[Black Rose]

Because I obviously got no life...
Perhaps a couple adjustments and it's ready to go.

sv_downloadurl "http://*snip*/cstrike/?file="

#include <amxmodx>
#include <sqlx>

new Handle:ghTuple;

public plugin_init() {
    register_plugin("Test Plugin 1", "1.0", "[ --{-@ ]");

    ghTuple = SQL_MakeDbTuple("*snip*", "*snip*", "*snip*", "amxx");

    new error, errorstr[1];
    new Handle:hConnection = SQL_Connect(ghTuple, error, errorstr, 0);

    if ( error )
        return;

    new Handle:hQuery = SQL_PrepareQuery(hConnection, "CREATE TABLE IF NOT EXISTS fastdl_auth(IP CHAR/*REMOVE THIS*/(15));");
    SQL_Execute(hQuery);

    SQL_FreeHandle(hQuery);
    SQL_FreeHandle(hConnection);
}

public client_connect(id) {
    new error, errorstr[1];
    new Handle:hConnection = SQL_Connect(ghTuple, error, errorstr, 0);

    if ( error )
        return;

    static szQuery[55];
    static szIP[16];

    get_user_ip(id, szIP, charsmax(szIP), 1);
    formatex(szQuery, charsmax(szQuery), "INSERT INTO fastdl_auth(IP) VALUES(^"%s^");", szIP);

    new Handle:hQuery = SQL_PrepareQuery(hConnection, szQuery);
    SQL_Execute(hQuery);

    SQL_FreeHandle(hQuery);
    SQL_FreeHandle(hConnection);
}

PHP Code:

<?php

$FileName = preg_replace("#\.{2,9999}#", "", $_GET["file"]);
$FileName = preg_replace("#/+#", "/", $FileName);
$FileName = substr($FileName, 1);

$SQL["TYPE"] = "mysql";
$SQL["HOST"] = "*snip*";
$SQL["USER"] = "*snip*";
$SQL["PASS"] = "*snip*";
$SQL["DB"] = "amxx";

$hDB = new PDO($SQL["TYPE"] . ":host=" . $SQL["HOST"] . ";dbname=" . $SQL["DB"] . "", $SQL["USER"], $SQL["PASS"]);

    if ( $hDB === false )
        return;

$hQuery = $hDB->prepare("SELECT * FROM fastdl_auth WHERE IP = \"" . $_SERVER["REMOTE_ADDR"] . "\";");
$hQuery->execute();

if ( $hQuery->fetch(PDO::FETCH_OBJ) === false )
    return;

set_time_limit(0);
$hFile = @fopen($FileName,"rb");
while(!feof($hFile))
{
    print(@fread($hFile, 1024*8));
    ob_flush();
    flush();
}

?>

[Shooting King]

Yes, something like what BlackRose did, but i would like to point out few enhancements,

1. There is a very good alternative to

Originally Posted by Black Rose sv_downloadurl "http://*snip*/cstrike/?file="

is to use apache's Rewrite engine to redirect all traffic after "cstrike/" to the php gateway script. This way the php file will be concealed from the client and up to some limit can stop brute-forcing/fakeclients/some-shits. Something like this (you have to make the regex more strict, do not use as it is),

PHP Code:

RewriteRule "^cstrike/(.*)$"  "somehiddenphpgateway.php?file=$1" [PT] 


2. Are you assuming that the fdl is hosted on the same server as that of HLDS ? or the Database accept remote db connections. Accepting remote db connections welcomes unnecessary traffic on to db and makes db more vulnerable to attacks. This is why i proposed sockets-listening-db entry model.

3. You have to remove the IP from the db after a certain timelimit or on client_putinserver().

4. Are you sure you don't want to sanitize the $_GET["file"], i don't see htmlspecialchars() or *_real_escape_strings() anywhere.

We know you can do it Black !!

[Black Rose]

1. I like that very much and I've always wondered how that works. The question is, can this be done by anyone? Do you need special access to do these things? What if the server isn't Apache?

2. While testing I used my servers (HTTP, MySQL & HLDS) on my local network but I used remote addresses for everything. I did encounter some problems though with local connections. But they can easily be filtered.
I don't understand the sockets thing. I also don't get why remote db connections would be bad. It's not like you're storing your credit card information on it. Live a little.

3. Easily done.

4. Yes...(?)
I'm not sure how to make this 100% safe.

I like to dabble in many different areas of programming, but I'm not an expert in any of them.
Team effort?

[Neeeeeeeeeel.-]

Originally Posted by Shooting King Yes, something like what BlackRose did, but i would like to point out few enhancements, 1. There is a very good alternative to is to use apache's Rewrite engine to redirect all traffic after "cstrike/" to the php gateway script. This way the php file will be concealed from the client and up to some limit can stop brute-forcing/fakeclients/some-shits. Something like this (you have to make the regex more strict, do not use as it is), PHP Code: RewriteRule "^cstrike/(.*)$"  "somehiddenphpgateway.php?file=$1" [PT]  2. Are you assuming that the fdl is hosted on the same server as that of HLDS ? or the Database accept remote db connections. Accepting remote db connections welcomes unnecessary traffic on to db and makes db more vulnerable to attacks. This is why i proposed sockets-listening-db entry model. 3. You have to remove the IP from the db after a certain timelimit or on client_putinserver(). 4. Are you sure you don't want to sanitize the $_GET["file"], i don't see htmlspecialchars() or *_real_escape_strings() anywhere. We know you can do it Black !!

2. If you only allow your hlds server IP to remotely connect your MySQL Server throught firewall/mysqluser-settings you are completly safe.

4. For me, a good way to be safe is to only allow .mdl, .mp3, .wav, etc. files and use file_exists function to check that it's there.

[Shooting King]

Originally Posted by Black Rose 1. I like that very much and I've always wondered how that works. The question is, can this be done by anyone? Do you need special access to do these things? What if the server isn't Apache?

Yeah its an alternative for apache and no additional permissions are required for changing this, you just have to change .htaccess file in your www or root public_html folder or folder in which cstrike exists. IIS also has this kind of rewrites, I didn't use anyother webservers so i cant say every webserver has this feature. All popular and mostly used webserver have this kind of rewrite engines.

Originally Posted by Black Rose 2. While testing I used my servers (HTTP, MySQL & HLDS) on my local network but I used remote addresses for everything. I did encounter some problems though with local connections. But they can easily be filtered. I don't understand the sockets thing. I also don't get why remote db connections would be bad. It's not like you're storing your credit card information on it. Live a little.

I don't like any one to penetrate into my db, given some time anyone can brute force passwords and username. Yes i do store some important info on my db and don't want ppl to gain access to it xDDD Just a suggestion though xD With my model, you dont need your DB to accept remote connections.
Also If you still insist on going with remote db's, Neel's suggestion will be very helpful.

I was trying to point out sql injections vulnerabilities which can be mostly avoided by escaping special chars from GET string, using htmlspecialchars() and *_real_escape_string().
And neel is asking for additional filtering :v

Originally Posted by Neeeeeeeeeel.- 4. For me, a good way to be safe is to only allow .mdl, .mp3, .wav, etc. files and use file_exists function to check that it's there.

[Neeeeeeeeeel.-]

Originally Posted by Shooting King I was trying to point out sql injections vulnerabilities which can be mostly avoided by escaping special chars from GET string, using htmlspecialchars() and *_real_escape_string(). And neel is asking for additional filtering :v

At least with Black Rose's code, there is no SQLi vunlerability because he is only appending the client's IP to the SQL query, so no risks there.

[Shooting King]

Originally Posted by Neeeeeeeeeel.- At least with Black Rose's code, there is no SQLi vunlerability because he is only appending the client's IP to the SQL query, so no risks there.

Oh noes, I was confused, Ignore 4th Suggestion.