how do i prevent public downloads of files using php?

Question

Hi,

i have a script that allows only authorised users to upload files to a certain folder.

however i do not know how to prevent people from downloading freely without login.

I need the solution in php.

I have googled around but nothing straight forward as yet.

currently in my document root i have a folder called admin and a subfolder called uploads inside the admin. so only admin role can upload . both editor and admin can download. what should i do in this case?

Please advise.

Answer 1

Put the files somewhere outside the public webroot directory, or configure your server to not serve the files. As long as your server will happily serve everything with a valid URL, there's nothing you can do with PHP to prevent that.

---

If your files are in the /public_html/ folder, take them out of that folder and place them in e.g. /secret_files/, so your directory structure looks something like this:

public_html/
    index.html
    admin/
        admin_index.php
secret_files/
    my_secret_file.txt

The webserver is only configured to serve files in the /public_html/ directory, so nobody will have access to directories outside (technical term above) it.

To still enable somebody to download those files, do as cletus suggests and use readfile to "manually serve" the files via a PHP script. PHP will still have access to these other parts of the file system, so you can use it as a gatekeeper.

Answer 2

Answering question on how to password protect with PHP: This should solve your problem.

Answer 3

Don't store the files in a directory under the document root.

Instead move them somewhere else and then a PHP script can programmatically determine if someone can download them and then use readfile() or something similar to stream them to the user.

You could also configure the Web server to not serve files from this directory but then you need PHP to serve them anyway. It's cleaner simply not to put them under the document root.