when I use the CodeIgniter to upload pic to server , pictures are stored in '/controllors/file', and i have changed the file directory's permission to 777 already.But when i try to visit the url, "https://server/file/xxx.png" ,it returns 404. The url is correct, what's wrong with server ,please? My English is poor
if you want to store a picture, then save the file in a directory that is outside the codeigniter standard paths - .htaccess could be getting in the way. I suggest you have a structure like assets/images and store the images there.
Controllers are to serve files that require some sort of business logic - so does the user have access to the image etc?
Also look at the owner of the folder - it probably should have permissions of 755
Related
My question is, where should i save photos that will be uploaded from the users?
my root dir for the server is
C:/apache
here i have the folder that contains the php files C:/apache/htdocs . I was wondering where should i save the files, i heard it will be better if i saved it somewhere else than the htdocs (folder that contains the php scripts), but here is the thing. If i save it directly to C:/apache then i can't access the photos. While saving it to a new folder in C:/apache/htdocs/photos would make the photos folder visible or accesible from the php pages. Is there a way i can save them somewhere else, like, let's say one folder up from the htdocs folder?
EDIT: the .htaccess seems like a good solution. Though i'm curious about this 1 thing:
I was thinking, is it possible to have directories something like this?
--->phpfiles
|--->index.php
|--->another.php
--->photos
|--->1.jpg
|--->etc.jpg
And still somehow link those photos to my php files? Like making the server only view the phpfiles folder for links and all of that (so i can go to localhost/index.php and not localhost/phpfiles/index.php ) ?
EDIT 2: My server root is C:/apache, while my Document Root is C:/apache/htdocs. in case of any misunderstanding, sorry
I would suggest putting the uploads in a folder like you suggested with C:/apache/htdocs/photos and place a .htaccess in that file that prevents direct access to the folder. That way the folder won't be visible and they can't access the images without the file name.
Another solution would be to upload the images on a third party server.
In a PHP app I am allowing users to upload photos. Upon user upload, metadata is stored in the db and images are then stored in a directory on the linux server. I only want these images to be viewable when called through a view so I can verify that the correct party is viewing them. I do not want anyone to be able to just enter a url and view the image.
/site
/framework
/protected /**My PHP site**/
/www
/images /**This is where I am currently storing the images**/
In order to restrict viewing of these images do I need to move the images directory outside of www? If so to where?
What linux permissions should be given on the images directory?
For images that I have stored in my db that I want restricted access to I use access rules within my framework. Can rules such as these limit access to images in a given directory also?
Any info that can be provided as to how to approach this (so I can do further research) as well as answers to the questions above will be very helpful.
For all images in that directory to be denied (they ALL must be access through a script and none of them will have direct access available - ie only your server will be able to access them, and you have apache with mod_rewrite) you can put a .htaccess in that directory like the following:
deny from all
So to answer the questions by number.. ^^
No, the .htaccess will take care of it with the same effect.
You'll need read (+r) for the images for the server.
The framework may have something like that, but it can't prevent direct linking if the image URL is known. Doing it with .htaccess or moving the directory would be the best bet.
In order to restrict viewing of these images do I need to move the images directory outside of www?
No, but that is the most secure option.
If so to where?
Anywhere
What linux permissions should be given on the images directory?
The minimum you need for the server to read from and write to it. Possibly 700.
For images that I have stored in my db that I want restricted access to I use access rules within my framework. Can rules such as these limit access to images in a given directory also?
Since the images are only available via PHP, the PHP can add whatever auth/authz you like.
You could simply use a .htaccess file and restrict people from entering that directory, as well as turn off directory listing just in case.
When I link directly to an uploaded file in a Zend Framework based project I get differing results depending on if I'm working in my local environment or my remote environment.
In both cases I want to link to an uploaded photo. The generated URL looks like:
http://whateverserverweareon/projectfiles/project18/photos/aphoto.jpg
On my local machine clicking that link will show me the photo, in my remote machine it gives me a warning about "invalid controller..." (as, while I do not have a "projectfiles" controller, the uploaded photos are in the projectfiles directory on the path specified in that sample url).
So how do I link to these uploaded photos? Create a controller just so I can link to them? Can I bypass the controller altogether and link directly? Is there some sort of custom route I need to create? Should I be doing this in a completely different manner? Any suggestions?
The exception means that on remote mashine your file does not exists in specified location. Standard rewrite rules in .htaccess file is written so that if your file exists (i.e. /projectfiles/project18/photos/aphoto.jpg) then index.php file of ZF will not be executed. You should check that your file exists.
ischenkodv is right.
And also, it's a better practice to put your file somewhere out of index.php's directory tree. Perhaps another subdomain.
I wrote this VERY simple PHP login system:
<?php
session_start();
$error = '';
if (isset($_POST['username']) && isset($_POST['password']))
{
if ($_POST['username'] == 'user' && $_POST['password'] == 'pass')
{
$_SESSION['client'] = 'ok';
Header ("location: /kit/kit/index.php");
}
else
{
$error = 'Usuario o contraseña incorrectos.';
}
}
?>
Don´t worry about the vulnerability issues, it´s not protecting anything valuable.
In every .php page i add:
<?php
session_start();
if (!isset($_SESSION['client']) || $_SESSION['client'] != 'ok')
{
Header ("location: /kit/index.php");
die();
}
?>
This protects the .php sessions just fine.
The problem is that this doesn´t protect the files.
I mean if go directly to:
something/other/file.zip
it will download it wether you have loged in or not.
I hope the question is clear enough, if not, please ask!
To stop a user from seeing the directory, all you need to do is create an index page in that folder. Ex: index.htm, index.html, default.htm, default.html.
To stop a user from entering the folder (e.g. stop anyone from viewing http://www.yoursite.com/myFolder/), you may need to access some features of your web host. Some hosts allow you to password protect files or folders. You can also create an .htaccess file/folder
An htaccess file is a simple ASCII file, such as you would create through a text editor like NotePad or SimpleText. Many people seem to have some confusion over the naming convention for the file, so let me get that out of the way.
.htaccess is the file extension. It is not file.htaccess or somepage.htaccess, it is simply named .htaccess
Create the file
In order to create the file, open up a text editor and save an empty page as .htaccess (or type in one character, as some editors will not let you save an empty page). Chances are that your editor will append its default file extension to the name (ex: for Notepad it would call the file .htaccess.txt). You need to remove the .txt (or other) file extension in order to get yourself htaccessing--yes, I know that isn't a word, but it sounds keen, don't it? You can do this by right clicking on the file and renaming it by removing anything that doesn't say .htaccess. You can also rename it via telnet or your ftp program, and you should be familiar enough with one of those so as not to need explaining.
htaccess files must be uploaded as ASCII mode, not BINARY. This makes the file usable by the server, but prevents it from being read by a browser, which can seriously compromise your security. (For example, if you have password protected directories, if a browser can read the htaccess file, then they can get the location of the authentication file and then reverse engineer the list to get full access to any portion that you previously had protected. There are different ways to prevent this, one being to place all your authentication files above the root directory so that they are not www accessible, and the other is through an htaccess series of commands that prevents itself from being accessed by a browser, more on that later)
JUST INCASE stop users from downloading your file
store all things that are downloadable ourside your document root. which means before the public_html file.
EDIT: updated the section below to show graphical representation of folder structure
how do you access them then?
work
downloadableFiles
downloadables
- memberOnlyFile.zip
- welcomePackage.zip
- memberhshipVideoVideo.mov
photos
- photo1.jpeg
- photo2.jpeg
publi c_html
- index.htm
About
- about.html
- about.gif
LogIn
- login.htm
- loginScreen.htm
- loginFancyButton.gif
Now anything in the public_html folder the world can see through your website.
Anything outside your public_html folder, will not be visible directly to the world through your website by typing the file name into the address bar in their browser. so thats a good thing as we are going to save all our files that we dont want to give access to outside of the public_html folder.
Now say if you want a certain user to be able to download a file, say maybe a logged in user, you can still make the file downloadable by having a link to that file.
If we are at the login Page, to access the loginScreen webpage you just write down the hyperlink like so:
login screen
since that page is on the same folder. now if you want to allow a user to be able to download a file from the downloadable files folder which is outside the public_html folder since it is not in that folder it self youjust reference to it like so:
How would we get to that folder if we are in the login folder as we are viewing the loginScreen.htm page, you go one folder back so we end up being in the public_html folder. then we go another folder back so we are in the work folder.
so it would look like this so far.
../../ which means two folders back.
then to access the memberonlypath.zip we then need to go into the downloadableFiles folder then we need to get into the downloadable files and then we can link it to the file membersOnlyFile.zip which is the file we were lookng for before.
so the full link now becomes
download file
This way the user cannot access the file by simply typing it on the address bar but can download it if you reference it yourself like the above.
Hope this helps
PK
Store all files you don't want downloaded outside the DocumentRoot.
You need .htaccess to deny access to the folder.
Just have a php download script like: this one that will get the file below the public_html folder.
"Static" files are served by the webserver, not PHP, so authentication is handled differently. There are two easy ways around this:
Handle all authentication in the webserver, e.g. with HTTP basic/digest authentication. Apache 2.2 has a helpful introduction.
Serve the files with PHP, e.g. with foo.php/path/to/file if you have "pathinfo" enabled (according to the PHP docs you set AcceptPathInfo=ON in the server config somewhere) or foo.php?path=path/to/file, which is pretty terrible, but oh well.
There is a more enterprisey solution:
Write an authentication module for your download server which understands authentication cookies from the other site. Many big sites do this (adcdownload.apple.com comes to mind), partly so they can stick the downloads on a CDN but still have some sort of access control.
There is a lazy workaround:
Stick everything in an "unguessable" directory name (e.g. some random base64 chars). Make sure you can't list the parent directory (the easiest way is to create an empty "index.html" file).
I have read the following tutorial "Uploading Files To the Server Using PHP"
and have several questions related to the topics.
Q1> The tutorial mentions that
"Note that PHP must have write access
to $uploadDir or else the upload will
fail"
For me, I only allow the user to upload the file after the user has login to the website.
If we set that $uploadDir permission as 777, then everyone can have written permission to that folder. How to avoid this problems?
Also I am using WAMP as my testing bed, can I simulate the same case as a real web server?
Q2> In order to prevent Preventing direct access, the tutorial mentions:
"A better approach is to move the
upload directory away from your web
root. For example, the web root for
this site is:
/home/arman198/public_html/ to prevent
direct listing i can set the upload
directory to /home/arman198/upload/."
Now my problem is that how can I display the uploaded images on other website pages. Since, the upload is not accessible directly anymore? I need to display the uploaded image save personal headshot dynamically on other website page. Is it possible?
Thank you
It's a common problem.
All modern computers have a temporary files directory. On Linux/Unix it's /tmp, on Windows it's usually c:\temp. The OS install will have set permissions on that directory so that anyone can write files there but only privileged users can delete files that don't belong to them. This is where PHP will want to put an uploaded file; your application then has to move it elsewhere (this is the purpose of the move_uploaded_file() function). PHP under Windows may need upload_tmp_dir actually set in the php.ini file.
Once you have an uploaded file, you can shift it whereever you like, including to where the webserver can read it to serve it. The biggest problem with that it is awfully easy to put this directory inside your codebase. Don't do that. As soon as you do anything beyond editing the files inside the directory they are served from, it will be problematic. Trust me: I've dealt with a few times this in code I've inherited. It's easy to let your webserver load files from a location outside your codebase.
The other alternative is to produce a download script. That way the file need not be servable by the webserver at all. One disadvantage is that you don't get to leverage the web server's MIME translation, but then, that lets you control which types of image files are permitted.
For the second question, you can use a PHP script intead of direct access to the directory. Lets name it image.php. Lets assume that it can take a parameter id, like image.php?id=image_id. In that file you can get the id using superglobal array $_GET. Then you can search for images with that Id and just send it as response.
First one I'm not sure, but maybe play with .htaccess file.
And for the first question, try setting your permissions to 775. That should allow PHP to write the file to the directory without giving the general public write access.