123ben on "[Plugin: BulletProof Security] 403 - Trying to download an image"

Hi,

I have a download link on my website for different images. This is the href:

https:/my-domain.com/content/plugins/myplugin/download.php?file=https://my-domain.com/path/to/image/image.jpg

The download.php looks like this:

<?php
$file_url = $_GET['file'];
function retrieve_remote_file_size($url){
 $ch = curl_init($url);
 curl_setopt($ch, CURLOPT_RETURNTRANSFER, TRUE);
 curl_setopt($ch, CURLOPT_HEADER, TRUE);
 curl_setopt($ch, CURLOPT_NOBODY, TRUE);
 $data = curl_exec($ch);
 $size = curl_getinfo($ch, CURLINFO_CONTENT_LENGTH_DOWNLOAD);
 curl_close($ch);
 return $size;
}
$filesize = retrieve_remote_file_size($file_url);
if($filesize != -1){
  if($filesize < 52428800){
    if(ini_get('zlib.output_compression')) ini_set('zlib.output_compression', 'Off');
    header("Pragma: public"); // required
    header("Expires: 0");
    header("Cache-Control: must-revalidate, post-check=0, pre-check=0");
    header("Cache-Control: private",false); // required for certain browsers
    header('Content-Type: application/force-download');
    header("Content-Transfer-Encoding: Binary");
    header("Content-disposition: attachment; filename=\"".basename($file_url)."\"");
    header("Content-Length: ".$filesize);
    @readfile($file_url);
  }else{
    echo 'The requested file is too large.';
  }
}else{
  header('HTTP/1.0 404 Not Found');
}
exit;

When I click the link my browser tells me that the file size is 0 bytes (which of course isn't true).

In the BPS error log this is all I got (remote_addr, host name and request uri altered):

>>>>>>>>>>> 403 GET or Other Request Error Logged - July 8, 2013 - 23:13 <<<<<<<<<<<
REMOTE_ADDR: 11.111.111.111
Host Name: my-domain.com
SERVER_PROTOCOL: HTTP/1.1
HTTP_CLIENT_IP:
HTTP_FORWARDED:
HTTP_X_FORWARDED_FOR:
HTTP_X_CLUSTER_CLIENT_IP:
REQUEST_METHOD: GET
HTTP_REFERER:
REQUEST_URI: /path/to/image/image.jpg
QUERY_STRING:
HTTP_USER_AGENT:

I don't know what to do. Could someone please give me a hint which custom code have to be entered?

All the best
Ben

http://wordpress.org/extend/plugins/bulletproof-security/