Menu
Community /Pin to ProfileBookmark
@NogDogJun 01.2008 — #Store the files in a directory which is either outside of the web document root directory, or else configure your web server to not serve files from that directory (e.g. via .htaccess in Apache). Then write a file server script in PHP that will validate the user's login status, and if valid serve up the file, e.g.:
You would then access a file with a url query string for the file name, e.g.: [noparse]"http://www.example.com/scriptname.php?file=some_name "[/noparse]
Securing folders
Hi,
I want to be able to provide a download area to a site whereby people can download an MP3 track provided they have joined a mailing list. Now, it is easy for me to write a PHP script that checks my MySQL db to see if the email is valid and then direct them to the download but what stops people finding out the directory of the download and entering that in the URL in the first place thus bypassing any security checks etc.?
What are the ways of providing secure folders whereby PHP can only interact with the folder?
Sign in
to post a comment5 Comments(s) ↴
0
@NogDogJun 01.2008 — #Store the files in a directory which is either outside of the web document root directory, or else configure your web server to not serve files from that directory (e.g. via .htaccess in Apache). Then write a file server script in PHP that will validate the user's login status, and if valid serve up the file, e.g.:[code=php]
<?php
if(!isset($_SESSION['logged_in']))
{
header('Location: http://www.example.com/login.php');
exit;
}
$file = basename($_GET['file']) . '.mp3';
$dir = 'path/to/files/';
if(!file_exists($dir.$file))
{
header('HTTP/1.0 404 Not Found');
exit;
}
header('Content-Length: ' . filesize($dir.$file);
header('Content-Type: audio/mpeg');
header('Content-Disposition: attachment; filename="' . $file . '"');
header('Content-Transfer-Encoding: binary');
header('Cache-Control: must-revalidate, post-check=0, pre-check=0');
readfile($dir.$file);
exit;
?>
[/code]You would then access a file with a url query string for the file name, e.g.: [noparse]"