PHP prevent direct access to file but still use in download script

Question

I have simple download script (used for Wordpress file downloads

if($filesize) {
        header('Content-Type: application/octet-stream');
        header("Content-Transfer-Encoding: Binary"); 
        header("Content-disposition: attachment; filename=\"" . basename($file_url) . "\""); 
        readfile($file_url);
    } else {    
        echo '<p>No file found</p>';
    }

I want to prevent users from accessing download files by direct access to them, so if user types in the path in browser, file should not be accesible.

I've tried this with .htaccess but without results. It was blocking the file directly but also script won't download the file.

Any help?

Thanks!

Just store the files to be accessed in a directory that's not accessible via the HTTP server you're running. — GordonM
– GordonM, Commented Mar 15, 2017 at 11:48
Thats quite not possible in this case, I store everything in one folder (protected files and not protected) — kroma
– kroma, Commented Mar 15, 2017 at 12:34

Dan · Accepted Answer · 2017-06-16 21:30:54Z

2

If the files are on the same box as the PHP script, move them out of the webserver directory so the script can access them but users can not.

edited Jun 16, 2017 at 21:30

answered Mar 15, 2017 at 11:25

Dan

514 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

kroma Over a year ago

download.php script is in different location than files which are meant to be downloaded, different folders.

Neinrappeur Zaki · Accepted Answer · 2017-03-15 11:35:11Z

0

i will assume that User need to click certain button to get the file ,means a post method ,and if not from post you show theme an error message,

if($_SERVER['REQUEST_METHOD'] != 'POST'){
   echo 'Error: You cannot access this link Directly';
}

im also assuming you have your files on separate Folder where you can create new .htaccess file with the following rules:

Order Deny,Allow
Deny from all

edited Mar 15, 2017 at 11:35

answered Mar 15, 2017 at 11:29

Neinrappeur Zaki

3972 silver badges12 bronze badges

5 Comments

kroma Over a year ago

No, user click link which leads to download.php?file_id=66, then download.php serves the file to download. But if somehow user figures out from which folder it came from, it still can be accessed with direct link in browser.

Neinrappeur Zaki Over a year ago

you used .htaccess file?

kroma Over a year ago

Yeah I've tried Order Deny,Allow Deny from all But this also prevented Wordpress from accessing the files, also files with my script were downloaded but the files were empty...

Neinrappeur Zaki Over a year ago

ok , if ur files are in one folder , create new htaccess with following rules : Order Deny,Allow Deny from all

kroma Over a year ago

Yeah I did that, but as I've mentioned above this caused problems with accessing the files with the script too

AdilKhan · Accepted Answer · 2017-03-15 11:45:08Z

0

to solve this issue what you can do is you can keep the script file out of folder where download files and .htaccess files are located.

By doing so users cant access download file directly if user types in the path in browser, file will not be downloaded. they can only access files via script.

hope it makes sense.

answered Mar 15, 2017 at 11:45

AdilKhan

114 bronze badges

Collectives™ on Stack Overflow

PHP prevent direct access to file but still use in download script

3 Answers 3

1 Comment

5 Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

1 Comment

5 Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related