So, I have a client requesting a solution to password protect files. He wants to basically have a solution similar to OpenDocMan. However he showed me something from another client that basically just password protects the file itself no user name. So he can upload files, put a password on that file, send links directly to that file and then when users click on a link they are prompted with the password and then the clients puts it in and the file is released. Anyone know of a solution that can do this exact requirement?
You can setup a basic validation page so that when a user visits a page they enter the document id (or it's encoded in the link) and you put up a simple form with a password field and a submit button.
If the password matches what is stored in the database for that document id. send that file to the user.
Keep the uploaded files outside the /web directory so you don't have to worry about people hacking the system by guessing filenames.
The files themselves won't have passwords on them, but the only way from the outside to get the file is to have the password.
If you don't have to have a unique password for every file, you can try apache's mod_auth. You drop a .htaccess & .htpasswd file in the directory you want to protected, and update the users/passwords in the .htpasswd file.
If you want something more dynamic, try mod_auth_mysql, so you have better control from your application.
Related
My question seems to be similar to others here in SO, I have try a few but it doesn't seem to work in my case...
I have develop a site in which you have to fill up a form and then it returns a PDF file that you can download or print, this file is saved so you can retrieve it later
public_html
|_index.php
|_<files>
| |_file_001.pdf
| |_file_002.pdf
|_<asstes> ....etc
that is how my files and folders look on the server, anyone can easily guess other files, .com/folder/file_00X.pdf, where X can be change for any other number and get access to the file... the user after finish with the form the script returns a url .com/file/file_001.pdf so he/she can click on it to download...
a year ago I did something similar an script to generate PDF's but in that case the user needed the email and a code that was sent via email in order to generate the PDF and the PDF's are generated on demand not saved like in this case...
Is there a way to protect this files as they are right now?
or, do I have to make it a little bit more hard to guess?
something like.
.com/files/HASH(MD5)(MICROTIME)/file_(MICROTIME)_001.pdf
and save the file and folder name in the DB for easy access via admin panel, the user will have to get the full URL via email...
Any ideas would be greatly appreciated.
For full security i would move the PDFs out of the public folder and have ascript in charge of delivering the content. If the form is filled correctly, you can generate a temporary hash and store that hash and the pdf path in the database. That way the user will have access to the file as a link through the retriever script, but you will control for how long he will have that link available.
Imagine the temporary link being http://yourdomain/get_pdf/THIS_IS_THE_HASH
Move the PDF's to some non-public folder (that your web server has access to but the public does not). Or you can use .htaccess to restrict access to the pdf's in their current location.
Write a php script that returns the correct pdf based on some passed in http variable.
You can secure/restrict this any way that you want to.
For example, one answer suggested using a temporary hash.
Other options for restricting access:
Store in the user's session that they submit the form and have a download pending, that way no one could direct link.
Check the referrer header. If it is a direct request then do not serve the file.
Here is a code example using the last option:
$hash_or_other_identifier = $_REQUEST["SomeVariable"];
if (!$_SERVER["HTTP_REFERER"])
{
//dont serve the file
} else {
//lookup the file path using the $hash_or_other_identifier
$pdfFile = somelogic($hash_or_other_identifier);
//serve the correct pdf
die(file_get_contents($pdfFile));
}
I don't even think that keeping the file name secret is a very big deal if all you are worried about is people typing it into the URL bar because you can simply check if it is a direct link or not. If you are also worried about bots or clever people who will create a link that points to your file so it looks like a referrer, then you will need to add stricter checks. For example, you can verify that the referrer is your own site. Of course headers can be spoofed so it all just depends how bulletproof it needs to be.
The url would be something like: http://yourdomain/pdf?SomeVariable=12345
However, you don't have to use an http variable. You can also use a url fragment with the same result, eg: http://yourdomain/pdf/12345
General guidelines:
File is not in the directory that's accessible via HTTP
Use a database or any other storage to link up file location with an identifier (an auto incremented number, guid, hash, whatever you deem fit). The location of the file could be in the server's file system or on a shared network location etc.
Instead of hashes, it's also practical to encrypt the ID generated by the database, base64 encode it and provide it back - that makes it nearly impossible to guess the valid string that one needs to send back in order to refer to a file
Use a PHP script that delivers the file if user authentication passes (in case you need authenticated users to be able to retrieve the file)
This is my doubt: I want to create a login page to acess an html page (I will use a form and a MySQL database for that).
The problem is, if someone knows the name of the html page, they can go there directly, without having to login, which is something I dont want. How do I prevent this?
Example: I have an abc.html page, and I create a login.php page to acess abc. But if I know the name and address of the abc page, I can just type on my naviagtion bar: www.somesite/abc.html , and I can go to the abc page without logging in.
If you're unwilling to rename your webpage from abc.html to abc.php, the best option, as Peter mentions, is likely to use htaccess to require a password for the page (provided of course your webserver is running Apache).
By using this method, you don't need to create a login.php page and open yourself up to all sorts of vulnerabilities (most 'custom' login scripts that require passwords nearly always isn't written in a secure manner).
Here's how you'd go about creating a password protected page with htaccess:
Password protection with htaccess
Create both a .htaccess file in your root directory of your site, and a .htpasswd in the directory you'd like to protect
Edit the .htaccess file so it contains the following code:
AuthType Basic
AuthName "Some message to be displayed to the user"
AuthUserFile /your/path/to/.htpasswd
Require valid-user
Edit the .htpasswd file so it contains your list of credentials. These are line separated, so if you'd like more than one user to access it, simply add a new user on a new line. The syntax is as follows:
username:password
The password should not be stored in plain text though. You'll need to use a htpasswd generator, such as David Walsh's here, to create an encrypted password.
There are several options you could use.
Assuming you're using Apache as a webserver, you could configure it to require a password itself without having a separate login page (http://httpd.apache.org/docs/2.2/howto/auth.html).
Otherwise you could on your login page use a $_SESSION variable once you validate the user (http://php.net/manual/en/reserved.variables.session.php) and then check for that on the html page and if it's not there then redirect.
Actually this is about a cloud storage web app
A web app where user have their own private folder and i want they should have their own folders too .What could be the best way, to tell uploader that the file being uploaded has to be in specific folder in which user is in.
So what i thought is whenever a folder is created and opened a session which stores folder name is started and sent to uploader where Uploader that way uploads.
For eg $_SESSION['folder-name']='x'
$upload_dir= "/$_SESSION['username']/$_SESSION['folder-name']/"
Every user has specific private directory where they can upload files. So there is no chance that session can be manipulated to upload in wrong user directory.
Since now i see this way as the best way, is there any alternative i can get from stackoverflow community on this . if yes, please describe
Since your username is unique I suppose then I seems legit.
But lets see this scenario:
A user get's deleted and another one registers with the same username...
EDIT
It depends on the fs and many other factors. Eg is this going to be url accessible ?
An legit alternative could be:
Since the username as you set it seems to be unique then you could first md5 it (is quick) and then digest to hex if you want it shorter and url accessible. That will give you a good number of usernames that can be converted to folders.
Bad thing about this is that you can't find the user by the folder name. If you had that in mind
That's it.
One section of my site allows users to upload files. These files are not uploaded to the server that the website is hosted on (let's say site.com), instead they are uploaded to s1.site.com, s2.site.com etc. These subdomains point to servers on a different IP address than the main server. I am using the Uploadify jQuery plugin for file uploads.
Now, when a user is logged in and uploads a file, I want that uploaded file to appear in their account page under "files". I'm stuck on what the best way to do this would be.
I can set options for Uploadify to send additional POST data along with the upload. The simple solution would be to just send the username of the user uploading the file along with the file upload, however other users could spoof their username and upload files into other peoples accounts. Not cool. So I need a way to tell what user is uploading the file while stopping username spoofing.
I thought about sending the users session as POST data, kind of like this:
$('#file_upload).uploadify({
formData : { '<?php echo session_name();?>' : '<?php echo session_id();?>' }
});
But I don't really know a thing about sessions. CodeIgniter is handling my user logins. Would this work? Could someone explain to me exactly how I'd go about doing this?
Thank you.
I like to do things like use md5 hashing to create a unique Hash Value based on the Username. I do this once the user has created his or her account for the first time. Then I store that hash value in a column called hash_validation.
Next, I would (upon user login(you use CodeIngiter for this)) create a session variable for the hash value. Then I can check the hash value against the table and the username for security purposes. It's as simple as ->
$_SESSION['hash_value'] = $row['hash_validation']; //general example of grabbing the row we created
I like to hide my SESSION values in a div on the page so I can constantly reference them with JavaScript without having to communicate with the server.
Once we've done all the above, we can use the formData method to send over the hash value to the server (without using php like you did above.) Then the server can check the hash value against existing hash values for said username in the table, and if it's correct, we'll upload the file.
I want my files to be secure in my web server. Only authenticated users to access those files should be able to access those files. I thought of storing files in database as "Long BLOB" but it supports only upto 2MB of data. The file size may exceed beyond 50MB. is there any other better way to secure the files? please help me.thanks in advance.
Don't store them in a database. Put them in your web directory and secure them using .htaccess.
If you want to authenticate via other means, then store the files in a directory that isn't web-accessible but is readable by the user php runs as.
Discussion
If you opt to keep high value downloadable content files directly on the filesystem, the best thing to do is to keep them outside of the webroot.
Then, your application will have to solve the problem of creating URLs (url encoding when necessary) for content (PDF's, Word Docs, Songs, etc..).
Generally, this can be achieved by using a query to retrieve the file path, then using the file path to send content to the user (with header() etc ..) when he or she clicks on an anchor (all of this without the user ever seeing the true, server side file path).
If you do not want user A sharing URLs for high value downloadable content to user B, then your application must somehow make the links exclusively tied to user A. What can be done? Where should I start?
Obviously, you want to make sure user A is logged in during a session before he or she can download a file. What is not so obvious is how to prevent a logged in user B from using a URL sent from user A (to user B) to download A's digital content.
Using $_SESSION to store the logged in user's ID (numerical, or string) and making that part of the eventual query (assuming content is tied to user purchases or something) will prevent a logged in user B from downloading things they have not purchased, but you will still incur the resource hit for processing the SQL empty set for items they have not purchased. This sounds like a good step two.
What about step one? Is there something that can prevent the need to do a query to begin with?
Well, let us see. In HTML forms, one might use a XSRF token in a hidden field to verify that a submitted form actually originated from the web server that receives the POST/GET request. One token is used for the entire form.
Given a page of user specific things to download (anchors), one could embed a single token (the same token, but different per page request) into each anchor's href attribute in the form of a query string parameter and store a copy of this token in $_SESSION.
Now, when a logged in user B attempts to use a logged in user A's shared URL, the whole thing fails because user A and user B have different sessions (or, no session at all), and thus different tokens. In other words, "My link is the same as yours, but different." Anchors would be tied to the session, not just to the page, user, or content.
With that system in place, PHP can determine if a request for content is valid without getting the database involved (by comparing the submitted token to the one in $_SESSION). What is more, a time limit can be established in $_SESSION to limit the duration/lifetime of a valid XSRF token. Just use the time() function and basic math. Sixty minutes might be an ideal token lifetime for an anchor in this situation. Have the user login again if the token for a clicked anchor has expired.
Summary
If you use files on a filesystem and store the paths in the database, make sure you do the following (at minimum), too.
Apply proper file permissions to your content directory (outside of webroot).
Use random names for uploaded files.
Check for duplicate file names before saving a file from an upload.
Only logged in users should be able to download high value content.
Have an effective $_SESSION system that deters session fixation.
Make URLs for high value downloadable content unique per page by using hashed XSRF tokens.
XSRF tokens cover more scenarios when they have a terminal life time.
Make SQL queries for user content based on the logged in user's ID, not the product exclusively.
Filter and validate all user input.
Use prepared statements with SQL queries.
A few options come to mind.
If you are using Apache you can use htaccess to password protect directories. (first googled link : http://www.javascriptkit.com/howto/htaccess3.shtml)
or
Store the files above the web server.
Create a script in php that will allow authorised users to access them.
If you want to do it Via FTP, and you are running cpanel you may be able to create new ftp accounts. check yourdomain.com/cpanel to determine if you have it installed.
Storing files in DB is very bad practice. Very good practice to store only information about file. Name, extension. Files save on server like $id.$ext. It will be a good architecture. And when user download file, he take file with name in DB.Sorry for my english.
The best way is to store the file reference in Database. The file itself will be stored in the server filesystem. The complexity of this is making sure there is reference integrity between the database file reference and the existing file in the server filesystem. Some database such as sql server 2008 have feature that maintain the integrity of the file references to the actual file itself.
Other than that securing the file itself in the server depends on the OS where permissions can be configured to the specific folder where the file reside.
If the files are purely static you could use read-only or WORM media to store the data files or indeed run the complete web server from a "LiveCD". It's certainly not suited to everyone's needs but for limited cases where the integrity of the data is paramount it works.
Downloadable files can be stored in htaccess protected folder/s. A script like the one below can be used to generate dynamic links for downloadable files.
for ex. Secure download links. http://codecanyon.net/item/secure-download-links/309295