[RESOLVED] Restricting file download?

hagen00

Hi there

Does anyone know how to restrict file download to a particular group?

E.g. I've got a file in download/file.doc, but now i only want to allow certain users to download that file. Currently everyone can just type in the url mydomain.com/download/file.doc and can get the file.

Protecting the file (or folder that it is in) with .htaccess is not ideal, since then my goup of users that do have download permissions would need that username and password. I want to do it a bit more elegantly and seamlessly.

Any ideas?

Frederick

you can always have a link to point to a process page and have the file set in this page.

<?php
if ($_GET['file']==1) {
    header("Content-Disposition: filename=\"myfiles/my_excel_sheet.xls\""); 
}
?>

Use your link as follows:
<a href="process_page.php?file=1">Download Now</a>

By setting up a stream for the file, the user does not know where it is coming from.

hagen00

<?php 
if ($_GET['file']==1) { 
    header("Content-Disposition: filename=\"myfiles/my_excel_sheet.xls\""); 
} 
?>

Thanks for the reply.

So now the user does not know that there are files located in the folder "myfiles", but if they were to find out, they could still just enter the path into the browsers i.e. mydomain.com/myfiles/my_excel_sheet.xls and download the file. That's what i'm trying to prevent and i don't think your method prevents that.

Davidc316

Why not just use session variables?

jimsus

You could put the doc file in a directory on your server that's not public to the internet, and have PHP dish it up once the user is authenticated?

Or, a more ugly solution would be to store it in a database using blob?

hagen00

Again, thanks for the replies!

Why not just use session variables?

Not sure how session variables will protect my file.

You could put the doc file in a directory on your server that's not public to the internet, and have PHP dish it up once the user is authenticated?

Jimsus, now that sounds interesting! How would this be done? Using a bash script to move the file to a public folder once the user is authenticated? I'm just guessing here. What do you mean by PHP dishing it up?

Many thanks

Edit:

I think this link here explains what jimsus meant. http://www.zend.com/zend/trick/tricks-august-2001.php
I'm going to give it a bash...

hagen00

That link i posted in my message above sorted me out! Works very nicely.

jimsus

Sound! good work 🙂