Question Attachment Security Problem

public function download($check = '') { // init vars $filepath = JPATH_ROOT . '/' .$this->_data->get('file'); $download_mode = $this->_config->get('download_mode'); // check limit if ($this->isDownloadLimitReached()) { header('Content-Type: text/html'); echo JText::_('Download limit reached!'); return; } // trigger on download event $this->app->event->dispatcher->notify($this->app->event->create($this, 'element:download', compact('check'))); // output file if ($download_mode == 1 && is_readable($filepath) && is_file($filepath)) { $this->_data->set('hits', $this->_data->get('hits', 0) + 1); $this->app->filesystem->output($filepath); } else if ($download_mode == 2 && $this->filecheck() == $check && is_readable($filepath) && is_file($filepath)) { $this->_data->set('hits', $this->_data->get('hits', 0) + 1); $this->app->filesystem->output($filepath); } else { header('Content-Type: text/html'); echo JText::_('Invalid file!'); } // save item $this->app->table->item->save($this->getItem()); } public function output($file) { @error_reporting(E_ERROR); $name = basename($file); $type = $this->getContentType($name); $size = @filesize($file); $mod = date('r', filemtime($file)); while (@ob_end_clean()); // required for IE, otherwise Content-disposition is ignored if (ini_get('zlib.output_compression')) { ini_set('zlib.output_compression', 'Off'); } // set header header("Pragma: public"); header("Cache-Control: must-revalidate, post-check=0, pre-check=0"); header("Expires: 0"); header("Content-Transfer-Encoding: binary"); header('Content-Type: '.$type); header('Content-Disposition: attachment;' .' filename="'.$name.'";' .' modification-date="'.$mod.'";' .' size='.$size.';'); header("Content-Length: ".$size); // set_time_limit doesn't work in safe mode if (!ini_get('safe_mode')) { @set_time_limit(0); } // output file $handle = fopen($file, 'rb'); fpassthru($handle); fclose($handle); } public function filecheck() { $secret = $this->_config->get('secret'); return md5($this->_data->get('file').$secret.date('Y-m-d')); }