File access control

[Anon]

Hello,

I would like to give registred users the ability to store files online on the webserver that's running apache.

When the user logs in using he gets a list of the files that he has access to. These files are downloadable through links.

But, how do I prevent user X to not type in the exact directory and filename which belongs to user Y as an URL and then get the download prompt for that file?

// Magnus

[Anon]

You probably need to stop giving direct access to files. Instead:
Move the uploaded files out of any Apache DocumentRoot.

Then, write a PHP-wrapper which
1) Checks if the user is allowed to
access the file.
2) If yes, then set the correct MIME
content-type with some header()
calls.
3) You should probably also send out
some HTTP-headers making the file
cacheable in the browser, at least
for a couple of hours.
4) Output the file contents to the browser
via the readfile() function.

[Anon]

How do I figure out what MIME-type to send?
For some I could imagine that you can guess frmo the filename extension, but the other ones? Are there a generic one for "data"?

Thanks for your previous answer!

// Magnus

Troels Arvin wrote:

You probably need to stop giving direct access to files. Instead:
Move the uploaded files out of any Apache DocumentRoot.

Then, write a PHP-wrapper which
1) Checks if the user is allowed to
access the file.
2) If yes, then set the correct MIME
content-type with some header()
calls.
3) You should probably also send out
some HTTP-headers making the file
cacheable in the browser, at least
for a couple of hours.
4) Output the file contents to the browser
via the readfile() function.

[Anon]

Yes, there is a generic MIME type for unspecified, binary data:
application/octet-stream

About guessing a mime-type:
Apache is normally distributed with a file called mime.types which is a sort of plain-file database of suffix vs. mime-type relations.

An other thing to look into: On most modern unix systems, there is a command-line utility called "file" which is rather good at telling you what a file contains. If you use the -i switch with "file", then it will also output the guessed mime-type.

See also
http://sunsite.dk/RFC/rfc/rfc1341.html

[Anon]

Thanks for the info Troels, you have been real helpful!

// Magnus