Solved

How to Password Protect Specific Files on a Web Folder

Posted on 2013-05-12
18
435 Views
Last Modified: 2013-05-12
We currently mail USB drives to our board members with confidential PDF files on them.  We created a php website that allows the members to log in and access the files but quickly realized that one of the members was hiding her referrer info so the htaccess file wouldn't allow her to download the file (not to mention referrers can be faked).  So, now we're back to square one trying to figure out a way to securely give the members access to the PDF files.  We don't really want to use htaccess to password protect the folder.  We've come up with:

1) Password protect the PDF file and just provide a direct link
2) Have them use FTP

Any other options anyone can think of?

Thanks.
0
Comment
Question by:Jason92s
  • 5
  • 4
  • 4
  • +2
18 Comments
 
LVL 58

Expert Comment

by:Gary
ID: 39159817
Why not just a simple login form that streams the pdf.
Doesn't have to be anything complicated - how many members are we talking about?
0
 

Author Comment

by:Jason92s
ID: 39159826
It's actually a collection of about 60-100 PDF files depending on the size of the hearing and can be anywhere from 100mb to 2GB in size.  We usually zip the files so they just have to download the file to their computer and extract.  Only about 10 members need access.  I have the login stuff all set and thought I could do this through referrers but that blew up.
0
 
LVL 82

Expert Comment

by:Dave Baldwin
ID: 39159833
Why isn't the login good enough?  I would put the PDFs outside the web root and present them for download (thru PHP) only to logged in users.
0
 
LVL 58

Expert Comment

by:Gary
ID: 39159841
Would just go with the simple login, store the username/password or whatever format you wish to use to validate who the user is in the post back form and then just stream the pdf.
It's just one php page and no-one will know where the pdf's are stored.
0
 

Author Comment

by:Jason92s
ID: 39159857
I like having the files outside root but I can't figure out how to link to them in PHP.
0
 
LVL 58

Expert Comment

by:Gary
ID: 39159867
How far outside the root? Is it still within the site folder structure - you can still stream it.
If not you could create a symlink to the folder.
0
 
LVL 76

Expert Comment

by:arnold
ID: 39159870
To avoid unauthorized downloads by referencing a link, the PHP file outputs
content-type: application/PDF filename=filename
And then streams the raw data forcing a download.
This is what the other experts referenced.
I.e.
<a href=https://www.yourdomain.com/getmydocument.php?docid=25565677>Get document</a>

The php code will verify the request is coming from a logged in/authenticated user.

Reliance on referrer is not a security mechanism.

Alternatively, you could add a java applet through which the document will be displayed within the browser.
0
 

Author Comment

by:Jason92s
ID: 39159873
/home/mysitename/public_html is where my regular content is

I created a directory here:
/home/mysitename/mem_files

I came across this:

http://forums.phpfreaks.com/topic/129814-solved-accessing-images-and-files-that-are-located-outside-document-root/
0
 
LVL 58

Assisted Solution

by:Gary
Gary earned 167 total points
ID: 39159879
That is still in your site root just not directly accessible from a browser.
You can verify with
<?php
 echo $_SERVER["DOCUMENT_ROOT"];
?>

And you should get
/home/mysitename

Then you're good to go with streaming.
0
Do You Know the 4 Main Threat Actor Types?

Do you know the main threat actor types? Most attackers fall into one of four categories, each with their own favored tactics, techniques, and procedures.

 
LVL 76

Assisted Solution

by:arnold
arnold earned 333 total points
ID: 39159880
The secure.php in the discussion link is what you need to start with that includes user verification.

How do users currently login? Are you using .htaccess with require user parameter, or you have a login form in php?
0
 
LVL 82

Expert Comment

by:Dave Baldwin
ID: 39159889
That link is a good example of how to get and deliver the files.
0
 
LVL 108

Expert Comment

by:Ray Paseur
ID: 39159891
Why not use PHP client authentication to protect the pages that allow access to the PDF files?  Put the PDFs outside of the web root directory and use a "force download" script to link to them.  Password protect the download script with something like the design shown in this article.
http://www.experts-exchange.com/Web_Development/Web_Languages-Standards/PHP/A_2391-PHP-login-logout-and-easy-access-control.html
0
 

Author Comment

by:Jason92s
ID: 39159930
I tried the secure.php in the link I posted above and it works great for PDF files but when I tried to use a zip file, it shows as trying to download secure.php (shows the correct filename when downloading a PDF).  When I look in File Manager on my hosting account it shows the Type as "package/x-generic" for my zip file so I'm wondering if that has anything to do with it.
0
 
LVL 76

Accepted Solution

by:
arnold earned 333 total points
ID: 39159938
It is within your control when outputting content-type.
Secure.php is using an external call to determine the mime type of the file.

Yu could use a test for a filename that is .zip and output the correct MIME type application/zip

Etc.
0
 
LVL 108

Expert Comment

by:Ray Paseur
ID: 39159943
This script teaches how to force a download.  It does not require any knowledge of the file type.  Using the example in the article you might want to add access_control().  Then you would have a password-protected download script.

<?php // RAY_force_download.php
error_reporting(E_ALL);
ini_set('display_errors', TRUE);
ini_set('log_errors',     TRUE);


// DEMONSTRATE HOW TO CAUSE A FILE DOWNLOAD


// REQUIRED FOR USE WITH THE PHP date() FUNCTIONS
date_default_timezone_set('America/New_York');

// A FILE TO DOWNLOAD - THIS LINK COULD COME IN THE URL VIA $_GET, OR COULD BE GENERATED INSIDE THE SCRIPT
$url = "http://www.LAPRBass.com/RAY_short_text_file.txt";

// THE USE CASE FOR THE FUNCTION
force_download($url);


// FUNCTION TO FORCE A DOWNLOAD FROM A FILE
function force_download($filename)
{
    // GET THE CONTENTS OF THE FILE
    $filedata = @file_get_contents($filename);

    // SUCCESS
    if ($filedata)
    {
        // GET A NAME FOR THE FILE
        $basename = basename($filename);

        // THESE HEADERS ARE USED ON ALL BROWSERS
        header("Content-Type: application-x/force-download");
        header("Content-Disposition: attachment; filename=$basename");
        header("Content-length: ".(string)(strlen($filedata)));
        header("Expires: ".gmdate("D, d M Y H:i:s", mktime(date("H")+2, date("i"), date("s"), date("m"), date("d"), date("Y")))." GMT");
        header("Last-Modified: ".gmdate("D, d M Y H:i:s")." GMT");

        // THIS HEADER MUST BE OMITTED FOR IE 6+
        if (FALSE === strpos($_SERVER["HTTP_USER_AGENT"], 'MSIE '))
        {
            header("Cache-Control: no-cache, must-revalidate");
        }

        // THIS IS THE LAST HEADER
        header("Pragma: no-cache");

        // FLUSH THE HEADERS TO THE BROWSER
        flush();

        // WRITE THE FILE
        echo $filedata;
    }

    // ERROR
    else
    {
        trigger_error("ERROR: UNABLE TO OPEN $filename", E_USER_ERROR);
    }
}

Open in new window

HTH, ~Ray
0
 
LVL 82

Expert Comment

by:Dave Baldwin
ID: 39159945
See the first user comment here about setting up to 'force download' files: http://php.net/manual/en/function.header.php   One of the lines should include the filename to be downloaded.
0
 

Author Comment

by:Jason92s
ID: 39159961
Ok, thanks everyone.  I'm going to close this topic since we've found a way to do it, but I'll open up a new post in PHP since I can't get it to open the ZIP files.  Thanks.
0
 
LVL 76

Expert Comment

by:arnold
ID: 39159965
Zip files should be downloaded not opened.  Your php should stream the data raw.
0

Featured Post

PRTG Network Monitor: Intuitive Network Monitoring

Network Monitoring is essential to ensure that computer systems and network devices are running. Use PRTG to monitor LANs, servers, websites, applications and devices, bandwidth, virtual environments, remote systems, IoT, and many more. PRTG is easy to set up & use.

Join & Write a Comment

Suggested Solutions

SSH (Secure Shell) - Tips and Tricks As you all know SSH(Secure Shell) is a network protocol, which we use to access/transfer files securely between two networked devices. SSH was actually designed as a replacement for insecure protocols that sen…
If your site has a few sections that need to be secure when data is transmitted between the server and local computer, such as a /order/ section for ordering or /customer/ which contains customer data, etc it would of course be recommended to secure…
This tutorial will teach you the core code needed to finalize the addition of a watermark to your image. The viewer will use a small PHP class to learn and create a watermark.
The viewer will learn how to create a basic form using some HTML5 and PHP for later processing. Set up your basic HTML file. Open your form tag and set the method and action attributes.: (CODE) Set up your first few inputs one for the name and …

706 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

15 Experts available now in Live!

Get 1:1 Help Now