Control Access to Filesystem with PHP

Question

I previously posted here:

http://stackoverflow.com/questions/3731171/controlling-access-for-trial-subscription

Since this is a new question based on suggestions there, I thought I should start a new post. If this should have been an edit, please let me know for the future.

I think the solution I'm going with to control access will be to upload a file and hash the name. The file will be in the format:

/uploads/#############.pdf

A link will be sent to subscribers. The first time they come to the site, they'll be asked to create a "pin" and a "hint" to remember. Then can then access a landing page to list their items via an email address/pin combo.

My question is: I know I can control the access to the page that shows what items they can view, but is there a way to control the /uploads/[file] to only be download-able after some kind of programmatic check? I can't think of any way to do this....

Thanks again. D.

Answer 1

Your pdf files don't have to be in a user viewable directory. They can be outside your web root. That way, noone can actually browse to www.yoursite.ext/uploads/2395wrfhgt.pdf to download it himself or share the link with others.

In order to download the pdf you'll have a dedicated script that will do all the access checks on the user that's requesting it, and if all ok it will set the appropriate headers, read the file from the filesystem, and print it out to the user.

So, lets say your site is at /var/www/site/htdocs/ and you upload every pdf into /var/www/site/uploads/ . You don't even need to hash the filenames but instead can keep them nicely named for easy organization.

Then, all the links to download a file will be made to point to www.yoursite.ext/download.php?id={fileid}

Your download.php will do all the access checks (properly logged in, has permissions to download the file etc), and then do the following:

$pathToPdf = '/var/www/site/uploads/some.pdf' ;

header('Content-Type: application/pdf');
header('Content-Length: ' . filesize($pathToPdf));
header('Content-Disposition: attachment; filename=' . 'some.pdf');

readfile($pathToPdf) ;

And that's pretty much it. Once you get this working you can look into improving a few things:

• use mod_rewrite or similar to have the actual pdf filename in the link, which helps some browsers realize they should download it: www.yoursite.ext/download/{fileid}.pdf
• consider using the web server instead of php to serve files, eg X-Sendfile header