3

I want to protect some files in my server from download but my site needs to have access in them. I want to protect some subtitles files, which are needed to be accessed by site, but I don't want anybody to download them. The site is hosted.

For example some sites use some strange strings that are connected with user, video and IP. Can be used something like this for my case.

http://www11.some-site.com:182/d/qygiatnqvsulzrqmk7n6nbhddbcscvyguy4auc3fn4nvf23jp64tjcpa/File-needed.mp4?start=0
Tunaki
  • 132,869
  • 46
  • 340
  • 423
user1935676
  • 55
  • 1
  • 1
  • 7
  • Put them in a local directory that is not on the path of the website but that the account running the server has access to. – Oded Jan 05 '13 at 16:18
  • The site is hosted I don't think I can do that. – user1935676 Jan 05 '13 at 16:24
  • 1
    Ah. Small details that should be mentioned in the question - like what server and how you manage it. – Oded Jan 05 '13 at 16:25
  • 1
    See http://stackoverflow.com/questions/5377117/best-strategy-to-protect-downloadable-files-php-mysql-apache2-server – ZombieSpy Jan 05 '13 at 16:26
  • 1
    Thank you ZombieSpy. I found just what I needed. I just created in the directory an .htaccess file with "deny from all" (without quotes). – user1935676 Jan 05 '13 at 16:36

2 Answers2

11

If you are using Apache, You have to use rewrite rules in your .htaccess file. IF you are using other HTTP Server brand, you should use almost the same logic that I will show here, so check your HTTP server manual in that case.

Explain:

When you type www.me.com/index.php the PHP system puts the content generated by the echo commands you use inside your code.

When you type www.me.com/myfiles/iou345yo13i2u4ybo34ybu3/passwords.txt your server will put the file contents to the client browser, which will ask you to download it as a file or show as a page, depending of the file extension.

Now, if you do something like this in your .htaccess file:

 RewriteEngine On
 RewriteRule ^myfiles/([^/]*)^.pdf$ /index.php?file=$1& [L]
 # avoit direct access to your server directories file listing
 Options All -Indexes

You will type www.me.com/myfiles/file123.pdf but the server will execute index.php with the file name as content of the "file" parameter, and there in the code, you will be able to check the session to see if the user has the authorization to download this file.

If the user has the authorization, you then use the readfile() function to send the file to the user and he will not recognize where it came from (I mean the real path).

Look on how to do this here:

PHP - send file to user

NaN
  • 8,596
  • 20
  • 79
  • 153
-4

Change to 644 permissions in your content.

Daniel Afonso
  • 30
  • 1
  • 3
  • 8