使用 PHP 应用 .htaccess 文件夹用户名/密码
我正在构建一个 PHP/MySQL Web 应用程序。用户登录并设置各种会话变量。
网络服务器上有一个文件夹，用户可以将文件上传到其中（任何类型 - 图像、pdf、.doc 等）。我想保护此文件夹，以防止未登录的人输入网址并访问这些文件。禁止浏览此文件夹中的文件。
我可以使用我的 cpanel 应用密码，效果很好。然而，这意味着用户必须登录到应用程序，然后当他们第一次导航到此受保护文件夹中的文件时，系统会提示他们输入受保护文件夹的用户名/密码。我想这样做，这样他们就不必输入受保护文件夹的用户名/密码。
当用户登录并设置会话变量时，是否有办法同时使用 PHP 设置受保护文件夹的用户名/密码，这样就不会出现提示？ 谢谢。伊恩.
I’m building a PHP/MySQL web application. Users log in and various session variables are set.
There’s a folder on the webserver where users can upload files to (any kind – images, pdf, .doc etc). I’d like to protect this folder to prevent people who are not logged in typing in the url and getting to these files. Browsing of files in this folder is disallowed.
I can apply a password using my cpanel, which works nicely. However it means that users have to log in to the application, then the first time they navigate to a file in this protected folder, they’re prompted for the username/password for the protected folder. I’d like to make it so they don’t have to type in the username/password for the protected folder.
Is there any way when a user logs in, setting their session variables, to at that same time – using PHP – also set the username/password for the protected folder – so they’re not prompted?
Thank you. Iain.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
我处理这个问题的方法是，他们认为他们访问的受保护文件夹不是实际的受保护文件夹，发生的情况是您仅通过 PHP 与它交互，并且如果他们已经登录（您可以通过发送适当的 Web 身份验证代码请参阅 http://php.net/manual/en/features.http-auth.php）
从那里，如果他们“登录”，您就可以知道，并且可以向他们显示代码，如果没有，您可以说“您尚未登录，如果您想访问该区域，则需要登录”。
它简单但有效。
当然请记住，明智的人知道您是否这样做 http://user:[email protected]/files 它会自动发送网络身份验证信息。
The way I approached this was that the protected folder they think they access is NOT the actual protected folder, what happens is you interface with it only via PHP, and if they have logged in (which you can do a fake .htaccess by sending the appropriate web authetification codes see http://php.net/manual/en/features.http-auth.php)
From there, if they "log in" you can tell, and they can be shown the codes, if not, you can say "You arent logged in, if you wish to access this area, you will need to login".
its simple but effective.
do remember of course, that sensible people know if you do http://user:[email protected]/files it auto sends web auth info.
我认为您无法从
.htaccess级别获取 PHP 会话变量。您可以做的是重写对 PHP 脚本的所有访问，该脚本检查登录用户并返回文件或重定向到“未登录”页面。
I don't think you can get at PHP session variables from the
.htaccesslevel.What you can do is to rewrite any accesses to a PHP script that checks for a logged-in user and either returns the file or redirects to a 'not logged in' page.
我几年前就这样做过，但它与 cpanel 配合得很好：我以编程方式调用了 cpanel 的目录保护设置页面，并在其中添加了用户名/密码。因此 cpanel 负责服务器管理。但是我不知道这是否仍然有效。
您还可以使用一个库来创建 .htaccess 和 .htpasswd 文件。我从未使用过它，所以我不能说它是否有效： 类：PHP 函数类
我还记得其他一些库，它们只执行 .htaccess 和 .htpasswd 的内容，因此您可能会通过搜索互联网找到其他内容。
I've did this years ago, but it worked very well with cpanel: I programmatically called the directory protection settings page of cpanel and added the username/password there. So cpanel took care of the server administration. However I have no clue if that still works.
There is a library available that you can use to create the .htaccess and the .htpasswd files as well. I have never used it so I can not say if it works: Class: PHP Functions Class
I sort of remember some other library as well that does only the .htaccess and .htpasswd stuff, so you might find something else with searching the internet.