防止特定用户的目录列表和文件
我有一个文件夹（/files），其中有大量文件可供用户下载。我希望用户只能下载自己的文件，而不能看到其他人的文件。
例如：
用户 A 只能查看和下载：
- file1.doc
- file2.jpg
用户 B 只能查看和下载：
- file3.txt
- file4.jpeg
用户 C 只能查看和下载：
- file1.doc
- file2.jpg
- file3.txt
我的想法是将所有文件放在同一个文件夹中，以便所有用户都知道去哪里。我的问题是：我可以使用 .htaccess 还是应该为此构建 PHP 脚本？安全性怎么样（哪一个更安全）？
谢谢
I have a folder (/files) and I have tons of files there that users can download. I want users to be able to download their files only and no be able to see others people file.
For example:
User A can only view and download:
- file1.doc
- file2.jpg
User B can only view and download:
- file3.txt
- file4.jpeg
User C can only view and download:
- file1.doc
- file2.jpg
- file3.txt
My idea was to put all files in the same folder so all users knows where to go. My question is: Can I use .htaccess or should I build a PHP scripts for this? What about security (which one is more secure)?
Thanks
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
首先它是一个开放目录吗？您可以做的是为每个用户创建一个子文件夹，将他们的文件放入其中，然后在 .htaccess 中为所述文件夹分配适当的权限。但是，这需要与您的操作系统进行一些安全集成（即，用户必须在您的计算机上拥有帐户，而不仅仅是您的 Web 应用程序）...一个快速而肮脏且不安全的替代方案是预先考虑所有上传的内容文件名与用户名（例如，由“foobar”上传的“file1.jpg”可以命名为“foobar.file1.jpg”），那么这只是您的 PHP 脚本仅返回那些具有相应用户名的文件的情况也许剥离那部分显示时（或者，您可以使用文件夹，只要您的脚本可以为每个用户创建一个新文件夹（当文件夹不存在时））。另一种稍微安全的选择是在数据库中创建文件和用户名的哈希值，使用此哈希值重命名所有上传的文件，然后适当地查询数据库。
最好的解决方案肯定是操作系统管理帐户，这是我首先提到的，但它需要更多的开销。
Is it an open directory, to start with? What you could do is create a subfolder for each user, put their files in there and then assign appropriate permissions in .htaccess for said folders. However, this would require some security integration with your OS (i.e., users would have to have accounts on your machine, not just your web application)... A quick and dirty -- and insecure -- alternative would be to prepend all uploaded filenames with the username (e.g., 'file1.jpg' uploaded by 'foobar' could be named 'foobar.file1.jpg', for example), then it's just a case of your PHP script returning only those files with the respective username and perhaps stripping that part out when displaying (or again, you could use folders, as long as your script can create a new folder per user, when one doesn't exist). Another option, which is slightly more secure is to create a hash of the file and usernames in a database, rename all uploaded files with this hash and then query the database appropriately.
The best solution would definitely be OS managed accounts, a I first mentioned, but it entails more overhead.
构建一个 PHP 脚本，在其中使用 readfile 将文件发送到浏览器。通过这种方式，您可以限制对单个文件的访问，并使用您已有的身份验证系统。
Build a PHP script where you use readfile to send the file to the browser. This way you can restrict access for individual files, and use the authentication system you already have.
您当然可以使用 htaccess 或 PHP 来实现此目的。据我所知，两者都不是更安全，而另一个——尽管做得错误，但都可以允许在没有意图的地方进行访问！
PHP 可能会稍微好一点，因为您有更大的灵活性（例如，在与其他 PHP 身份验证集成方面），并且您可以将文件夹放在通常的 Web 根目录之外，无论如何，这是一个很好的做法。
You can certainly use either htaccess or PHP for this. Neither are more secure, as far as I know, that the other - though done wrong both can permit access where none is intended!
PHP might be marginally better, since you have more flexibility (in terms of integrating it with other PHP authentication, say) and you can put the folder outside the usual web root, which is good practise anyway.