Convert the uploaded files to specific file format which can not download

Question

Hi,

I have a problem regarding to prevent download and saving of uploaded files.

My users can upload multiple files types like doc, pdf, ppt,etc....

This all file types are easily download if any one have url.

So what is the better way to prevent the download of the file.

Or i convert the uploaded files to some specific format which can not download easily (e.g flash)..

I am running on php and mysql.

Thanks
Avinash

Answer 1

You have two options in this regard. The first is to move the files, through a PHP script, to a server-side folder outside of the server's web directory. The second is to store the files in a BLOB column in a MySQL table. Both will prevent users from accessing the files directly, without the need to convert the file to a not-so-easily-downloaded format.

Answer 2

Upload the files outside of your document root. For example:

/var/username/uploads/file.docx

where your document root is

/var/username/public_html/index.php

So they can't be accessed directly. And then if you want to allow downloads, create a PHP file called "download.php" that does something similar to:

$data  = file_get_contents('/var/username/uploads/file.docx');
header('Content-Type: application/docx');
header('Content-Length: '.strlen($data));
header('X-Content-Type-Options: nosniff');
echo $data;

and obviously you can add checks to see if the user has the proper permissions to download this particular file or is logged in.

Answer 3

A solution can be to set a user and a password to the upload folder, so only the users that know authentification details can download files. Check next link for learn how to make htpasswd files on your server folders:

---

http://httpd.apache.org/docs/1.3/programs/htpasswd.html

---