文件夹安全？
我有一个名为 upload 的文件夹，其中充满了用户上传文件的文件夹。
有什么方法可以阻止人们通过简单地在地址栏中输入文件夹名称和文件名来直接下载我的用户文件？
示例：用户 Jim 的文件夹存储在 HOST/uploads/jim
用户 Jim 的重要文件“myimportantfile.txt”存储在 HOST/uploads/jim/myimportantfile.txt
现在，如果有人在地址栏中输入：www.HOST.com /uploads/jim/myimportantfile.txt ，他们将能够查看 Jim 的重要文件。
我怎样才能阻止这种情况发生？
创建目录时可以写入某些属性吗？
I have a folder named upload which is filled with folders of users uploaded files.
Is there any way I can stop people from directly downloading my users files by simply typing the folder names and file name into the address bar?
Example: user Jim's folder is stored at HOST/uploads/jim
user Jim's important file "myimportantfile.txt" is stored at HOST/uploads/jim/myimportantfile.txt
Now, if just anyone types into the address bar: www.HOST.com/uploads/jim/myimportantfile.txt , they will be able to view Jim's important file.
How can I stop this from happening?
Can I write certain attributes when making the directories?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（5）
您不希望将这些文件放在可通过 Web 访问的文件夹中。 将它们移出网络根目录。
一旦你这样做了，你就可以拥有一个像 download.php 这样的文件，你可以向其中传递一个文件 ID，然后它可以验证它确实是 Jim 要求的文件，然后才获取该文件并将其作为附件输出到浏览器。 这是最安全/最好的安全方式。
You don't want to have those files in a web-accessible folder. Move them out of the webroot.
Once you do this, you can have a file like download.php to which you pass a file ID and it can then validate it is in fact Jim asking for his files and only then fetch the file and output it to the browser as an attachment. This is the safest/best way for security.
我相信目录 +w-r+x 的文件权限将允许目录写入但不允许读取。 用极客 UNIX 术语来说，这是 %chmod 733 dirname。 必须使用 chown 和 chgroup 正确设置目录所有权。 这适用于unix环境。
I belive file permissions of a directory +w-r+x will alow directory writes but not reads. In geeky unix terms this is %chmod 733 dirname. The directory ownership would have to be set properly using chown and chgroup. This applies to a unix environment.
您可以使用
.htaccess文件要求输入用户名和密码，使每个文件夹成为受保护的文件夹。但我认为最好的方法是将上传文件夹移到 webroot 之外，这样就无法直接访问它，然后创建一个脚本（PHP、ASP 等），在验证用户身份后提供请求的文件。
You could use an
.htaccessfile to require a username and password to be entered making each folder a protected folder.But I think the best way to do it would be to move the uploads folder outside of the webroot so that it's not directly accessible, and then create a script (PHP, ASP, etc) that serves up the requested file after authenticating the user.
最简单的解决方案是将一个index.htm 文件添加到该文件夹中。
然后，任何访问者都将看到此页面而不是文件索引。
该页面可以是空白的，或者更好的是，通过重定向重定向到域主页。
The simplest solution is to just add an index.htm file to the folder.
Any visitors will then see this page rather than the index of files.
The page can be blank, or even better, redirect to the domain home page with a redirect.
当然，您可以在 Linux 中使用基本的文件/目录权限。 您还可以将整棵树设置为被 apache 拒绝。
您运行什么平台/网络服务器软件？
好的，Linux：
如果目录的所有者是“joe”，组是“apache”，那么：
这将授予目录“joe”权限，允许所有者（joe）完全访问，组（apache）写入访问（以及进入目录的能力），仅此而已。
这是 FTP 投递箱吗？
现在的所有权/团体是什么样的？
Sure, you can use basic file/directory permissions in Linux. You can also set the entire tree to be denied by apache.
What platform / webserver software are you running?
Okay, linux:
If the owner of the directory is 'joe', and the group is 'apache', then:
This would give the directory 'joe' permissions which allow the owner (joe) full access, the group (apache) write access (and the ability to enter the directory), and nothing else.
Is this an FTP drop-box?
What are the ownerships/groups like now?