I have uploaded some zip files to my server and now want to allow a user to download them if he/she has an appropriate password. I'm coding in PHP and I've made it so a user cannot access the page with the links to zip files unless the proper password has been entered, but by having a link to my zip file the user could just see and in future cases type in the absolute location of the zip file and bypass my password checks. If I change the file permissions on the zip file then I can't have it as a link because the user won't be able to access it. How can I allow the user to get the zip file while still keeping it secure? Any suggestions would be much appreciated.
The best way to do this is to mask url.
user logins
generate a token based on his login details. some md5 or whatever you decide
create a download link (eg: download.php) that load the file based on valid token and session and get's the file with file_get_contents().
Use .htaccess to deny direct access to files. Put this .htaccess file in relevant folder.
Then from php authenticate user and after successful authentication, redirect user to a download.php with file name as a parameter (or even id), then use force download to let them download. This way even if they have direct link to zip file, they will not be able to download the file.
You need to write code that can hide download links/ the links need to expire and new links should take its place and/or links should change.
You can code it in PHP or use an existing piece of code that exactly does this.
http://sixthlife.net/product/secure-download-links/
Related
I am currently busy with a website which basically does the following:
someone uploads a file then some processing is done on that file and then the completed file is stored in a directory called /documents.
Inside of my php script I generate a random number which allows multiple documents to be stored simultaneously, for example a document might be stored in /documents/145214693/file.pdf.
The user then has the option to download the document.
Inside of my /documents folder I have a .htaccess file which Deny's anyone to access the /documents folder by typing it into the URL bar, for example when someone types www.example.com/documents/ they will receive "Forbidden".
Now the issue is, this also disallows anyone from downloading the file.
Is there a way in which I can generate a random code and inside of my htaccess file I specify that only someone with that specific code is allow to access that specific directory?
In short, when someone uploads a file it is stored in /documents/256984128/test.pdf, then generate a random code which is passed through the URL for ex,
www.example.com/documents/256984128/test.pdf?code=<random code here>
and only if the code is correct access is granted to the file.
Thanks in advance!
I'd like to protect some files with a session Authentication. Some files can be viewed by users, some not.
I've impelemented a solution with mod_rewrite and readfile(). My problem is that this function will use a lot of ram and the server goes down when more users download files.
I tried this:
1) Pass a file trough the php handler and use the prepend function. It doesn't work because when the prepend php file finished the handler process the file, and in my case the handler was blocked because of invalid ASCII chars. I couldn't manage to stop the handler from processing but output the file.
2) Put the session, ip and the folder name in a temporary file what I tried to check in my nginx.conf to exclude from rewriting. I failed because I was not able to extract only the folder name in nginx into a variable.
How can I solve this problem? Has anyone a suggestion?
Thanks
If I understand the question correctly, you are trying to create a system that only allows authorised users to view certain files, and other users to view other files.
If my understanding is correct, then I would personally store the files above the root or in a secure location, and then have an access script (such as fetch_file.php) with a unique identifier in the URL (e.g. fetch_file.php?uid=1234).
If the user is authorised to access the file with the unique id of 1234; provide the file from the location details within the database, otherwise deny the request.
This way, the user can not access the file without the correct permissions, as it is stored securely above the root which should not be accessible from the internets.
I have this in my code:
Sample PDF
So basically it will appear to be a download link to file 'sample.pdf' but the problem is, there's a restriction in downloading this file. so whenever there are confidential reports uploaded and a malicious user accidentally memorized or viewed the URL of the download link in the browser history he can easily download it even without accessing the website because it is a direct link. What am i supposed to do so this link will be protected? or be downloaded only for the user assigned to it?
Don't serve up files by their direct URLs. Have a PHP script receive the filename of the file wanted, and serve it up.
So, if someone wants to download the above files, he would go to
example.com/getfile?file=sample.pdf
Your PHP script would check if the current user has permission to view the file, and then serve it up.
Make your links like this:
Sample PDF
Your current method is very insecure for sensitive files. A malicious user could trivially write a script to download ALL files in res/pdf. All he needs to do is check every permutation of letters in the directory, and throw away all 404 errors.
You will not redirect the user since that would defeat the purpose. You will serve the file as a download with the appropriate Content-disposition header.
Here's an example: Fastest Way to Serve a File Using PHP
You can google and get many more examples.
Here's a great example that shows how to serve PDF files:
https://serverfault.com/questions/316814/php-serve-a-file-for-download-without-providing-the-direct-link
You can restrict using htaccess
I have a WordPress site, in which type1 users can upload *.doc files and type2 users should be able to open them by clicking on a link which represents a file.
The file then should be opened in a new window of the browser.
I got the first part easily - there are many guides on uploading a file.
But I couldn't find one that goes through all the steps of getting and opening a file which resides on a server directory.
I assume clicking the link should cause an ajax request which will send the file key to the server.
The server can then get from the MySQL DB the file name and location.
But what do I do then?
How do I get the file from the server directory, send it back to the client and open it for reading in the browser?
Edit:
I want the files to be confidential and not let just anyone read them so giving the users the link for the file on the server isn't the right way.
I still think I need to send the file from the server directory to the client.
How can this be done?
You can add links to uploaded media in WordPress easily. Just remember to link to the actual file:
I want the files to be confidential and not let just anyone read them so giving the users the link for the file on the server isn't the right way.
Yes it is. You can't let people read the document without giving them the document.
If you want to keep it confidential, then require the users to agree not to share the link with anyone else. Or go further and add a layer of authentication + authorisation and also require that users not hand over their credentials.
Simply, redirect the browser to the location of the file. It's depend on user's browser settings that file opens on the browser directly, or user sees open/save dialog.
But, if you want to open the file inside the browser without letting user download it, you should redirect her/him to a custom page. e.g. a page that loads a doc editor.
There's no way to show a Microsoft Word file inside the browser unless they install proper software. e.g. an Applet or ActiveX or something that be able to open MSWord files.
Consider using WP Client File Share plugin.
I am trying to create a secure file transfers between a client and a user by which I have the client Upload files, and click on which ones they wish to share with the user.
My problem comes when the client passes a url to a user (This url is stored in the database)
ie: http://www.example.com/files/my-new-file.pdf
So then the user clicks on the URL and now becomes unsecure, because anyone technically could download this file. How do I make it so this file is ONLY able to be downloaded by the specified users.
I hope this makes some sense in what i'm trying to do and am trying to make sure these files are secure. Any thoughts would be appreciated.
You should use a PHP page to control access to the resources, rather than having the /files/ directory serve the content directly via the web server.
For example, a simple PHP page can read a file from the filesystem and serve this up so that it is downloaded to the browser.
http://www.higherpass.com/php/Tutorials/File-Download-Security/
You would want to ensure:
Only valid files can be downloaded
The request is from a valid authenticated user who is allowed to access the requested file
The simple example in that URL is vulnerable to directory traversal in the file parameter. You should validate any filename that is passed to your PHP script to protect against "../.." type attacks. This can actually get quite complex.
What may work for you is to have a token system where files are referenced by a unique, complex, random token. The database stores the actual file location on the filesystem, and when a request is recevied such as /download.php?token=blah... you lookup a) the location of the file referenced by token "blah", and b) that the session of the calling user is permitted to access the file. If all is well, serve the file to the user, otherwise raise an error and log the illegitimate access.
Protect image path - PHP
Hope this help you.
I believe adding security preferences to the registered users will make the things work.
You need to have user logged in to upload the file.
Otherwise, whenever somebody uploads a file, ask his/her email address and send a string key (randomly generated by your server and mapped to the uploaded file) which may be used by the user who wants to download as password.
Share that key with the users who uploader wants to share...