Controlling downloads of files

[webpoet]

I´m creating a private community which allows users to store documents on the server for later downloading by themselves or for attaching with e-mails. Now, I will of course have a table in the db that will keep track of all files and who they belong to, but I don´t want to store the files in the database.

What I can´t figure out is a simple sollution for protecting the files from being downloaded by other users who might guess the right filename. Can anyone give me a hint ?

The only sollution I can think of myself is storing them in a directory on the server that is not accessible via the web and make temporary copies of them to a public dir when they are to be downloaded but I must admit I don´t know how to do that so either I would like some hints on that or another (better?) solution).

Thanx in advance.

[jackiw]

First you put all the files in the directory bellow and after you have to chmod the directory to disable the web and other kind of access. (chmod 200).

And then what you can do is something like:

$dir_path = "/your/path/to/directory";

if($access == "ok") {
chmod($dir_path, 0755);

//Rest of the code to download the file

} else {
print "Access Denied";
}

[Daggeth]

Another way is to put the files in a directory protected by .htaccess and have your script (when asked to download a file) send proper authentication to retrieve the file.

[webpoet]

After having read some other threads here I think I´ll go with the below solution. Theres one problem with it tho: With netscape the filename is filename.doc.php instead of just filename.doc. It works fine with IE. Anyone know how to fix it ?

<?
$file="/path/filename.doc";

if ($fd = fopen ($file, "r")){

      $size=filesize($file);
      $fname = basename ($file);
      header("Content-type: application/octet-stream");
      header("Content-Disposition: filename=\"$file"");
      header("Content-length: $size");
      while(!feof($fd)) {
           $buffer = fread($fd, 4096);
           echo $buffer;
      }
      fclose ($fd);
	  exit;

}
?>

[tsinka]

Hi,

for netscape the Content-Disposition has to be

Content-Disposition: attachment; filename = xxx

But that should also work with ie (if not you'd have to implement a browser detection).

If there is a browser that still displays the document instead of letting the user download it you might try to change

application/octet-stream

to
application/RFC822
or
application/force-download

[webpoet]

Well, with Content-Disposition: attachment; filename = xxx it works well in NS, but then in IE it first says that you are downloading the actual file that sends it (file.php) and then after you choose to it sends the correct file.
I could add browser detection but I figure it would be impossible to cover all browsers so does anyone have a way to fix it in some other way ? Me greedy 😛