网络托管文件授权

发布于 2024-12-29 04:27:32 字数 427 浏览 1 评论 0原文

我使用基于 PHP 的登录身份验证机制来允许/限制访问我网站的某些部分（文件夹 module1、module2 等），但我在限制访问方面遇到问题到文件。我使用文档文件夹（如下所示）来托管一些可下载的文件。这些文件的链接出现在index.php中（托管在root目录中）。但是，如果由于某种原因，未经授权的用户获得了文档中存储的文件的 URL，他将能够下载该文件。

/
/documents/
/module1/
/module2/

PS：由于这是一个内网网站，我通过IP限制了对文档的访问，但是仍然有很小的机会有人使用具有允许IP地址的PC并且他拥有文档的URL。

原文

Im using a PHP based login authentication mechanism to allow/restrict access to some parts of my website (folder module1, module2, etc), but i have a problem with restricting access to files.
I used the documents folder (check below) to host some downloadable files. The links to those files appear in index.php (hosted in the root directory). However if for some reason a non-authorized user get the URL of the files hosed in documents he will be able to download it.

/
/documents/
/module1/
/module2/

PS: as this is an intranet website I restricted the access to documents by IPs, but there is still a small chances that someone use a PC with allowed IP address and he have the URL of the document.

分享到QQ

分享到微博

如果你对这篇内容有疑问，欢迎到本站社区发帖提问参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。

发布评论

需要登录才能够评论，你可以免费注册一个本站的账号。

ゝ杯具 2025-01-05 04:27:32

使用某种代理 PHP 脚本，该脚本将为用户提供文件服务，而无需提供真实的源位置。

然后，用户将看到 http://yourdomain.com/download.php?file=mydoc。 docx

真正的路径仍然是 /documents/userid/2342/mydoc.docx 或您的结构的样子。

然后让您的 download.php 文件通过以下方式提供该文件：

<?php
// Validate the user here

// Set document root
$root = 'documents/userid/'.$userID.'/';

// Requested file
$file = $_GET['file'];

// Validate
if (file_exists($root . $file))
{
    header("Pragma: public");
    header("Expires: 0");
    header("Cache-Control: must-revalidate, post-check=0, pre-check=0");
    header("Cache-Control: private", false);
    header("Content-Type: application/force-download");
    header("Content-Disposition: attachment; filename=\"".basename($file)."\";");
    header("Content-Transfer-Encoding: binary");
    header("Content-Length: ".filesize($root . $file));

    ob_clean();
    flush();
    readfile($root . $file);
}
else { echo "File not found"; }
?>

在此处查看更多

Use some sort of a proxy PHP script that will serve the file for the user without giving the real source location.

The user would then see http://yourdomain.com/download.php?file=mydoc.docx

The real path is still /documents/userid/2342/mydoc.docx or what ever your structure looks like.

Then let your download.php file serve the file by:

<?php
// Validate the user here

// Set document root
$root = 'documents/userid/'.$userID.'/';

// Requested file
$file = $_GET['file'];

// Validate
if (file_exists($root . $file))
{
    header("Pragma: public");
    header("Expires: 0");
    header("Cache-Control: must-revalidate, post-check=0, pre-check=0");
    header("Cache-Control: private", false);
    header("Content-Type: application/force-download");
    header("Content-Disposition: attachment; filename=\"".basename($file)."\";");
    header("Content-Transfer-Encoding: binary");
    header("Content-Length: ".filesize($root . $file));

    ob_clean();
    flush();
    readfile($root . $file);
}
else { echo "File not found"; }
?>

See more here

回复收藏 0 原文

~没有更多了~