force-file-download.php

<?php

function forceDownload()
{
	$file_name = "/some/directory/not/publicly/available/" . $_GET['file'];

	$file = file_get_contents( $file_name );

	if( !empty($file) )
	{
		header( 'Content-Description: File Transfer' );
		header( 'Content-Type: application/octet-stream' );
		header( 'Content-Disposition: attachment; filename=' . $_GET['file'] );
		header( 'Content-Transfer-Encoding: binary' );
		header( 'Connection: Keep-Alive' );
		header( 'Expires: 0' );
		header( 'Cache-Control: must-revalidate, post-check=0, pre-check=0' );
		header( 'Pragma: public' );
		header( 'Content-Length: ' . filesize( $file_name ) );

		echo $file;
		exit;
	}
}

function authenticate()
{
	//do authentication stuff and return true if authenticated, false otherwise
}

if( authenticate() )
{
	forceDownload();
}