file permissions per user

johanf

I'm thinking about making a photo album and I would like to be able to restrict access to some pictures. I use an mysql db for users and passwords on a shared linux provider.

The way this is usually done, if one looks at the ready-made galleries out there, the users access-level dictates which files are shown in the browser. A user - knowing the path and filename of a restricted file - could easily view the picture by submiting it in the address bar of the browser.

How can I prevent this and still keep a smooth web-based login system for the users? 😕

thanks

bastien

use sessions and on each page look for the user level which should be one of the session variables...if the session variable is not there then disallow access to the user and redirect the user to the login in screen....

the ideal way to do this is to place a function that does all this in a common shared file that holds elements common to each page (header, footer, security etc) then just call the function and run the check....

simple clean and effective

hth

johanf

Thanks, but that is just the wat i'm doing it for .php and .html files etc.

Maybe I was a bit unclear above but basically what I want to prevent is a user typing (for example):
www.mydomain.com/photos/album1/pic0001.jpg
and then getting the picture displayed in the browser.

Is there maybe some thing that can be done on the webserver to force it to always load a specific page when accessing a directory. For example if the user types the URL above then he will automatically be redirected to say index.html or something like that, although the .jpg file exists in the directory.

Hope I made myself clear this time. Thanks anyway bastien 🙂 maybe you can solve this one for me.

theeper

Have your user log in though some authentication mechanism. Then use a header redirect to point them at the file that contains links to each image if they are properly logged in. Then don't allow access to the links page from anywhere but the referring page.