Secure files and folders

[toneee]

Hi,

I have recently created a auth section on my site, i have got the username and password working to protect a specific file, but i need to secure a directory.

For example, if i had a site that was a gallery, the main page which displayed all the thumbnails would be secure with my script, but you could just view the images in the directory.

Is there anyway to stop this or do i have to use the .htaccess files?

Kind Regards

Tony

[rebelo]

PHP cannot protect your directory or images from being viewed directly. You have to use apache to do this. If you disable indexes and put an index.php file in that folder, you will prevent anyone from seeing a list of files in the directory, but that still doesn't 'secure' the directory, because anyone who knows the url could still get at the files directly (with the filenames).

You have to use .htaccess if you want to lock the directory right down.

[ozzythaman]

you CAN do it with php but it will be slow, i've done it,

you can have a gateway php file that accesses ALL images and prints them out directly to the browser as if they were the images themselves. the intended graphics file is determined by the parameters given to the php file like showpic.php?file=aa.jpg

and the accessed directory could be totally invisible from the apache side, it only needs to be accessed through the filesystem, and could be on a completely different drive. the directory COULD be visible also but a difficult one like "/strangedir/hereare/dafiles" and the showpic.php would know that as a base and access all files from there.

but this IS slow, as said..

one big + is that you can log every single access to all files to a database very easily.

oz