• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 658
  • Last Modified:

Download only file premission

Hi,

i have designed a php app that allows users to logon and see a collection of documents. i have put the files on the server but am worried that puting a direct link into the files could allow users to modify them or whatever. im curious if its possible to allow the files to only be downloaded once a user selects the link to the file
0
J N
Asked:
J N
2 Solutions
 
Kent DyerIT Security Analyst SeniorCommented:
Chmod 744 should do it..

If you go to 755 is too much..

HTH,

Kent
0
 
J NUnicorn wranglerAuthor Commented:
nice!

did not even think of that

so if i restrict the permissions on the folder it should work?

what if i went lower to just allow read access how about 444?
0
 
Frosty555Commented:
The permissions for the folder are for the folder, not it's contents, so if you are using unix permissions you need to make sure you change the permissions of the file itself.

However, that said there are a few things you should know:

   1) If the user is accessing the file via a simple HTTP request using a direct URL, they can't modify the file. The HTTP protocol has no provisions to modify files on the server. Changing the chmod of the files only changes the ability for your PHP script itself to modify the files (or FTP, or WebDAV or Samba or some other process running on your server that accesses the server's filesystem).

   2) If you use a direct link to the file, ANYBODY with that URL can download the file, even with chmod 444 permissions.


If you are looking to restrict access to the file (e.g. only allow the user to download it if they are logged into your PHP app), then what you actually want to do is store the files on your server in a directory which is NOT web accessible (e.g. /var/myapp/somefile.zip, or at the very least put it in a directory that has password protection or a .htaccess denying access in Apache).

Then, create a PHP "downloader" script that acts as a middle-man between the user and their file. The user navigates to the downloader script, which authenticates and validate the user's request (forcing them to wait, login etc.) and then it streams the contents of the desired file to them using the readfile() function.

Simple example:

http://php.net/manual/en/function.readfile.php

You can use $_GET parameters to specify which file to download, but watch out to ensure users' can't compromise your server by asking for files they shouldn't be allowed to see, like for example asking to download "/etc/passwd".

http://forums.thedailywtf.com/forums/p/10247/182665.aspx
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

Featured Post

Introducing Cloud Class® training courses

Tech changes fast. You can learn faster. That’s why we’re bringing professional training courses to Experts Exchange. With a subscription, you can access all the Cloud Class® courses to expand your education, prep for certifications, and get top-notch instructions.

Tackle projects and never again get stuck behind a technical roadblock.
Join Now