Solved

Download only file premission

Posted on 2013-01-16
3
630 Views
Last Modified: 2013-01-16
Hi,

i have designed a php app that allows users to logon and see a collection of documents. i have put the files on the server but am worried that puting a direct link into the files could allow users to modify them or whatever. im curious if its possible to allow the files to only be downloaded once a user selects the link to the file
0
Comment
Question by:M. Jayme Nagy
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
3 Comments
 
LVL 17

Assisted Solution

by:Kent Dyer
Kent Dyer earned 250 total points
ID: 38785507
Chmod 744 should do it..

If you go to 755 is too much..

HTH,

Kent
0
 
LVL 6

Author Comment

by:M. Jayme Nagy
ID: 38785518
nice!

did not even think of that

so if i restrict the permissions on the folder it should work?

what if i went lower to just allow read access how about 444?
0
 
LVL 31

Accepted Solution

by:
Frosty555 earned 250 total points
ID: 38785563
The permissions for the folder are for the folder, not it's contents, so if you are using unix permissions you need to make sure you change the permissions of the file itself.

However, that said there are a few things you should know:

   1) If the user is accessing the file via a simple HTTP request using a direct URL, they can't modify the file. The HTTP protocol has no provisions to modify files on the server. Changing the chmod of the files only changes the ability for your PHP script itself to modify the files (or FTP, or WebDAV or Samba or some other process running on your server that accesses the server's filesystem).

   2) If you use a direct link to the file, ANYBODY with that URL can download the file, even with chmod 444 permissions.


If you are looking to restrict access to the file (e.g. only allow the user to download it if they are logged into your PHP app), then what you actually want to do is store the files on your server in a directory which is NOT web accessible (e.g. /var/myapp/somefile.zip, or at the very least put it in a directory that has password protection or a .htaccess denying access in Apache).

Then, create a PHP "downloader" script that acts as a middle-man between the user and their file. The user navigates to the downloader script, which authenticates and validate the user's request (forcing them to wait, login etc.) and then it streams the contents of the desired file to them using the readfile() function.

Simple example:

http://php.net/manual/en/function.readfile.php

You can use $_GET parameters to specify which file to download, but watch out to ensure users' can't compromise your server by asking for files they shouldn't be allowed to see, like for example asking to download "/etc/passwd".

http://forums.thedailywtf.com/forums/p/10247/182665.aspx
0

Featured Post

Free Tool: Subnet Calculator

The subnet calculator helps you design networks by taking an IP address and network mask and returning information such as network, broadcast address, and host range.

One of a set of tools we're offering as a way of saying thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
API Soap Calls 4 140
Optimum versions of Selenium Webdriver with Python On Windows 7 1 174
Google Analytics 5 144
Where does legacy ASP.NET initialize language? 2 63
I found this questions asking how to do this in many different forums, so I will describe here how to implement a solution using PHP and AJAX. The logical flow for the problem should be: Write an event handler for the first drop down box to get …
Styling your websites can become very complex. Here I'll show how SASS can help you better organize, maintain and reuse your CSS code.
The viewer will learn how to count occurrences of each item in an array.
The viewer will learn how to look for a specific file type in a local or remote server directory using PHP.

730 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question