspan="3"><strong>Path: [[+fd.path]]</strong></td>
    </tr>`:default=``]]
    <tr class="fd-header">
        <td>Dateiname</td>
        <td>Größe</td>
        <td>Datum</td>
    </tr>
    [[+fd.fileRows]]
</table>

halftrainedharry · May 4, 2021, 1:51pm

Now I’m confused!
You said “The ‘assets/’ folder is missing.” but in the call you use the path “…/filesIntern”. Also, with this call to FileDownload you get back a hashed link without any folders.

mediengaarage · May 4, 2021, 2:19pm

Oh sorry, i sent you a wrong snippet call. Because i want to use it, that the files are outside the root. But this does not work. Then i create another call where the path is inside the root to test ist. And there i saw, that the URL is wrong.

Here is the snippet call:

[[!FileDownload?
	&dateFormat=`d.m.Y`
    	&getDir=`assets/upload/pdf`
    		&countDownloads=`1`
	&tplWrapper=`wrapperTpl`
	&sortBy=`date`
	&sortOrder=`asc`
	&directLink=`1`
]]

halftrainedharry · May 4, 2021, 3:02pm

I did some testing. In the function _directLinkFileDownload the file-path is converted into a url and this is the line where it failed in my test:

github.com

goldsky/FileDownload-R/blob/c0b1e74bfa6dbb8bde077c4d1a4766d45bf8bfcc/core/components/filedownloadr/model/filedownloadr/filedownloadr.class.php#L1411


        // to use this method, the file should always be placed on the web root
        $corePath = str_replace('/', $this->ds, MODX_CORE_PATH);
        if (stristr($filePath, $corePath)) {
            return false;
        }
        // switching from absolute path to url is nuts
        if (empty($this->mediaSource)) {
            $fileUrl = str_ireplace(MODX_BASE_PATH, MODX_SITE_URL, $filePath);
            $fileUrl = str_replace($this->ds, '/', $fileUrl);
            $parseUrl = parse_url($fileUrl);
            $url = ltrim($parseUrl['path'], '/' . MODX_HTTP_HOST);
            $link['url'] = MODX_URL_SCHEME . MODX_HTTP_HOST . '/' . $url;
        } else {
            if (method_exists($this->mediaSource, 'getObjectUrl')) {
                $link['url'] = $this->mediaSource->getObjectUrl($filePath);
            }
        }
    }
    $link['hash'] = '';
    return $link;
}

Try changing this line to

$url = ltrim($parseUrl['path'], '/');

and check if that helps.

mediengaarage · May 4, 2021, 3:24pm

o.k. this would work with the option

&directLink=`1`

but not with

&directLink=`0`

then the file is not found and i get an error page.

halftrainedharry · May 4, 2021, 4:09pm

Please make up your mind if you want to use &directLink=`0` or &directLink=`1` . There are huge differences between these two settings.
With &directLink=`0` the URL of the file is never used. If the generated URL for &directLink=`1` is wrong, then this doesn’t matter at all for &directLink=`0` as only the file-path is used!

As this seems to be now a completely different problem. What is the behaviour you see?
Are the files listed correctly with a link like this?

https://www.yourdomain.com/yourpage.html?fdlfile=ATH4A...=

When do you see an error page? When you click on a link?

mediengaarage · May 5, 2021, 12:14pm

Both should work, right? I would like to offer documents for download that are outside the root. It is a password-protected area on the site. Since it didn’t work with &directLink=0, I tested it with &directLink= 1 and found that it doesn’t work there either. I suspected a connection.

The following URL is generated (with &directLink=0):

https://www.mydomain.de/page.html?fdlfile=ZQHlZ...GplLGD=

If I click on the URL, I get to the 404 error page.

halftrainedharry · May 5, 2021, 1:42pm

Just to be sure: I assume if you delete the fdlfile parameter in the link, then the page https://www.mydomain.de/page.html works correct.

Are there any (related) error message in the MODx error log?
There is this line in the snippet FileDownload that maybe redirects to your error page (depending on your unauthorized_page system setting).

github.com

goldsky/FileDownload-R/blob/c0b1e74bfa6dbb8bde077c4d1a4766d45bf8bfcc/core/components/filedownloadr/elements/snippets/filedownload.snippet.php#L720


        $baseRef = $xRef[0] . '?id=' . $queries['id'];
    } else {
        $baseRef = $xRef[0];
    }
    $baseRef = urldecode($baseRef);
    $page = $modx->makeUrl($modx->resource->get('id'), '', '', 'full');
    /**
     * check referrer and the page
     */
    if ($baseRef !== $page) {
        return $modx->sendUnauthorizedPage();
    }
    $sanitizedGets = $modx->sanitize($_GET);
}


if (empty($scriptProperties['downloadByOther'])) {
    if (!empty($sanitizedGets['fdlfile'])) {
        $checkHash = $fdl->checkHash($modx->context->key, $sanitizedGets['fdlfile']);
        if (!$checkHash) {
            return;
        }

To check if this is the place where the snippet breaks, you could add a $modx->log() line to the snippet code and then check the MODx error log if the text (here '-> sendUnauthorizedPage') gets written.

if ($baseRef !== $page) {
	$modx->log(modX::LOG_LEVEL_ERROR,'-> sendUnauthorizedPage'); //log error message
	return $modx->sendUnauthorizedPage();
}

mediengaarage · May 5, 2021, 2:28pm

Yes, the page is working correct. No error messages.
Even after changing the code in the file, no error message.
I’ve run the extra on other websites and it works fine there. Can it be that it is up to the server settings of the provider? The provider is Strato.

mediengaarage · May 5, 2021, 2:30pm

Check it here at the bottom:
https://www.marktkapelle-kirchseeon.de/impressum.html

halftrainedharry · May 5, 2021, 2:38pm

If I open the developer tools in my browser (Tab Network) and click on one of your links, I can see a 401 (Unauthorized) error code.

Have you changed the snippet inside MODx or the file under /core/components/filedownloadr/elements/snippets? You should make the change to the snippet in MODX!

mediengaarage · May 5, 2021, 2:53pm

o.k, now i get an error message:
[2021-05-05 14:52:19] (ERROR @ /.../core/cache/includes/elements/modsnippet/31.include.cache.php : 719) -> sendUnauthorizedPage

halftrainedharry · May 5, 2021, 3:03pm

Ok. The code does a check here, to make sure that the link isn’t called from a different page. Probably the value of $_SERVER['HTTP_REFERER'] can’t be read.

To be sure what is going on, you could add some additional log messages:

$modx->log(modX::LOG_LEVEL_ERROR,'$ref=' . $ref);
$modx->log(modX::LOG_LEVEL_ERROR,'$baseRef=' . $baseRef);
$modx->log(modX::LOG_LEVEL_ERROR,'$page=' . $page);

mediengaarage · May 5, 2021, 3:19pm

i get this error messages:

[2021-05-05 15:17:56] (ERROR @ /.../core/cache/includes/elements/modsnippet/31.include.cache.php : 719) -> sendUnauthorizedPage
[2021-05-05 15:17:56] (ERROR @ /.../core/cache/includes/elements/modsnippet/31.include.cache.php : 720) $ref=
[2021-05-05 15:17:56] (ERROR @ /.../core/cache/includes/elements/modsnippet/31.include.cache.php : 721) $baseRef=
[2021-05-05 15:17:56] (ERROR @ /.../core/cache/includes/elements/modsnippet/31.include.cache.php : 722) $page=https://www.domain.de/page.html

halftrainedharry · May 5, 2021, 3:39pm

This confirms what I supposed earlier. $_SERVER['HTTP_REFERER'] is empty and therefore the check fails.

github.com

goldsky/FileDownload-R/blob/c0b1e74bfa6dbb8bde077c4d1a4766d45bf8bfcc/core/components/filedownloadr/elements/snippets/filedownload.snippet.php#L703


if ($scriptProperties['ajaxMode'] && !empty($scriptProperties['ajaxControllerPage'])) {
    if ($scriptProperties['fileJs'] !== 'disabled') {
        $modx->regClientStartupScript($fdl->replacePropPhs($scriptProperties['fileJs']));
    }
}


/**
 * do sanitizing first
 */
if (!empty($_GET['fdldir']) || !empty($_GET['fdlfile'])) {
    $ref = $_SERVER['HTTP_REFERER'];
    // deal with multiple snippets which have &browseDirectories
    $xRef = @explode('?', $ref);
    $queries = array();
    parse_str($xRef[1], $queries);
    if (!empty($queries['id'])) {
        // non FURL
        $baseRef = $xRef[0] . '?id=' . $queries['id'];
    } else {
        $baseRef = $xRef[0];
    }

I have no idea however, why $_SERVER['HTTP_REFERER'] is empty!

mediengaarage · May 6, 2021, 7:07am

Can we set the HTTP_REFERER manually?

halftrainedharry · May 6, 2021, 8:22am

Personally, I would probably just comment out the line that does the redirection and then the downloads should work.

if ($baseRef !== $page) {
	//return $modx->sendUnauthorizedPage();
}

If someone has no permission to access https://www.mydomain.de/page.html, then he can’t download the file anyway, no matter the value of the referer header.

halftrainedharry · May 6, 2021, 9:03am

This line in the <head> of your website prevents the referer header from being sent.

<meta name="referrer" content="no-referrer">

So alternatively you could just change this tag. Maybe to <meta name="referrer" content="same-origin">.