Secure File Downloads in WordPress with Custom URLs

if ($download_jpg || $download_pdf || $download_png) {
    ?>
    <div class="single-mandalas-downloads">
      <?php
        if ($download_jpg) {
            $encoded_file = base64_encode($download_jpg); // Encode file path
            $nonce = wp_create_nonce('download_file'); // Create nonce
            $download_link = add_query_arg(array(
                'file' => $encoded_file,
                'nonce' => $nonce,
            ), home_url('/file-download/'));

            echo '<div class="mandala-button"><a class="btn btn-outline download-jpg" href="' . esc_url($download_link) . '">Download JPG</a>';
            $download_count = get_download_count($download_jpg);
            echo '<span>Downloaded ' . $download_count . ' times</span></div>';
        }

        if ($download_pdf) {
            $encoded_file = base64_encode($download_pdf);
            $nonce = wp_create_nonce('download_file');
            $download_link = add_query_arg(array(
                'file' => $encoded_file,
                'nonce' => $nonce,
            ), home_url('/file-download/'));

            echo '<div class="mandala-button"><a class="btn btn-blue btn-outline" href="' . esc_url($download_link) . '">Download PDF</a>';
            $download_count = get_download_count($download_pdf);
            echo '<span>Downloaded ' . $download_count . ' times</span></div>';
        }

        if ($download_png) {
            $encoded_file = base64_encode($download_png);
            $nonce = wp_create_nonce('download_file');
            $download_link = add_query_arg(array(
                'file' => $encoded_file,
                'nonce' => $nonce,
            ), home_url('/file-download/'));

            echo '<div class="mandala-button"><a class="btn btn-blue btn-outline" href="' . esc_url($download_link) . '">Download PNG</a>';
            $download_count = get_download_count($download_png);
            echo '<span>Downloaded ' . $download_count . ' times</span></div>';
        }
      ?>
    </div>
  
<?php } ?>

<?php

// Rewrite rule to handle the custom file download URL structure
function add_custom_download_rewrite_rule() {
    add_rewrite_rule('^file-download/?$', 'index.php?pagename=file-download', 'top');
}
add_action('init', 'add_custom_download_rewrite_rule');

// Add 'file' as a custom query variable for download links
function add_custom_query_vars($vars) {
    $vars[] = 'file';
    return $vars;
}
add_filter('query_vars', 'add_custom_query_vars');

<?php
/* Template Name: File Download Handler */

// Exit if accessed directly
defined('ABSPATH') || exit;

// Check if 'file' parameter is provided
if (!isset($_GET['file']) || empty($_GET['file'])) {
    wp_die('Invalid request: No file specified.');
}

// Decode and sanitize the file parameter
$file_encoded = sanitize_text_field($_GET['file']);
$file_relative_path = base64_decode($file_encoded);

if (!$file_relative_path) {
    wp_die('Invalid file request.');
}

// Optional: Validate nonce for security
if (!isset($_GET['nonce']) || !wp_verify_nonce($_GET['nonce'], 'download_file')) {
    wp_die('Security check failed: Invalid nonce.');
}

// Construct the full server path
$base_server_path = '/public_html';
$file_path = realpath($base_server_path . $file_relative_path);

// Ensure the file exists and is within the allowed directory
if (!$file_path || !file_exists($file_path) || strpos($file_path, realpath($base_server_path . '/mandala-images')) !== 0) {
    wp_die('File not found or invalid path.');
}

// Clear all output buffers to prevent any unexpected output
while (ob_get_level()) {
    ob_end_clean();
}

// Set appropriate headers for download based on file type
$file_extension = strtolower(pathinfo($file_path, PATHINFO_EXTENSION));
$mime_type = '';

switch ($file_extension) {
    case 'jpg':
    case 'jpeg':
        $mime_type = 'image/jpeg';
        break;
    case 'png':
        $mime_type = 'image/png';
        break;
    case 'pdf':
        $mime_type = 'application/pdf';
        break;
    default:
        $mime_type = 'application/octet-stream';
}

header('Content-Description: File Transfer');
header('Content-Type: ' . $mime_type);
header('Content-Disposition: attachment; filename="' . basename($file_path) . '"');
header('Content-Transfer-Encoding: binary');
header('Content-Length: ' . filesize($file_path));
header('Cache-Control: no-cache, must-revalidate');
header('Pragma: public');
header('Expires: 0');

// Open the file in read mode
$handle = fopen($file_path, 'rb');
if ($handle === false) {
    wp_die('Unable to open file for reading.');
}

// Output the file in chunks
$chunk_size = 8192; 
while (!feof($handle)) {
    echo fread($handle, $chunk_size);
    flush();
}

fclose($handle);
exit;