此代码可不透露实际的文件下载地址。

function download_document($filename,$path="",$mimetype="application/octet-stream"){
  header("Cache-Control: must-revalidate, post-check=0, pre-check=0");
  header("Content-Disposition: attachment; filename = $filename");
  header("Content-Length: " . filesize($pathto . $filename));
  header("Content-Type: $mimetype");
  echo file_get_contents($pathto . $filename);
}