I've a site I'm trying to set up on a Windows 2003 Server using IIS6. It has a MySQL database with a front end written in PHP. Users are authenticated via account details in the database rather than through the server's local users. They are authenticated through HTML forms, which are passed to a PHP function for authentication against the database.
The problem I'm having is that you can still type in the full path to a file if you happen to know it (e.g.
http://www.mysite.com/somefiles/dir1/myfile.pdf). Doesn't matter how, or if, you are authenticated against the database. I'm not sure of how to overcome this. I can restrict NTFS security on the site for the IUSR account, but then no one can read the file.
Anyway, hopefully this is a simple problem to overcome and I'm just overlooking a simple solution.
Thanks,
Michael
Start Free Trial
