目录结构逻辑
我正在尝试创建一个像这样的文件夹结构：
- 上传的文件
- 一个
- b
- c
- ...一直到 z
公共 Web 目录上方的 z 一级。唯一的唯一键（除了 user_id 本身）是用户电子邮件，因为他们的电子邮件就是他们的用户名，所以...
问题：人们是否能够访问这些目录并获取所有用户的电子邮件地址？这是一个多么糟糕的主意？您建议什么可能的替代方案？
谢谢。
I am trying to create a folder structure like so:
- Uploaded files
- a
- b
- c
- ...all the way to z
one level ABOVE the public web directory. The only unique key (besides the user_id itself) is the user email, since their email is their username, so...
Question: Would people be able to access these directories and get a hold of all user's email address? How bad of an idea is this? What possible alternatives do you suggest?
Thanks.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（4）
一定要确保使用哈希值而不是纯文本电子邮件地址。这是必须的。
除此之外，我想这与基于模糊安全性的解决方案一样安全（和不安全）（即您的安全性仅依赖于没有人知道 URL 的事实 - 但如果他们知道，他们可以访问它们）没有限制。）有很多潜在的漏洞——用户可以为 URL 添加书签；它可以嵌入页面上的某个位置；它可以存储在服务器、浏览器和代理日志中......
Definitely make sure you use hashes instead of plain-text E-Mail addresses. That is a must.
Other than that, I guess this is as safe (and unsafe) as a solution can be that is based on security through obscurity (i.e. your security relies solely on the fact that nobody knows the URLs - but if they do, they can access them without limitation.) There are many potential holes - a user could bookmark a URL; it could be embedded somewhere on a page; it can be stored in server, browser, and proxy logs...
看一下 PHP
dir函数：http://php.net/manual/en/class.dir.php
如果您希望用户可以通过网络公开访问这些文件夹，为什么要将这些文件夹放在网络根目录之上？
此外，您可以考虑对文件夹名称使用某种哈希，1) 因为没有人希望公开泄露他们的电子邮件地址，2) 泄露内部 user_ids 可能会导致漏洞利用。
Take a look at the PHP
dirfunction:http://php.net/manual/en/class.dir.php
If you want the folders to be publicly accessible to your users via the web, why put the folders above the web root?
Also, you may consider using some sort of hash for the folder names, 1) because nobody wants their email addresses publicly revealed, and 2) revealing internal user_ids could lead to exploits.
正如佩卡刚刚回答的那样；对电子邮件地址进行哈希处理可能是一个好主意，因为链接很可能会发布到论坛或类似的地方，然后该帖子可能会被电子邮件地址爬虫抓取。我认为只需一个简单的地址哈希（例如 md5）就可以（几乎）解决这个问题。
请参阅此线程了解如何防止目录列表，以及如果采用 Apache 方式该怎么办不起作用。
As Pekka just replied; it might be a good idea to hash the email addresses since there's a big chance that the links might be posted to a forum or similar, and the post might then get crawled by an email address crawler. I think that just a simple hash (e.g. md5) of the address would (almost) solve this.
See this thread on how to prevent directory listing, and what to do if the Apache way doesn't work.
对电子邮件进行哈希处理以用作文件夹名称，并将其放在 Web 根目录之上。
您可以使用简单的身份验证来访问此文件，并使用 php 文件来读取它们并发送
他们到浏览器。
Hash the e-mails to use as folder names and put it above web root.
You can use a simple autentication to give access to this files and a php file to read them and send
them to the browser.