Geek Answers Handbook

PHP to protect PDF and DOC

I am trying to provide .pdf and .doc files to authorized users on a website. The user can only see the file selection page at login, but this does not prevent an unauthorized user from viewing documents if they know the full URL.

How can I prevent unauthorized users from accessing these files?

+4
source share
4 answers

The answer is pretty simple, @Jon Stirling posted this when I was typing, but I will explain you a little more.

one puts your files outside your public html directory,

Configure E.gcpanel

 user/public_html /public_html/download.php user/documents/ /documents/file.doc /documents/file.pdf

@dhh posted the base file download.php php, however, since you want to force your things to be downloaded, which you can do, for example, search and provide the correct mime type, this is an extension of its code to make the best use of 1 force downloading the file and 2 allowing different file types

download.php

 //check users is loged in and valid for download if not redirect them out // YOU NEED TO ADD CODE HERE FOR THAT CHECK // array of support file types for download script and there mimetype $mimeTypes = array( 'doc' => 'application/msword', 'pdf' => 'application/pdf', ); // set the file here (best of using a $_GET[]) $file = "../documents/file.doc"; // gets the extension of the file to be loaded for searching array above $ext = explode('.', $file); $ext = end($ext); // gets the file name to send to the browser to force download of file $fileName = explode("/", $file); $fileName = end($fileName); // opens the file for reading and sends headers to browser $fp = fopen($file,"r") ; header("Content-Type: ".$mimeTypes[$ext]); header('Content-Disposition: attachment; filename="'.$fileName.'"'); // reads file and send the raw code to browser while (! feof($fp)) { $buff = fread($fp,4096); echo $buff; } // closes file after whe have finished reading it fclose($fp);

PS is a list of mime types for abig if you want to add support for other files http://www.hansenb.pdx.edu/DMKB/dict/tutorials/mime_typ.php

+8
source

What you can do is provide the equivalent PHP proxy for files.

Put the files outside of webroot, then write a script that verifies that the user is allowed access. If not, redirect them, if they do, set the appropriate headers and display the file data.

+3
source

You must store all downloads outside your public / user doc root (but, of course, inside your server) and add a script download to send the download if the user is logged in.

Here is an example of how to “send” a file to download it.

 $file = "ireland.jpg"; $fp = fopen($file,"r") ; header("Content-Type: image/jpeg"); while (! feof($fp)) { $buff = fread($fp,4096); print $buff; }
+3
source

This helped me: I placed the .pdf and .htaccess file with the following code in a regular folder (I called it "docs") on my apache web server.

 Order Deny,Allow Deny from all Allow from 127.0.0.1 <Files /index.php> Order Allow,Deny Allow from all </Files>

Then I took the code from Martin Barkers above, changed the path to the "docs / sample.pdf" file and pasted it into the .php file in my root directory. It. You cannot access the file at the url now, but you can download it if you run test.php.

+1
source

More articles:


All Articles