Can PHP be used to deny access to PDF documents?

mrfru

I'm currently developing an online inventory system using PHP 4 to connect in to a MSSQL DB server. I've got users logging on before the system will allow them access to the site, but there are portions of the site that give the user the ability to click on a link and have a PDF of the inventory piece pop-up in a new window. Setting security on the page with the links was easy, but I'd like to be able to set security (being able to check session variables would be ideal) for each individual PDF as well (in other words, to prevent a user from typing in the entire URL path to the PDF and being able to view it without logging in).

Any thoughts?

rrijnders

Put any files that you don't want direct access to outside of the server root. Then create a php script that will validate that the user is logged in and has appropriate authority to the file in question and then retrieve the file from it's directory location and output it to the user's browser.

mrfru

$pdfhandle = fopen($path . $filename, "r");
header("Content-type: application/pdf");
header("Content-Disposition: attachment; filename=" . $filename);

fpassthru($pdfhandle);
fclose($pdfhandle);

I've got the above scenario working using your suggestion so that I can keep the PDf out of the server root. The issue that I am having now, though, is that I'm using session variables to determine who is logged on and their permission level, so once I do the session_start() PHP won't allow me to manipulate the headers. Any thoughts?

Weedpacket

Originally posted by mrfru
so once I do the session_start() PHP won't allow me to manipulate the headers. Any thoughts?

Using session_start() has never stopped me from then adding other headers.

mrfru

I get an error message about the headers having already been sent. If the session_start() is removed, it works AOK.

rrijnders

Must be something else. I can use session_start() and then send header information such as a redirect without any problems.

Post a chunk of the code so we can check it out with you...

mrfru

Code that calls showpdf.php:

<form name="Proof1" method="post" action="showpdf.php">
<input type="hidden" value="1000d/60026_sample.pdf" name="pdfname">
<a href="javascript:void(0)" target="new" onClick="document.forms['Proof1'].submit(); return false;">View PDF Proof</a>
</form>

showpdf.php code:

session_start();
require('global.php');

if ($_POST['pdfname'] == "") { exit; }

$split_pdf_path = split("/", $_POST['pdfname']);
load_pdf($PROOF_PDF_PATH . $splitpdfpath[0] . "/", $splitpdfpath[1]);

load_pdf function in global.php:

function load_pdf($path, $filename) {
	if (file_exists($path . $filename) == false) {
		print "Sorry! Unable to find the requested PDF. Please contact " . $_SERVER['SERVER_ADMIN'] . " immediately!";
		print "<br><br>[" . $path . $filename . "]";
		exit;
	}

$pdfhandle = fopen($path . $filename, "r");

header("Content-type: application/pdf");
header("Content-Disposition: attachment; filename=" . $filename);

fpassthru($pdfhandle);
fclose($pdfhandle);
}

rrijnders

Well, I don't think the offending code is in the parts that you posted. You are saying that if all you do is comment out the session_start() line, it works?

I am guessing that there must be a blank line or character above or in front of the "<?php" opener in "showpdf.php" that you inadvertently also removed with the "session_start()" during your debug testing...

rockerscc

You have to put the session_start() before any html output. Headers sent means there was already html output. Your form is html output. If you put the form in a variable and print after your session stuff, you'll be fine. you could also just put the form as html below the session stuff.

mrfru

Duh. That was it, rrijnders! Thanks for the feedback, guys.