How to hide files... only logged can DL?

Anon

I'm writting a mini PHP application that will store PICTURES (all have JPG extension) in high resolution and only for people who may login (pay) for certain pictures may DOWNLOAD them...

How to allow only APACHE to use this pictures (to show them) from certain url...
and if somebody knows the url to picture (for example: http://my.domain.com/pictures/picture.jpg
)

cannot open it...
only APACHE may enter this directory or sth... nobody else...

as a result we know that only PHP scripts may show this pictures (in /pictures/ directory and its subdirs) and nobody can steal PICTURES.

THX a lot!!!

P.S. I can administrate apache server but I haven't got experience and haven't done anything similar before

ruppelm

Hi,

Copy all imges in a directory which is NOT accessable over WWW. This means: Put them somewhere outside your document root dir. This dir. should be readable to the apache-user within the filesystem, though.
Create a php-Script like this:

<?php

$imagefilename = "/path/to/secure/dir/picture.jpg";

// Check if user is valid.
if ($username == "GoodGuy")
{
header("Content-type: image/jpeg");
$fp=fopen($imagefilename, "rb");
fpassthru($fp);
flush();
}
else
{
echo "Sorry - access denied!";
}

Keep in mind, that the header() requires that no output has been generated before. So make sure that there is NO space, empty line or any other whitespace before the "<?php".

Cheeres,
Markus

Anon

HI and THX for trying to help me!!!

readable to the apache-user within the filesystem

how to do it... should I make apache user or sth... I haven't done it before... if you know how to do it... please answer me

ruppelm

Hi,

sorry for confusing you ;-)
The Apache server, as any other process, runs under a certain user name. This user is in most cases called "wwwrun" (at least on unix systems). Usually this user is automatically generated when installing LINUX with apache.

For a start forget about the confusing line in my previous message. In most cases it will be enough to simply create the dir. and put the images there.

Cheers,
Markus

Anon

Would APACHE be able to create dirs outside WWW root (under UNIX) ...
I'm creating directories dynamicaly to CATALOGUE the files...

I'm wondering ... if apache will be able to create directories and upload files through HTTP FORMS to this directories (as it is right now)...

ruppelm

Hi Przemek,

the directory I am talking about is not created by apache but by yourself, indepentent of all web-servers.
Create the dir. exactly the same way as if you want to upload your html-files.
On MS Windows use e.g. the Win. Explorer.
On Unix use the mkdir-command.

Hope I'm not confusing you again ;-)

Cheers, Markus

Anon

I'm making new directories DYNAMICALY... using PHP scripts....

mkdir();

ruppelm

Do you not have any direct access to your server???
Well, anyway, you should also be able to create the mentioned dir. with php-scripts.

Cheers, Markus

hussainz2000

i have same problem but on IIS...
the file on iis now have secret by username and password...
i want to let only wanted people entred to it but by username and password ...
how can i do it...
pls step by step..
thx alot

ruppelm

Hello Nassem,

I'm not quite sure what exactly you want to do. Do you

want the URL/file location to be secret by any means

simply want to have the corresponding URL accessable by selected persons only?

Cheers, Markus

hussainz2000

yes second one,i want only selected users to enter to this file on IIS but the problem this file has password and username from IIS ,now i want put php secript which shpw username and password textbox if user now enter his/her username and password on my PHP script the script let him enter to this protiction file directely without messagebox from IIS which want password and username.....

another meaning:
old methode:
suppose you want to enter site by path a.b.c.com,
when u put this path in the browser and press enter u will get message box becuz this site has protection from IIS.this message box want from u fill three filds, one is username second is password 3ed is domain.if u fill it corectly u can see the file contents.
note:the username and password only one i.e:u can't make more than one password and username.
<b>now</b> i want to write PHP script show first time password and username, if it is right the user enter directly to file without IIS's username and password.
thx alot.