Can't make downloadable a file

Question

I'm getting troubles with the download from a server. If I enter to http://mypage.com can't download some .zip files. But if I enter to the page's IP, I download the files.

Other similar issue i'm having is with Godaddy, can't make my zip downloads even if I access with the IP or domain.

This is part of the code to generate the XML and ZIP it:

**xmlzip.php**
    $xmlfile = $rfc.$year.$month.'BN.xml';
    $xml->formatOutput = true;
    $el_xml = $xml->saveXML();
    $xml->save($xmlfile);

    $filename = $rfc.$year.$month.'BN';
    shell_exec('zip ../'.$filename.' '.$xmlfile);

    try {
      $date= date('Ymd_Hi');
      $data = '{
          "filename":"xml'.$date.'.zip",
          "filename2":"'.$filename.'.zip"
      }';
      echo '{"success":1,"message":"ok","data":['.$data.']}';
    } catch (Exception $e) {
      $data = '';
      echo '{"error":1,"message":"error","data":['.$data.']}';
      die();
    }

Then I get this on ExtJS to create the Messagebox.wait :

**downloadzip button**
     msg = Ext.MessageBox.wait('Generating XML ...', '');
        Ext.Ajax.request({
            url: 'cakephp/app/webroot/xml.php?',
            params:{
                rfc: rfc,
                month: month,
                year: year
            },
            method : "POST",
            headers: {
                'Content-Type': 'application/json'
            },
            jsonData: true,
            timeout: 1000000,
            withCredentials: true,
            success : function(response) {
                var jsonResponse = JSON.parse(response.responseText);
                filename = jsonResponse.data[0].filename;
                filename2 = jsonResponse.data[0].filename2;

                if(jsonResponse.success === 1) {
                    msg.hide();
                    Ext.getCmp("winFormXML_XMLpanel").setHtml(
                        '<iframe id="" name=""'+
                        ' src="cakephp/app/webroot/download_xml.php?filename='+
                        filename+'&filename2='+filename2+'" width="100%" height="100%"></iframe>');
                    Ext.getCmp('winFormXML').destroy();
                } else {
                    msg.hide();
                    Ext.Msg.alert("ERROR","Error generating XML.");
                }

            },
            failure : function(response) {
                msg.hide();
                var respObj = Ext.JSON.decode(response.responseText);
                console.log(respObj);
                Ext.Msg.alert("ERROR", respObj.status.statusMessage);
            }
        });

And with this i download the generated file:

**downloadzip.php**
    try {
        $filename = $_REQUEST['filename'];
        $filename2 = $_REQUEST['filename2'];

        header('Content-Type: application/zip');
        header('Content-disposition: attachment; filename='.$filename2);
        header('Content-Length: ' . filesize($filename2));
        readfile($filename2);
    } catch(Exception $ex) {
        echo $ex-getMessage();
    }

Like i mention above, I know it works because I can download it from other computers but via IP, and not from the domain.

---

EDIT:

It seems that the line Ext.getCmp('winFormXML').destroy(); was giving troubles when generating. Removing that line make it works!

Answer 1

"Upgrade-Insecure-Requests:1" mean that your browser is asking to your server to transform the url (http) to a secure url (https).

And for the best path for your logic, create a little cakeph plugin (maybe the plugin exist) or just use a controller (like pagesController or dedicated one) and create inside this controller an action (function) that will do all the job that you need (action on xml file, zip and download)

Like this you can add a security layer (for example to only let authenticated user download your file), you can also add some statistics (save downloaded counter in your database)

And i'm not sure that using shell_exec is a good practise, instead this, try ziparchive An example of useful cakephp zip helper or like this

<?php

...

$filename2 = 'xml.zip';

$zip = new ZipArchive;

if ($zip->open($filename2, ZipArchive::CREATE)!==TRUE)
{
    die("zip creation failed!");
} else {
    $zip->addFile($xmlfile);
    $zip->close();

    header('Content-Type: application/zip');
    header('Content-disposition: attachment; filename='.$filename2);
    header('Content-Length: ' . filesize($filename2));
    readfile($filename2);
    unlink($filename2);
}
?>

And at last for your issue if you didn't have the Upgrade-Insecure-Requests message when you use IP adress, it mean that the problem come from your browser. Try to use a browser that don't implement this security level (like chrome or firefox) or simply configure your website to work with https protocol: -> redirection in your .htaccess (inside your cakephp root directory)

<IfModule mod_rewrite.c>
    RewriteEngine on

    RewriteCond %{REQUEST_URI} !^/(s|g)etcmd?(.+)$
    RewriteCond %{HTTPS} !=on
    RewriteRule ^/?(.*) https://%{SERVER_NAME}/$1 [R=301,L] 

    RewriteCond %{QUERY_STRING} ^(.*)http(\:|\%3A)(.*)$
    ReWriteRule .* - [F]    

    RewriteRule    ^$    webroot/    [L]
    RewriteRule    (.*) webroot/$1    [L]
</IfModule>

-> and some configuration in you virtual host to listen on port 443 (inside /etc/apache2/site-available if your under *nix)

# with the automatic HTTPS redirection you are not supposed to configure HTTP part (port 80)
<VirtualHost *:80>
    ServerAdmin [email protected]
    ServerName mypage.com
    ServerAlias mypage.com
    DocumentRoot /var/www/mypage
    <Directory /var/www/mypage/>
        Options -Indexes +FollowSymLinks +MultiViews
        AllowOverride All
        Order Allow,Deny 
        Allow from All
    </Directory>
    ServerSignature Off
    ErrorLog /var/log/apache2/error.log
</VirtualHost>
<VirtualHost *:443>
    ServerAdmin [email protected]
    ServerName mypage.com
    ServerAlias mypage.com
    DocumentRoot /var/www/mypage
    <Directory /var/www/mypage/>
        Options -Indexes +FollowSymLinks +MultiViews
        AllowOverride All
        Order Allow,Deny
        Allow from All
    </Directory>
    ServerSignature Off

    SSLEngine on
    SSLProtocol all -SSLv2
    SSLCipherSuite ALL:!ADH:!EXPORT:!SSLv2:RC4+RSA:+HIGH:+MEDIUM

    # If you have secure certificate
    SSLCertificateFile /etc/apache2/certificats/YOURCRTFILE.crt
    SSLCertificateKeyFile /etc/apache2/certificats/YOURPEMFILE.pem
    SSLCertificateChainFile /etc/apache2/certificats/YOURPEMFILE.pem
    SSLCACertificatePath /etc/ssl/certs/
    SSLCACertificateFile /etc/apache2/certificats/YOURCRTFILE.crt
    ErrorLog /var/log/apache2/error.log
</VirtualHost>

Hope it helps