File Sharing application

I will recommend that you store each file in a database as opposed to a webfolder.
If the file are store in a database (in a blob field), you can defined easely administration rule on who and how people can upload and download.

virmaior it is your point of view.
I believe it is easier in a DB!

alain34, can you imagine backuping 200 megs of sql data (with phpmyadmin) on shared server?

cheers

how do you know esher 669 has 200meg of data

:)

how do you know esher 669 won't have 200meg of data?

just put the file somewhere outside the webserver's document root. Then anonymous user can't just read the file out. So long as the web service acct has read access to that file, you can use

$file = "absolute system path to file";
header("Content-Description: File Transfer");
header("Content-Type: application/force-download");
header("Content-Disposition: attachment; filename=".basename($file));
@readfile($file);

and it will spit the file out to the browser when that code is executed. You can control access then via php control structures or logic.
Change content-type header field if you want the browser to recognize the file type.

cheers!

200meg of database or files is still 200 meg!!
No difference in size!

I don't think entering files into a database would provide any benefit here.

The files already sit inside a searchable, seekable, data structure many times faster than mysql. It's the filesystem. Database user permissions don't come into effect because there's only one system user doing all the work. It's probably called (www) or (NT_NETWORK_SERVICE). There aren't concurrent updates or write so a database locking mechanism isn't being used. The filesystem already holds an index table based off filename, and memory caching is built into every major filesystem for the past 5 years. While binary blobs have their place, I don't think it applies here. This is just my opinion but I think it makes sense.

The OPs concern is to prevent people who know the filename to punch the location into a browser and download willy nilly. Solution, keep the documents outside of the document root and let php handle permissions and delivery.

example:
web directory is in /home/esther/www/
put the downloadables in /home/esther/downloads/

so assuming we have a file called "cheesypoofs.xls" in /home/esther/downloads.

a script cheesypoofs.php consisting of :

$file = "/home/esther/downloads/cheesypoofs.xls";
header("Content-Description: File Transfer");
header("Content-Type: application/force-download");
header("Content-Disposition: attachment; filename=".basename($file));
@readfile($file);

will let users download the cheesypoofs.xls file.
changing the value of $file will, obviously, refer to a different file and can be dynamically obtained...possibly from a small database record.
dropping control structures like "if","while" etc will let the OP fine tune access or behavior. it's a pretty handy piece of code to have around.

ps - if you're assigning points for my above statement, they should goto virmajor, he said it first, except he includes all the code.

Thanks for all of your professional comments. I decided to go to virmaior's solution (and other related assist solutions as well) as I do want to keep the features associated in a real file system.

However, I would like to ask...
1. if I store the file outside the document root, how the php in document root what files are in the sharing list? do you mean I have to store both the filename, physical location and who can access the file in db?

2. what mode should I set for the sharing files? (chmod to what?) just leave it 755?

Sorry for my stupid questions..

One more question..so if a image-based file is uploaded for sharing, what php function can I use for preview for that image? (imagegif? imagejpeg?) how about swf file?

esther 6694, you don't have to put files outside document root. All you have to do is put a .htaccess file in a folder that you want to protect. Put this code in it

<limit GET POST>
  order deny,allow
  deny from all
</limit>

this would block access to your folder.

cheers

I've added

ReWriteEngine On
RewriteRule ^/?([^/]*\.*?|[^\./]*)[:;,\.]*$ /downloadengine/download.php [L,NS]

as per virmaior's suggestion in the folder, it seems it can limit access only to a specific php.. should I set the folder to 777? as my system would allow upload file too, and file copy from php need the desitination folder to be open to public ..., will 777 incompatible with the htaccess settings? please advise.

the solution I (and the other experts) showed you provides the way that files are DOWNLOADED.
controlling how they are previewed and/or uploaded are two separate issues.

1.  how you set the chmod on the folders won't affect the download script as it works through php and only needs open rights.

2. to make previews of images, you would want to do an imagecopyresampled() (http://us3.php.net/manual/en/function.imagecopyresampled.php)...
to make previews of video files or swf files, you will probably have to resort to some other means (I don't know off hand)


3. upload functionality and being public sounds more like an anonymous ftp site than somewhere that there's any need for php.  What's the point of securing who can download if anyone can upload?  
You should make a page that shows previous/file names for everything a user can see.

Hi virmaior,

My system would have 2 level of users- modulator & viewer, and my php would allow only modulator to upload files (use of session to check whether upload is possible for that user).

the file uploaded would properly copy to the sharing folder[outside document root] by move_uploaded_file, but I need to change the mode of sharning folder to 777.

I do not familiar with mode setting / htaccess on apache/linux..I just wonder whether it will not be safe enough that someone may easily get upload/download things from the folder under the above settings...please kindly advise...  

that should be fine (afaik- I use win32 but exposing the temp directory shouldn't be all that dangerous unless you blindly copy everything you find there)

No comment has been added to this question in more than 21 days, so it is now classified as abandoned..
I will leave the following recommendation for this question in the Cleanup topic area:
Split: virmaior & gruntar

Any objections should be posted here in the next 4 days. After that time, the question will be closed.

Huji
EE Cleanup Volunteer