URL Rewriting to Privately Access Files - php

Question

I'm trying to build a simple website which is going to let users upload files, and privately share them with other designated users. The problem is: I don't want anyone to be able to type in the url for a file to be able to get to it (then anyone could see it).
I decided to try using .htaccess to prevent direct url access, however, I cannot figure out how to access the file myself. All of the uploaded files are going to go into a subfolder called "restricted".
My ".htaccess" file is:
RewriteEngine on
RewriteCond {%QUERY_STRING} !^.*key=SECRET.*$ [NC]
RewriteRule ^restricted/(.*)$ showfile.php?file=$1
My "showfile.php" file:
<?php
echo file_get_contents('[...]/restricted/'.$_GET['file'].'?key=SECRET');
?>
However, when I open "restricted/test.txt" or some other file in the restricted folder, it successfully redirects to "showfile.php?file=test.txt", however, I get a php error:
Warning: file_get_contents([...]/restricted/test.txt?key=SECRET)
[function.file-get-contents]: failed to open stream: No such file or
directory in [...]/showfile.php on line 10
It seems like even though the query string contains "key=SECRET", it is still trying to redirect.
What I want: I want it to redirect on direct URL access, but that I can access it through the php page it's redirected to.

Answer 1

If you want to access the file as an HTTP resource instead of direct disk access (like in your question), you can do the following:
Code in .htaccess (placed the "nonpublic_test" folder):
RewriteEngine on
RewriteCond %{REQUEST_URI} ^.*/restricted/.*$ [NC]
RewriteCond %{QUERY_STRING} !^.*key=SECRET.*$ [NC]
RewriteRule ^(.*)$ /$1 [R=403,L]
Then in your showfile.php:
<?php
echo file_get_contents('http://www.domain.name.here/restricted/'.$_GET['file'].'?key=SECRET');
?>
This will prevent any access to the restricted folder and its contents but still allow your showfile.php script to access the file inside that folder and output it.

Answer 2

It would be better off to move restricted folder a level above site root and have your PHP code in showfile.php like this:
<?php
echo file_get_contents('/path/to/restricted/'.$_GET['file']);
?>
With rule simply as:
RewriteEngine on
RewriteRule ^restricted/(.*)$ showfile.php?file=$1 [L,QSA,NC]