通过ZipArchive动态生成Zip文件无法打开

Question

我正尝试创建用户上传图片的zip文件，用户单击按钮时将生成用于下载的zip文件。该按钮位于Wordpress管理页面中。该页面来自添加新管理部分的插件。当点击按钮时，它将表单提交到'themes/twentyfourteen/page-templates'目录中的页面。该页面被称为cartoon_zip.php，并通过管理页面部分创建，所以它的网址为http://www.sitename.com/cartoon-zip/。当我点击该文件时，它似乎工作。没有错误发生，并且保存文件对话框出现。我在本地保存文件并尝试解压缩，但得到消息'文件的内容'characters.zip“无法用此程序解压缩。'我在Mac上，所以这是Unarchiver试图打开;它不能在PC上工作。以下是我正在使用的代码;任何帮助是极大的赞赏。

<?php 
    /* 
     Template name: Cartoon Zip 
    */ 

    if(isset($_REQUEST['order_id'])){ 
     $order_id = $_REQUEST['order_id']; 

     $query = "SELECT optional_image FROM order_listing WHERE order_no = '".$order_id."'"; 
     $query2 = "SELECT main_image FROM character_order WHERE order_id = '".$order_id."'"; 

     $entries = $wpdb->get_results($query); 
     $entries2 = $wpdb->get_results($query2); 

     $error = "";  //error holder 

     if(extension_loaded('zip')){ // Checking ZIP extension is available 

      $zip = new ZipArchive();   // Load zip library 
      $zip_name = "characters.zip";   // Zip name 

      if($zip->open($zip_name, ZIPARCHIVE::CREATE)!==TRUE){  // Opening zip file to load files 
       $error .= "* Sorry ZIP creation failed at this time<br/>"; 
      } 

      foreach($entries as $entry) { 
       $image=$entry->optional_image; 
       if(!empty($image)): 
        $url = 'wp-content/themes/twentyfourteen/upload/main/'.$image; 
        if(file_exists($url)){ 
         $zip->addFile($url,$image);   // Adding files into zip 
        } 
       endif; 
      } 
      foreach($entries2 as $entry) { 
       $image=$entry->main_image; 
       if(!empty($image)): 
        $url = 'wp-content/themes/twentyfourteen/upload/character/'.$image; 
        if(file_exists($url)){ 
         $zip->addFile($url,$image);   // Adding files into zip 
        } 
       endif; 
      } 

      if ($zip->close() === false) { 
       exit("Error creating ZIP file"); 
      }; 

      $filename = $zip_name; 
      // send $filename to browser 
      $finfo = finfo_open(FILEINFO_MIME_TYPE); 
      $mimeType = finfo_file($finfo, $filename); 
      $size = filesize($filename); 
      $name = basename($filename); 

      if (isset($_SERVER['HTTPS']) && $_SERVER['HTTPS'] == 'on') { 
       // cache settings for IE6 on HTTPS 
       header('Cache-Control: max-age=120'); 
       header('Pragma: public'); 
      } else { 
       header('Cache-Control: private, max-age=120, must-revalidate'); 
       header("Pragma: no-cache"); 
      } 
      header("Expires: Sat, 26 Jul 1997 05:00:00 GMT"); // long ago 
      header("Content-Type: $mimeType"); 
      header('Content-Disposition: attachment; filename="' . $name . '";'); 
      header("Accept-Ranges: bytes"); 
      header('Content-Length: ' . filesize($filename)); 

      readfile($fullFilePath); 
      exit; 
     }else 
      $error .= "* You dont have ZIP extension<br/>"; 
    } 
?> 

编辑：所以我manged得到下面结合doublesharp的帮助，这方面的工作，并通过改变头以下内容。

$file = $zip_name; 
     if (file_exists($file)) { 
      header('Content-Description: File Transfer'); 
      header('Content-Type: application/octet-stream'); 
      header('Content-Disposition: attachment; filename='.basename($file)); 
      header('Expires: 0'); 
      header('Cache-Control: must-revalidate'); 
      header('Pragma: public'); 
      header('Content-Length: ' . filesize($file)); 
      ob_clean(); 
      flush(); 
      readfile($file); 
      exit; 
     } 

以下是完整的工作代码。

<?php 
/* 
    Template name: Cartoon Zip 
*/ 

if(isset($_REQUEST['order_id'])){ 
    global $wpdb; 
    $order_id = isset($_REQUEST['order_id'])? $_REQUEST['order_id'] : 0; 

    $query = $wpdb->prepare("SELECT optional_image FROM order_listing WHERE order_no = %s", $order_id); 
    $query2 = $wpdb->prepare("SELECT main_image FROM character_order WHERE order_id = %s", $order_id); 

    $entries = $wpdb->get_results($query); 
    $entries2 = $wpdb->get_results($query2); 

    $error = "";  //error holder 

    if(extension_loaded('zip')){ // Checking ZIP extension is available 

     $zip = new ZipArchive();   // Load zip library 
     $zip_name = "characters.zip";   // Zip name 

     if($zip->open($zip_name, ZIPARCHIVE::CREATE)!==TRUE){  // Opening zip file to load files 
      $error .= "* Sorry ZIP creation failed at this time<br/>"; 
     } 

     foreach($entries as $entry) { 
      $image=$entry->optional_image; 
      if(! empty($image)){ 
       $filename = WP_CONTENT_DIR.'/themes/twentyfourteen/upload/main/'.$image; 
       if (file_exists($filename)){ 
        // Adding files into zip 
        $zip->addFile($filename, $image); 
       } 
      } 
     } 
     foreach($entries2 as $entry) { 
      $image=$entry->main_image; 
      if(! empty($image)){ 
       $filename = WP_CONTENT_DIR.'/themes/twentyfourteen/upload/character/'.$image; 
       if (file_exists($filename)){ 
        // Adding files into zip 
        $zip->addFile($filename, $image); 
       } 
      } 
     } 

     if ($zip->close() === false) { 
      exit("Error creating ZIP file"); 
     }; 

     $file = $zip_name; 
     if (file_exists($file)) { 
      header('Content-Description: File Transfer'); 
      header('Content-Type: application/octet-stream'); 
      header('Content-Disposition: attachment; filename='.basename($file)); 
      header('Expires: 0'); 
      header('Cache-Control: must-revalidate'); 
      header('Pragma: public'); 
      header('Content-Length: ' . filesize($file)); 
      ob_clean(); 
      flush(); 
      readfile($file); 
      exit; 
     } 
    }else 
     $error .= "* You dont have ZIP extension<br/>"; 
} 
?> 

Answer 1

的第一个参数addFile()必须到图像的完整路径，但使用的是具有wp-content/...相对路径。此页面的模板很可能位于您的wp-content/themes/目录中，因此致电file_exists()失败，这意味着什么都不会传递到ZipArchive。 WordPress提供了一个常量，其中包含wp-content文件夹的绝对路径，名称为WP_CONTENT_DIR - 或者如果您不确定自己将使用哪种主题，则可以使用get_template_directory()。

使用WP_CONTENT_DIR：

if(! empty($image)){ 
    $filename = WP_CONTENT_DIR.'/themes/twentyfourteen/upload/character/'.$image; 
    if (file_exists($filename)){ 
     // Adding files into zip 
     $zip->addFile($filename, $image); 
    } 
} 

使用get_template_directory()：

$filename = get_template_directory().'/upload/character/'.$image; 

SQL INJECTION警告

您还有一个SQL注入漏洞，可能在请求的order_id中传递任意SQL。使用$wpdb->prepare()来防止它。

global $wpdb; 
$order_id = isset($_REQUEST['order_id'])? $_REQUEST['order_id'] : 0; 
$query = $wpdb->prepare("SELECT optional_image FROM order_listing WHERE order_no = %s", $order_id); 
$query2 = $wpdb->prepare("SELECT main_image FROM character_order WHERE order_id = %s", $order_id);