76

I'm loading my files (pdf, doc, flv, etc) into a buffer and serving them to my users with a script. I need my script to be able to access the file but not allow direct access to it. Whats the best way to achieve this? Should I be doing something with my permissions or locking out the directory with .htaccess?

Brandon G
  • 2,733
  • 3
  • 25
  • 24

7 Answers7

98

The safest way is to put the files you want kept to yourself outside of the web root directory, like Damien suggested. This works because the web server follows local file system privileges, not its own privileges.

However, there are a lot of hosting companies that only give you access to the web root. To still prevent HTTP requests to the files, put them into a directory by themselves with a .htaccess file that blocks all communication. For example,

Order deny,allow
Deny from all

Your web server, and therefore your server side language, will still be able to read them because the directory's local permissions allow the web server to read and execute the files.

CodeIt
  • 3,492
  • 3
  • 26
  • 37
Sam Bisbee
  • 4,461
  • 20
  • 25
  • i have used this inside audio folder but it is stoping my audio player to play audio. I am using sound manager 2 to play audio. Is there any work around to allow only sound manager to play that audio file but stop anyother direct access? – sonill Jul 29 '13 at 06:07
  • 5
    @sonill - You can white list certain IPs to be able to access these directories. For example, adding a new line with `Allow from 127.0.0.1` will allow your server, including any server side code, to access files in that directory. More documentation on these bits is available at http://httpd.apache.org/docs/2.4/mod/mod_access_compat.html#allow – Sam Bisbee Jul 30 '13 at 16:38
  • 1
    "However, there are a lot of hosting companies that only give you access to the web root." Why can't those companies put the web root one level lower than the FTP root? Do they have zero knowledge of how PHP works (or rather is it an oversight which is more likely) or do they only care about their own security and money? Oh well, just pick a company that actually gives a damn about your website's security. – FluorescentGreen5 Mar 30 '17 at 04:58
  • 1
    I tried this, but am not able to open the files after they download: failed to open stream: HTTP request failed! HTTP/1.1 403 Forbidden – zylo Sep 14 '17 at 16:34
  • @SamBisbee, How safe is "put them into a directory by themselves with a .htaccess file that blocks all communication"? – Pacerier Nov 21 '17 at 11:31
  • 2
    Not work when we try to access from php script. you have any code how to access that file – Mukesh Panchal Jan 02 '18 at 06:01
  • If I add this to .htaccess file in the folder where the javascript files are located, the website stops running javascript code. How to make .js files runnable by php script but still prevent being viewed from the browser? – Ömer An Jan 14 '19 at 14:36
  • @ÖmerAn Unless you're doing something incredibly funky with your javascript, it *has* to be executed in the browser, not by PHP, and so it needs to be visible to the browser. – Darwin von Corax Jul 06 '21 at 08:27
  • @DarwinvonCorax I guess I am doing something incredibly funky. – Ömer An Jul 07 '21 at 11:14
36

That is how I prevented direct access from URL to my ini files. Paste the following code in .htaccess file on root. (no need to create extra folder)

<Files ~ "\.ini$">
  Order allow,deny
  Deny from all
</Files>

my settings.ini file is on the root, and without this code is accessible www.mydomain.com/settings.ini

Aamir Mahmood
  • 2,704
  • 3
  • 27
  • 47
3

in httpd.conf to block browser & wget access to include files especially say db.inc or config.inc . Note you cannot chain file types in the directive instead create multiple file directives. 

<Files ~ "\.inc$">
Order allow,deny
Deny from all
</Files>

to test your config before restarting apache

service httpd configtest

then (graceful restart)

service httpd graceful
zzapper
  • 4,743
  • 5
  • 48
  • 45
2

Are the files on the same server as the PHP script? If so, just keep the files out of the web root and make sure your PHP script has read permissions for wherever they're stored.

Damien Wilson
  • 4,540
  • 3
  • 21
  • 27
1

If you have access to you httpd.conf file (in ubuntu it is in the /etc/apache2 directory), you should add the same lines that you would to the .htaccess file in the specific directory. That is (for example):

ServerName YOURSERVERNAMEHERE
<Directory /var/www/>
AllowOverride None
order deny,allow
Options -Indexes FollowSymLinks
</Directory>

Do this for every directory that you want to control the information, and you will have one file in one spot to manage all access. It the example above, I did it for the root directory, /var/www.

This option may not be available with outsourced hosting, especially shared hosting. But it is a better option than adding many .htaccess files.

Sablefoste
  • 4,032
  • 3
  • 37
  • 58
1

To prevent .ini files from web access put the following into apache2.conf

<Files ~ "\.ini$">
Order allow,deny
Deny from all
</Files>
Daniel Boakye
  • 11
  • 1
0

How about custom module based .htaccess script (like its used in CodeIgniter)? I tried and it worked good in CodeIgniter apps. Any ideas to use it on other apps?

<IfModule authz_core_module>
    Require all denied
</IfModule>
<IfModule !authz_core_module>
    Deny from all
</IfModule>
Arun Panneerselvam
  • 2,263
  • 1
  • 17
  • 24