Solved

Download only file premission

Posted on 2013-01-16
3
620 Views
Last Modified: 2013-01-16
Hi,

i have designed a php app that allows users to logon and see a collection of documents. i have put the files on the server but am worried that puting a direct link into the files could allow users to modify them or whatever. im curious if its possible to allow the files to only be downloaded once a user selects the link to the file
0
Comment
Question by:M. Jayme Nagy
3 Comments
 
LVL 17

Assisted Solution

by:Kent Dyer
Kent Dyer earned 250 total points
ID: 38785507
Chmod 744 should do it..

If you go to 755 is too much..

HTH,

Kent
0
 
LVL 6

Author Comment

by:M. Jayme Nagy
ID: 38785518
nice!

did not even think of that

so if i restrict the permissions on the folder it should work?

what if i went lower to just allow read access how about 444?
0
 
LVL 31

Accepted Solution

by:
Frosty555 earned 250 total points
ID: 38785563
The permissions for the folder are for the folder, not it's contents, so if you are using unix permissions you need to make sure you change the permissions of the file itself.

However, that said there are a few things you should know:

   1) If the user is accessing the file via a simple HTTP request using a direct URL, they can't modify the file. The HTTP protocol has no provisions to modify files on the server. Changing the chmod of the files only changes the ability for your PHP script itself to modify the files (or FTP, or WebDAV or Samba or some other process running on your server that accesses the server's filesystem).

   2) If you use a direct link to the file, ANYBODY with that URL can download the file, even with chmod 444 permissions.


If you are looking to restrict access to the file (e.g. only allow the user to download it if they are logged into your PHP app), then what you actually want to do is store the files on your server in a directory which is NOT web accessible (e.g. /var/myapp/somefile.zip, or at the very least put it in a directory that has password protection or a .htaccess denying access in Apache).

Then, create a PHP "downloader" script that acts as a middle-man between the user and their file. The user navigates to the downloader script, which authenticates and validate the user's request (forcing them to wait, login etc.) and then it streams the contents of the desired file to them using the readfile() function.

Simple example:

http://php.net/manual/en/function.readfile.php

You can use $_GET parameters to specify which file to download, but watch out to ensure users' can't compromise your server by asking for files they shouldn't be allowed to see, like for example asking to download "/etc/passwd".

http://forums.thedailywtf.com/forums/p/10247/182665.aspx
0

Featured Post

Gigs: Get Your Project Delivered by an Expert

Select from freelancers specializing in everything from database administration to programming, who have proven themselves as experts in their field. Hire the best, collaborate easily, pay securely and get projects done right.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
Facebook React and SyntheticEvents 6 64
.php tree directory? 5 70
Animated .jpg? 13 77
Large File Sharing For Business 7 19
Have you tried to learn about Unicode, UTF-8, and multibyte text encoding and all the articles are just too "academic" or too technical? This article aims to make the whole topic easy for just about anyone to understand.
In this article you will learn how to create a free basic website on Bitbucket, a git service provider. Polymer creates dynamic HTML components, which allow more flexibility than static HTML. This tutorial uses Ubuntu Linux but can also be done on W…
The viewer will learn how to look for a specific file type in a local or remote server directory using PHP.
Sending a Secure fax is easy with eFax Corporate (http://www.enterprise.efax.com). First, Just open a new email message.  In the To field, type your recipient's fax number @efaxsend.com. You can even send a secure international fax — just include t…

813 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

18 Experts available now in Live!

Get 1:1 Help Now