当前位置：文江博客话题详情

保护可下载文件的最佳策略 -php/mysql Apache2 服务器

发布于 2024-10-25 06:00:46 字数 46 浏览 3 评论 0原文

我将尝试找出如何保护目录免遭未经授权或未经身份验证的用户下载文件。提前致谢。

原文

分享到QQ

分享到微博

如果你对这篇内容有疑问，欢迎到本站社区发帖提问参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。

发布评论

需要登录才能够评论，你可以免费注册一个本站的账号。

残疾 2024-11-01 06:00:46

找不到好的重复项，但稍微搜索一下就会得到类似这样的结果 PHP 保护文件夹

有一种简单的方法可以使用 php.ini 来限制基于 PHP 会话授权的文件夹访问。它需要为有效的授权会话创建存根文件（并自动删除它们）。在 PHP 中，您可以执行以下操作：

if ($user_has_permission_to_download)
{
   touch("tmp/access-" . session_id()); 
}

然后，一个简单的 rewriterule+rewritecond 可以用于授权：

RewriteCond %{HTTP_COOKIE}        PHPSESSID=(\w+)
RewriteCond ../tmp/access-%1      -f 
RewriteRule ^(.+)$  $1  [L]

RewriteRule .+  /deny   [L]

当找到相应的 cookie 值并且存在授权存根文件时，第一个块允许访问。第二条规则阻止其他任何人的访问。

Can't find a good duplicate, but a little search will bring up results like this PHP protect a folder

There is a simple way to restrict folder access based on PHP session authorization using php. It requires creating stub files for valid authorized sesssions (and automating their deletion). In PHP you do:

if ($user_has_permission_to_download)
{
   touch("tmp/access-" . session_id()); 
}

Then a simple rewriterule+rewritecond can then serve for authorization:

RewriteCond %{HTTP_COOKIE}        PHPSESSID=(\w+)
RewriteCond ../tmp/access-%1      -f 
RewriteRule ^(.+)$  $1  [L]

RewriteRule .+  /deny   [L]

The first block permits access when the according cookie value is found and an authorization stub file exists. The second rule blocks access for anyone else.

回复收藏 0 原文

梦年海沫深 2024-11-01 06:00:46

将 .htaccess 文件放入包含以下内容的文件目录中

deny from all

然后创建一个使用例如 readfile() 来提供文件。

Put a .htaccess file in the directory with the files, with the following content

deny from all

Then create a script that that uses for instance readfile() to serve the file if the user is authorized.

回复收藏 0 原文

赴月观长安 2024-11-01 06:00:46

我假设您在某处有一个用户/登录脚本来验证用户身份？
使用 .htaccess 重写规则通过 PHP 脚本转发文件请求，该脚本检查会话变量（如果用户已登录）然后返回文件。

麋鹿的一些东西：

.htaccess
RewriteEngine on
RewriteRule ^(.*).(pdf|exe|doc|whatever)$ some-script.php?file=$1.$2 [L]

<?php
if(loginCheck()) //function somewhere that checks session if user is logged in
{
  return fopen('../files/' . $_GET['file']); //open and return the requested file
}

这只是伪代码，可以让您了解需要做什么。您可能还必须回显正确的文件头。

为了阻止人们直接访问文件目录，我建议在该文件夹中放置一个 .htaccess 文件，并说 deny from all 以阻止所有人访问它。

I'm assuming you have a users / login script somewhere that authenticates a user?
Use .htaccess rewrite rules to forward the file request through a php script that checks a session variable if the user is logged in then returns the file.

Something of the elk:

.htaccess
RewriteEngine on
RewriteRule ^(.*).(pdf|exe|doc|whatever)$ some-script.php?file=$1.$2 [L]

<?php
if(loginCheck()) //function somewhere that checks session if user is logged in
{
  return fopen('../files/' . $_GET['file']); //open and return the requested file
}

This is just pseudo code to give you an idea of what you need to do. You may also have to echo the correct file headers as well.

And to stop people from just going to the files directory, I recommend putting an .htaccess file in THAT folder as well saying deny from all to stop EVERYONE from accessing it.

回复收藏 0 原文