Go Premium for a chance to win a PS4. Enter to Win

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 454
  • Last Modified:

How to Password Protect Specific Files on a Web Folder

We currently mail USB drives to our board members with confidential PDF files on them.  We created a php website that allows the members to log in and access the files but quickly realized that one of the members was hiding her referrer info so the htaccess file wouldn't allow her to download the file (not to mention referrers can be faked).  So, now we're back to square one trying to figure out a way to securely give the members access to the PDF files.  We don't really want to use htaccess to password protect the folder.  We've come up with:

1) Password protect the PDF file and just provide a direct link
2) Have them use FTP

Any other options anyone can think of?

Thanks.
0
Jason92s
Asked:
Jason92s
  • 5
  • 4
  • 4
  • +2
3 Solutions
 
GaryCommented:
Why not just a simple login form that streams the pdf.
Doesn't have to be anything complicated - how many members are we talking about?
0
 
Jason92sAuthor Commented:
It's actually a collection of about 60-100 PDF files depending on the size of the hearing and can be anywhere from 100mb to 2GB in size.  We usually zip the files so they just have to download the file to their computer and extract.  Only about 10 members need access.  I have the login stuff all set and thought I could do this through referrers but that blew up.
0
 
Dave BaldwinFixer of ProblemsCommented:
Why isn't the login good enough?  I would put the PDFs outside the web root and present them for download (thru PHP) only to logged in users.
0
Concerto Cloud for Software Providers & ISVs

Can Concerto Cloud Services help you focus on evolving your application offerings, while delivering the best cloud experience to your customers? From DevOps to revenue models and customer support, the answer is yes!

Learn how Concerto can help you.

 
GaryCommented:
Would just go with the simple login, store the username/password or whatever format you wish to use to validate who the user is in the post back form and then just stream the pdf.
It's just one php page and no-one will know where the pdf's are stored.
0
 
Jason92sAuthor Commented:
I like having the files outside root but I can't figure out how to link to them in PHP.
0
 
GaryCommented:
How far outside the root? Is it still within the site folder structure - you can still stream it.
If not you could create a symlink to the folder.
0
 
arnoldCommented:
To avoid unauthorized downloads by referencing a link, the PHP file outputs
content-type: application/PDF filename=filename
And then streams the raw data forcing a download.
This is what the other experts referenced.
I.e.
<a href=https://www.yourdomain.com/getmydocument.php?docid=25565677>Get document</a>

The php code will verify the request is coming from a logged in/authenticated user.

Reliance on referrer is not a security mechanism.

Alternatively, you could add a java applet through which the document will be displayed within the browser.
0
 
Jason92sAuthor Commented:
/home/mysitename/public_html is where my regular content is

I created a directory here:
/home/mysitename/mem_files

I came across this:

http://forums.phpfreaks.com/topic/129814-solved-accessing-images-and-files-that-are-located-outside-document-root/
0
 
GaryCommented:
That is still in your site root just not directly accessible from a browser.
You can verify with
<?php
 echo $_SERVER["DOCUMENT_ROOT"];
?>

And you should get
/home/mysitename

Then you're good to go with streaming.
0
 
arnoldCommented:
The secure.php in the discussion link is what you need to start with that includes user verification.

How do users currently login? Are you using .htaccess with require user parameter, or you have a login form in php?
0
 
Dave BaldwinFixer of ProblemsCommented:
That link is a good example of how to get and deliver the files.
0
 
Ray PaseurCommented:
Why not use PHP client authentication to protect the pages that allow access to the PDF files?  Put the PDFs outside of the web root directory and use a "force download" script to link to them.  Password protect the download script with something like the design shown in this article.
http://www.experts-exchange.com/Web_Development/Web_Languages-Standards/PHP/A_2391-PHP-login-logout-and-easy-access-control.html
0
 
Jason92sAuthor Commented:
I tried the secure.php in the link I posted above and it works great for PDF files but when I tried to use a zip file, it shows as trying to download secure.php (shows the correct filename when downloading a PDF).  When I look in File Manager on my hosting account it shows the Type as "package/x-generic" for my zip file so I'm wondering if that has anything to do with it.
0
 
arnoldCommented:
It is within your control when outputting content-type.
Secure.php is using an external call to determine the mime type of the file.

Yu could use a test for a filename that is .zip and output the correct MIME type application/zip

Etc.
0
 
Ray PaseurCommented:
This script teaches how to force a download.  It does not require any knowledge of the file type.  Using the example in the article you might want to add access_control().  Then you would have a password-protected download script.

<?php // RAY_force_download.php
error_reporting(E_ALL);
ini_set('display_errors', TRUE);
ini_set('log_errors',     TRUE);


// DEMONSTRATE HOW TO CAUSE A FILE DOWNLOAD


// REQUIRED FOR USE WITH THE PHP date() FUNCTIONS
date_default_timezone_set('America/New_York');

// A FILE TO DOWNLOAD - THIS LINK COULD COME IN THE URL VIA $_GET, OR COULD BE GENERATED INSIDE THE SCRIPT
$url = "http://www.LAPRBass.com/RAY_short_text_file.txt";

// THE USE CASE FOR THE FUNCTION
force_download($url);


// FUNCTION TO FORCE A DOWNLOAD FROM A FILE
function force_download($filename)
{
    // GET THE CONTENTS OF THE FILE
    $filedata = @file_get_contents($filename);

    // SUCCESS
    if ($filedata)
    {
        // GET A NAME FOR THE FILE
        $basename = basename($filename);

        // THESE HEADERS ARE USED ON ALL BROWSERS
        header("Content-Type: application-x/force-download");
        header("Content-Disposition: attachment; filename=$basename");
        header("Content-length: ".(string)(strlen($filedata)));
        header("Expires: ".gmdate("D, d M Y H:i:s", mktime(date("H")+2, date("i"), date("s"), date("m"), date("d"), date("Y")))." GMT");
        header("Last-Modified: ".gmdate("D, d M Y H:i:s")." GMT");

        // THIS HEADER MUST BE OMITTED FOR IE 6+
        if (FALSE === strpos($_SERVER["HTTP_USER_AGENT"], 'MSIE '))
        {
            header("Cache-Control: no-cache, must-revalidate");
        }

        // THIS IS THE LAST HEADER
        header("Pragma: no-cache");

        // FLUSH THE HEADERS TO THE BROWSER
        flush();

        // WRITE THE FILE
        echo $filedata;
    }

    // ERROR
    else
    {
        trigger_error("ERROR: UNABLE TO OPEN $filename", E_USER_ERROR);
    }
}

Open in new window

HTH, ~Ray
0
 
Dave BaldwinFixer of ProblemsCommented:
See the first user comment here about setting up to 'force download' files: http://php.net/manual/en/function.header.php   One of the lines should include the filename to be downloaded.
0
 
Jason92sAuthor Commented:
Ok, thanks everyone.  I'm going to close this topic since we've found a way to do it, but I'll open up a new post in PHP since I can't get it to open the ZIP files.  Thanks.
0
 
arnoldCommented:
Zip files should be downloaded not opened.  Your php should stream the data raw.
0

Featured Post

Veeam and MySQL: How to Perform Backup & Recovery

MySQL and the MariaDB variant are among the most used databases in Linux environments, and many critical applications support their data on them. Watch this recorded webinar to find out how Veeam Backup & Replication allows you to get consistent backups of MySQL databases.

  • 5
  • 4
  • 4
  • +2
Tackle projects and never again get stuck behind a technical roadblock.
Join Now