?
Solved

Download only file premission

Posted on 2013-01-16
3
Medium Priority
?
645 Views
Last Modified: 2013-01-16
Hi,

i have designed a php app that allows users to logon and see a collection of documents. i have put the files on the server but am worried that puting a direct link into the files could allow users to modify them or whatever. im curious if its possible to allow the files to only be downloaded once a user selects the link to the file
0
Comment
Question by:M. Jayme Nagy
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
3 Comments
 
LVL 17

Assisted Solution

by:Kent Dyer
Kent Dyer earned 1000 total points
ID: 38785507
Chmod 744 should do it..

If you go to 755 is too much..

HTH,

Kent
0
 
LVL 6

Author Comment

by:M. Jayme Nagy
ID: 38785518
nice!

did not even think of that

so if i restrict the permissions on the folder it should work?

what if i went lower to just allow read access how about 444?
0
 
LVL 31

Accepted Solution

by:
Frosty555 earned 1000 total points
ID: 38785563
The permissions for the folder are for the folder, not it's contents, so if you are using unix permissions you need to make sure you change the permissions of the file itself.

However, that said there are a few things you should know:

   1) If the user is accessing the file via a simple HTTP request using a direct URL, they can't modify the file. The HTTP protocol has no provisions to modify files on the server. Changing the chmod of the files only changes the ability for your PHP script itself to modify the files (or FTP, or WebDAV or Samba or some other process running on your server that accesses the server's filesystem).

   2) If you use a direct link to the file, ANYBODY with that URL can download the file, even with chmod 444 permissions.


If you are looking to restrict access to the file (e.g. only allow the user to download it if they are logged into your PHP app), then what you actually want to do is store the files on your server in a directory which is NOT web accessible (e.g. /var/myapp/somefile.zip, or at the very least put it in a directory that has password protection or a .htaccess denying access in Apache).

Then, create a PHP "downloader" script that acts as a middle-man between the user and their file. The user navigates to the downloader script, which authenticates and validate the user's request (forcing them to wait, login etc.) and then it streams the contents of the desired file to them using the readfile() function.

Simple example:

http://php.net/manual/en/function.readfile.php

You can use $_GET parameters to specify which file to download, but watch out to ensure users' can't compromise your server by asking for files they shouldn't be allowed to see, like for example asking to download "/etc/passwd".

http://forums.thedailywtf.com/forums/p/10247/182665.aspx
0

Featured Post

Independent Software Vendors: We Want Your Opinion

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Preface This is the third article about the EE Collaborative Login Project. A Better Website Login System (http://www.experts-exchange.com/A_2902.html) introduces the Login System and shows how to implement a login page. The EE Collaborative Logi…
Outsource Your Fax Infrastructure to the Cloud (And come out looking like an IT Hero!) Relative to the many demands on today’s IT teams, spending capital, time and resources to maintain physical fax servers and infrastructure is not a high priority.
The viewer will learn how to count occurrences of each item in an array.
The viewer will learn the basics of jQuery including how to code hide show and toggles. Reference your jQuery libraries: (CODE) Include your new external js/jQuery file: (CODE) Write your first lines of code to setup your site for jQuery…
Suggested Courses

770 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question