Protecting files

[morgymorg]

Ive made a password protected area that uses cookies. Each HTML file has a header that checks for the cookie to see if the user is ok to access the file.

Heres the problem- how do i use the same system to work on downloadable files, like .doc or .pdf files? can i put header info into these files or wot?

much obliged,
Morgan.

[malbera]

Put the files outside the document root (htdocs or so) and let them be downloaded only through some php script that requires authentication
hope that helps

[morgymorg]

but will the path be secure? - if someone types in the URL to the downloadable file they will be able to download it wont they?

[the_Igel]

If a file is out of document root, ie your web directory, one can't type the URL to it, 'cause there's none.
Another story is how secure your script will be.

[malbera]

and what will be the url?
you have, for example, /usr/local/apache/htdocs/dir1 for your site
if you put those files in /usr/extra/dir1, what will be the url someone could type in order to download the file?!?

[the_Igel]

You've just said about accessing it via some script. I just commented your idea, no more ;-)

[morgymorg]

ok ok, i get yers.

im a dum dum.