PHP - make file accessible for script but not for users - php

I want users to be able to upload files, but I don't want them to be able to view the contents of the folder which the files are uploaded to. A PHP script should be able to browse and read the files in the hidden (for the users) folder.
Any ideas?

Upload to a folder that's not in public_html - they can then only be accessed via FTP or the server itself, not by HTTP.

Theres multiple ways of accomplishing this.
option1 : like kolink says, place the files outside of your webroot (public_html)
option2 : use a .htaccess where you deny access to the dir, if you dont want the files to be listed you can use the following in your .htaccess
Options -Indexes
You might also wanna look at the permissions for the files using chmod.

Not totally secure, but a simple solution would be to place an index.php file in the folder you don't want accessed, that redirects the user back to the homepage. This will mainly prevent easy browsing of unindexed folders.
<?php
header('Location: ../../index.html');
?>

Related

How should i save photos with php/apache?

My question is, where should i save photos that will be uploaded from the users?
my root dir for the server is
C:/apache
here i have the folder that contains the php files C:/apache/htdocs . I was wondering where should i save the files, i heard it will be better if i saved it somewhere else than the htdocs (folder that contains the php scripts), but here is the thing. If i save it directly to C:/apache then i can't access the photos. While saving it to a new folder in C:/apache/htdocs/photos would make the photos folder visible or accesible from the php pages. Is there a way i can save them somewhere else, like, let's say one folder up from the htdocs folder?
EDIT: the .htaccess seems like a good solution. Though i'm curious about this 1 thing:
I was thinking, is it possible to have directories something like this?
--->phpfiles
|--->index.php
|--->another.php
--->photos
|--->1.jpg
|--->etc.jpg
And still somehow link those photos to my php files? Like making the server only view the phpfiles folder for links and all of that (so i can go to localhost/index.php and not localhost/phpfiles/index.php ) ?
EDIT 2: My server root is C:/apache, while my Document Root is C:/apache/htdocs. in case of any misunderstanding, sorry
I would suggest putting the uploads in a folder like you suggested with C:/apache/htdocs/photos and place a .htaccess in that file that prevents direct access to the folder. That way the folder won't be visible and they can't access the images without the file name.
Another solution would be to upload the images on a third party server.

How to stop direct access to a specific folder?

I have a folder in my website that is a kind of service. Other pages get data from this folder php files with ajax.
Now I don't want direct access to this folder or php files in this folder
Is there a way to do that?
If I understand correctly. you just want to deny access to the some folders?
You can put a .htaccess file in that folder that contains just:
deny from all
That way you cannot open any file from that folder, but you can include them in php without any problems.

How to not give direct acess to folder but to it's inside documents

environment
---------codeigniter framework
----------document sharing, links to download the files
mission
--------------files are allowed to download
--------------the folder which contains the files are
not allow to be seen by the user
Here I want to prohibit the user from seeing that folder, if I type the folder address I see all the files, I want to deny it. but the inside file not deny accessible
thanks in advance
Put a .htaccess file in that folder. .htaccess files are used by the server to follow some set rules. You should create this file with a basic text editor such as notepad, but not MSWord or a wysiwyg editor.
Search your FTP, there might already be one, it might also be hidden so make sure you open the FTP with the option to see all files option -a.
In the retrieved or newly created file, put the line
Options -Indexes
This will disable folder listing, giving a "Forbidden" error.
Another option, is to simply put an index.html or index.php file in the folder, that way when typing the folder name as URL will serve the index page instead of the folder root. And it also allows you to display a user friendly error.
Personnaly, I use both options.

Uploading files and keeping them safe

I'm using php and MYSQL. I've created a members area where people can upload important images (basically for financial record). I was hoping to get some advice as to the best way to store these files. What kind of folder structure would be best? Ex domain.com/Files/UserName/RandomGeneratedName/Files.
Also any advice for chmod, .htaccess, .htpassword and any kind of password protection with php.
Thanks in advance.
I would recommend to store them outside the tree. In this way, by default you need to enable access to them, not disable access (just in case you have a bug in your .htaccess/config/code, the access to the files is disabled, not enabled)
Second, get rid of the random directory, it doesn't add much to the security, but it complicates the implementation unnecessarily
You can use php to check the member credentials, put the appropriate headers (mime type for ex., etag, etc.), and serve the file via passthru or something similar.
Best way:
protect the directory with .htaccess
add an index.html to directory "just in case"
use random file names to store them in your directory
use php/mysql to check if user has access rights to your files
example:
You have a file in domain.com/protecteddir/sdjasdu83299sdnYUsb.dat
You can use php/mysql to send to user to a virtual directory to download the file. You can throw the correct file header + file name via php. So even if the file is called sdjasdu83299sdnYUsb.dat the user would download it as "myfinancial.doc"
The user will never know what the real file is located nor its name.
Your .htaccess file should contain:
<Files *>
Order Allow,Deny
Deny from All
</Files>
you could .htaccess for URL Rewriting and get the index.php file (write this code: ) in folder that save your files, so when anyone want to enter this folder:
First: he dont know real address
second: due there is a index.php that offer to home page he could not enter.

Forbid access to files in a simple PHP login system

I wrote this VERY simple PHP login system:
<?php
session_start();
$error = '';
if (isset($_POST['username']) && isset($_POST['password']))
{
if ($_POST['username'] == 'user' && $_POST['password'] == 'pass')
{
$_SESSION['client'] = 'ok';
Header ("location: /kit/kit/index.php");
}
else
{
$error = 'Usuario o contraseña incorrectos.';
}
}
?>
Don´t worry about the vulnerability issues, it´s not protecting anything valuable.
In every .php page i add:
<?php
session_start();
if (!isset($_SESSION['client']) || $_SESSION['client'] != 'ok')
{
Header ("location: /kit/index.php");
die();
}
?>
This protects the .php sessions just fine.
The problem is that this doesn´t protect the files.
I mean if go directly to:
something/other/file.zip
it will download it wether you have loged in or not.
I hope the question is clear enough, if not, please ask!
To stop a user from seeing the directory, all you need to do is create an index page in that folder. Ex: index.htm, index.html, default.htm, default.html.
To stop a user from entering the folder (e.g. stop anyone from viewing http://www.yoursite.com/myFolder/), you may need to access some features of your web host. Some hosts allow you to password protect files or folders. You can also create an .htaccess file/folder
An htaccess file is a simple ASCII file, such as you would create through a text editor like NotePad or SimpleText. Many people seem to have some confusion over the naming convention for the file, so let me get that out of the way.
.htaccess is the file extension. It is not file.htaccess or somepage.htaccess, it is simply named .htaccess
Create the file
In order to create the file, open up a text editor and save an empty page as .htaccess (or type in one character, as some editors will not let you save an empty page). Chances are that your editor will append its default file extension to the name (ex: for Notepad it would call the file .htaccess.txt). You need to remove the .txt (or other) file extension in order to get yourself htaccessing--yes, I know that isn't a word, but it sounds keen, don't it? You can do this by right clicking on the file and renaming it by removing anything that doesn't say .htaccess. You can also rename it via telnet or your ftp program, and you should be familiar enough with one of those so as not to need explaining.
htaccess files must be uploaded as ASCII mode, not BINARY. This makes the file usable by the server, but prevents it from being read by a browser, which can seriously compromise your security. (For example, if you have password protected directories, if a browser can read the htaccess file, then they can get the location of the authentication file and then reverse engineer the list to get full access to any portion that you previously had protected. There are different ways to prevent this, one being to place all your authentication files above the root directory so that they are not www accessible, and the other is through an htaccess series of commands that prevents itself from being accessed by a browser, more on that later)
JUST INCASE stop users from downloading your file
store all things that are downloadable ourside your document root. which means before the public_html file.
EDIT: updated the section below to show graphical representation of folder structure
how do you access them then?
work
downloadableFiles
downloadables
- memberOnlyFile.zip
- welcomePackage.zip
- memberhshipVideoVideo.mov
photos
- photo1.jpeg
- photo2.jpeg
publi c_html
- index.htm
About
- about.html
- about.gif
LogIn
- login.htm
- loginScreen.htm
- loginFancyButton.gif
Now anything in the public_html folder the world can see through your website.
Anything outside your public_html folder, will not be visible directly to the world through your website by typing the file name into the address bar in their browser. so thats a good thing as we are going to save all our files that we dont want to give access to outside of the public_html folder.
Now say if you want a certain user to be able to download a file, say maybe a logged in user, you can still make the file downloadable by having a link to that file.
If we are at the login Page, to access the loginScreen webpage you just write down the hyperlink like so:
login screen
since that page is on the same folder. now if you want to allow a user to be able to download a file from the downloadable files folder which is outside the public_html folder since it is not in that folder it self youjust reference to it like so:
How would we get to that folder if we are in the login folder as we are viewing the loginScreen.htm page, you go one folder back so we end up being in the public_html folder. then we go another folder back so we are in the work folder.
so it would look like this so far.
../../ which means two folders back.
then to access the memberonlypath.zip we then need to go into the downloadableFiles folder then we need to get into the downloadable files and then we can link it to the file membersOnlyFile.zip which is the file we were lookng for before.
so the full link now becomes
download file
This way the user cannot access the file by simply typing it on the address bar but can download it if you reference it yourself like the above.
Hope this helps
PK
Store all files you don't want downloaded outside the DocumentRoot.
You need .htaccess to deny access to the folder.
Just have a php download script like: this one that will get the file below the public_html folder.
"Static" files are served by the webserver, not PHP, so authentication is handled differently. There are two easy ways around this:
Handle all authentication in the webserver, e.g. with HTTP basic/digest authentication. Apache 2.2 has a helpful introduction.
Serve the files with PHP, e.g. with foo.php/path/to/file if you have "pathinfo" enabled (according to the PHP docs you set AcceptPathInfo=ON in the server config somewhere) or foo.php?path=path/to/file, which is pretty terrible, but oh well.
There is a more enterprisey solution:
Write an authentication module for your download server which understands authentication cookies from the other site. Many big sites do this (adcdownload.apple.com comes to mind), partly so they can stick the downloads on a CDN but still have some sort of access control.
There is a lazy workaround:
Stick everything in an "unguessable" directory name (e.g. some random base64 chars). Make sure you can't list the parent directory (the easiest way is to create an empty "index.html" file).

Categories