I'm using php and MYSQL. I've created a members area where people can upload important images (basically for financial record). I was hoping to get some advice as to the best way to store these files. What kind of folder structure would be best? Ex domain.com/Files/UserName/RandomGeneratedName/Files.
Also any advice for chmod, .htaccess, .htpassword and any kind of password protection with php.
Thanks in advance.
I would recommend to store them outside the tree. In this way, by default you need to enable access to them, not disable access (just in case you have a bug in your .htaccess/config/code, the access to the files is disabled, not enabled)
Second, get rid of the random directory, it doesn't add much to the security, but it complicates the implementation unnecessarily
You can use php to check the member credentials, put the appropriate headers (mime type for ex., etag, etc.), and serve the file via passthru or something similar.
Best way:
protect the directory with .htaccess
add an index.html to directory "just in case"
use random file names to store them in your directory
use php/mysql to check if user has access rights to your files
example:
You have a file in domain.com/protecteddir/sdjasdu83299sdnYUsb.dat
You can use php/mysql to send to user to a virtual directory to download the file. You can throw the correct file header + file name via php. So even if the file is called sdjasdu83299sdnYUsb.dat the user would download it as "myfinancial.doc"
The user will never know what the real file is located nor its name.
Your .htaccess file should contain:
<Files *>
Order Allow,Deny
Deny from All
</Files>
you could .htaccess for URL Rewriting and get the index.php file (write this code: ) in folder that save your files, so when anyone want to enter this folder:
First: he dont know real address
second: due there is a index.php that offer to home page he could not enter.
Related
This question already has answers here:
How to password protect streaming videos with php
(4 answers)
Closed 4 years ago.
I have an interesting dilemma... I am hosting several .mp4 files on a WAMP server. I am well aware of the method of storing files outside of the document root and using a PHP script to authenticate a user before retrieving the file contents. However, these .mp4 files are required to be inside the document root. Is there any way that I can authenticate a user who is trying to directly access one of these files? I have tried a .htaccess rewrite that takes a requested URL ending in ".mp4" and redirects to a PHP script passing the requested file as a parameter, but of course this just loops.
This is the rewrite rule in the .htaccess file...
RewriteEngine on
RewriteRule ^(.*).mp4$ /media/auth.php?file=$1.mp4
The idea was, a user will try to access http://www.example.com/media/myVideo.mp4, this reuest would get routed to a PHP script (auth.php) that would pick up the requested file from the URL using $_GET['file'], it would authenticate the user using a $_SESSION variable, and then user a header('Location: ' . $file) to send the authenticated user to the actual file. Again, I realized quickly after implementing this that it would just loop...
Any help would be greatly appreciated. Thanks!
Here's why they cannot be outside the doc root...
#IdontDownVote, very complicated, but I'll attempt a short version... I have this MOSTLY working great with files outside the doc root, with one serious issue. When I access the files using the PHP script, I am able to view the video in the Chrome browser, play, pause, rewind, the whole deal. The only (big) problem is when I use this method, I am not able to Cast the video. When I access a .mp4 file directly, it gives me the option to Download or Cast, but using the PHP script, only the Download option is available. Believe me, I have tried everything including discussing with two Google developers. I posted on Stack Overflow about this issue here with no joy...
Why can't I cast an MP4 file served by PHP from outside of the document root?
I am not sure why this is getting downvoted, this is causing my a lot of headache and I am just looking for advice...
First off have you tested it when serving the file though PHP outside of the document root?
When I access a .mp4 file directly, it gives me the option to Download or Cast, but using the PHP script
If you can then you can simply block access to all but one PHP file and use that to dish it out (you could allow access to *.php too..
#.htaccess
Order Deny,Allow
Deny from all
<Files index.php>
Allow from all
</Files>
That will only allow index.php to be accessed in whatever folder (and sub-folders) the htacccese is put in. This might be better if you have a existing login system in PHP that you want to make use of for your users.
If you can't then the only way I can thing of is to try using BasicAuth, and Htaccess like this:
#.htaccess
Order Deny,Allow
Deny from all
AuthType Basic
AuthName "Admin Only"
AuthUserFile /pathto/.htpasswrd
require valid-user
Allow from all
Then in a file named .htpasswrd put some stuff like this:
admin:$apr1$o48wfurr$5WaWCjD85kBu/ydGKsQeq/
You can use something like this to hash the password.
http://www.htaccesstools.com/htpasswd-generator/
Then when you give Chrome the url, you'll have to include the user:pass# part to bypass the login.
http://user:pass#somedomain/path/to/video.mp4
If you wan't to tie this into an existing login, you'll have to create some system to sync the passwords in the htpasswrd file to those of your users. That really shouldn't be too hard. I made one to sync our site users accounts to sFTP server, that was a real pain because of security and we have 3 sFTP servers (legacy, normal and dev). Anyway you just basically have to keep a list of their user/password and then update the file when a user is created/deleted or changes their password.
Maybe it will work (I honestly don't know ... lol).
Worth a shot.
I have some txt files with informations, but this *.txt files is going to be readable and writable by server php, (for example include them or just check them).
but i dont what this files to be accesstable from browser for example the user must can not
view the files with http:// mysite/myfile.txt
what perrmission i have to set up for this files when php makes them?
You can't do that using permissions. In both cases server will read file.
You have to put this file in public parent directory (eg. in directory where is your public_html). This way you'll be still able to include it but noone can read it using browser.
Second option is to set correct .htaccess file to deny all users (it'll still allow you to read it from scripts), eg. like this:
order deny,allow
deny from all
Among many folders available on the server by default like "public_html", "public_ftp" or simply the root, which one is the best to upload and store users' images safely which I can also add a link to mysql db?
If your clients upload images via http form, store it in public_html if they need access it from web.
I recommend you to save the files somewhere in "public_html" and create the following file to restrict public access:
file: upload/.htaccess
deny from all
In your php script you can send the files only to the users with access.
In my opinion, store it outside of the public htdocs folder. This is so that if someone manages to upload anything other than an image file (such as an evil PHP script), they won't be able to call it (and it won't run).
If you're public_html folder is say /path/to/website/public_html I'd store them in /path/to/website/uploaded_images
Also, make sure you that validate it so that it uses a white-list of allowed image names (such as only allowing .jpg, .gif and .png)
Edit:
You also need to create a script which opens the image file and passes it through back to the user
Define safely.
If you want to display these images on a site, that will be a folder in public_html, obviously, unless you want to use a script which presents the images to the user, possibly altering the image on-the fly, changing cache headers etc. Then you may move that folder outside of docroot anywhere the script will have access to those files.
Personally I store user images, files and everything in docroot, protected by .htaccess and accessed via a script which handles user permissions, if necessary. The files reside in an /uploaded folder with subfoldering up to 2 levels deep, each 'level' storing up to 1024 dirs/files. Files are named by their ids only, without any extension, all file info is stored in database. Took me some time to implement, but thankfully this is a reusable code.
Any folder inside your document root is fine. If you want it to be secure, make sure your script accepts only allowed file typed and, as another measure, put an .htaccess file inside that folder:
<FilesMatch "*.php">
SetHandler None
</FilesMatch>
This will ensure nothing get's executed from inside this directory.
I have a directory of files that logged-in users can upload to and access. Some of the files are public, and others are private - for internal access only. The filenames and access settings are saved in a database.
Can anybody give me some resources or show me an example of how i can use session data (and .htaccess?) to allow access of private files only to authorized users?
I'm thinking it might be easier to keep public documents in a seperate, unprotected directory, though i'd kind of like to keep everything together.
I'm not concerned about top-level security or encryption, as the files aren't terribly sensitive, but i want to keep them from being indexed on search engines, etc.
thanks!
I suppose I wouldn't use a .htaccess (or any kind of HTTP-authentication) for that : .htaccess / .htpasswd are great when you want to allow/deny access to a whole directory, and not to specific files.
Instead, I would :
Deny any access to the files -- i.e. use a .htaccess file, containing Deny from All
That way, no-one has access to the file
Which means everyone will have to use another way to get to the files, than a direct URL.
Develop a PHP script that would :
receive a file identifier (a file name, for instance ; or some identifier that can correspond to the file)
authenticate the users (with some login/password fields), against the data stored in the database
if the user is valid, and has access to the file (This is if different users don't have access to the same set of files), read the content of the file from your PHP script, and send it the the user.
The advantage is that your PHP script has access to the DB -- which means it can allow users to log-in, log-out, it can use sessions, ...
About the "send the file from PHP", here are a couple of questions that might bring some light :
Sending correct file size with PHP download script
Resumable downloads when using PHP to send the file?
forcing a file download with php
I'd create a custom index script in PHP -- something that would show the files dynamically. Use that to keep only the right files being listed -- afterwards, to further protect the files, fetch file contents dynamically -- Pascal MARTIN's links show you how to use PHP to control the file streaming, you can use that to block access from hidden files to users that aren't supposed to get to them.
Current status.
I have to set
606 for my foobaa.txt.
I wrote a php code,
that read and write
foobaa.txt,
and I want to make the
permission of the foobaa.txt as
600.
But when I tested 600,
the PHP code can not read and write
foobaa.txt.
so I changed to 606 the foobaa.txt,
then my PHP code can read and write
the foobaa.txt.
this is problom, because
when someone put
ttp://blabla.foobaa.com/foobaa.txt
directly, then he can see the contents of the
foobaa.txt.
This is security hole.
so I want to make 600 for the
permission of the foobaa.txt,
but if I do so, then
the php code can not read and write
foobaa.txt.
I think the admin can modify some
apatch settings for we can set the
txt file's permission as 600.
or do I have to do some other things?
like .htaccess or something.
Your PHP code runs as the web server, not the user that is SSH'ing into the account and changing the permissions. So if the text file is readable by the script, it is readable by the server. You will want to control outside users' access to the file by one of a couple of methods.
Put the file outside your DocumentRoot, so that the script can access it, but it's impossible to request by HTTP.
Put the file in a directory with a .htaccess file that reads simply Deny From All. You could also protect the file individually, but it's likely that you'll have other, related files that should be kept private. You can just put those in the same directory.
You could restrict access through .htaccess:
<Files foobaa.txt>
Deny from all
</Files>
or something similar. But this isn't perfect... better would be moving the file outside your public_html (or equivalent) folder.