$path = '../files/'; // 上层文件路径
$file_url = $path.$_GET['f']; // $_GET只暴露文件名
$file_name = $_GET['f'];

if(!file_exists($file_url)) {
echo "不存在";
}else{
header('Accept-Ranges: bytes');
header('Accept-Length: ' . filesize( $file_url )); // 文件尺寸
header('Content-Transfer-Encoding: binary');
header('Content-type: application/octet-stream');
header('Content-Disposition: attachment; filename=' . $file_name);
header('Content-Type: application/octet-stream; name=' . $file_name);
if(is_file($file_url) && is_readable($file_url)){
$file = fopen($file_url, "r");
echo fread($file, filesize($file_url));
fclose($file);
}
}