How to protect HTML navigation

Question

Hi!

I am writing software for an elearning platform. Validation is performed via PHP and MySQL. All content is uploaded into a folder protected for all direct access by HTACCESS and content is only served to users via a PHP routine that validates student credentials and then Fopens the file and sends it to the browser.

This is ok for all regular types of content (flash, gif, pdf, etc.), but cannot be used for content uploaded as regular HTML pages and graphics.

Does anyone know what would be a good idea to protect as much as possible this type of content? I thought of placing it in a random named directory, and linking to the content within an iframe to hide the address as much as possible, but is there a better way of doing this?

Thanks!

Answer 1

One way of solving this problem is to have an intermediary script serving the binary content (based on user privileges) from a protected location.

So a typical file download URL instead of /resources/foo.pdf would be /download.php?foo.pdf

Answer 2

You could serve non-HTML (or non-text) as cherouvim suggests, and store HTML (all text, really) in a database table. Your download.php script would then have to be smart enough to query the database for .html, etc. files.

The problem then is that any images or other assets would have the wrong URL (e.g. <img src="image.jpg"/> instead of <img src="download.php?image.jpg/>. You'd have to re-write the links to these assets in the saved HTML in the database -- you could probably do this with a combination of an XML interpreter (to pull all the img tags and other tags that link to files) and regular expressions to determine which need to be rewritten (e.g. rewrite src="image.jpg" but not src="http://google.com/image.jpg".

Not the most elegant solution ever, but I think it would work.

Answer 3

I may be a bit late on this, but in case somebody else looks for this...Maybe you can put give those files an extra extension, and then tell apache (or whoever) that php will actually be handling those files. For example, you have an 'example.html' file, rename it to 'example.html.answers'. Then when you need to serve the 'name.html' file, you actually pass the 'name.html'.'answers' argument.