file protection

H!
I know I could use login and check http_referers.
But when the person gets to download the file then he
has the direct link to the file so later he doesnt have to
login anymore. That is when I want to prevent.
I dont want people to be able to downlaod the file directly
without being authenticated.

Thank you for your help.



"Iván Sánchez Ortega" wrote in
message
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> Yannick Benoit wrote:
>
>> anyone can tell me a way to protect files from being downloaded from
>> other
>> sites using php ?
>
> Don't put the files in the document root of your webserver, use readfile()
> or a silimar function to provide the file, and check the HTTP referrer.
>
> - --
> - ----------------------------------
> Iván Sánchez Ortega -i-punto-sanchez--arroba-mirame-punto-net
>
> Cuando la sociedad esté preparada intentaré ser diferente.
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.2 (GNU/Linux)
>
> iD8DBQFDqyvv3jcQ2mg3Pc8RAqzQAJ0dRn3xQIE96Y5846olJpjF9vonFwCfQ0sJ
> iDfrPwGs+//E+EOwGNt6zI8=
> =Wo2K
> -----END PGP SIGNATURE-----
 >> Stay informed about: file protection 

>I know I could use login and check http_referers.
>But when the person gets to download the file then he
>has the direct link to the file so later he doesnt have to
>login anymore.

So make sure the *ONE* and *ONLY* URL that can be used to retrieve
the file checks whether the person is logged in.

>That is when I want to prevent.
>I dont want people to be able to downlaod the file directly
>without being authenticated.

Put the actual file outside the document tree so the web server
will not serve it directly with any URL. Install in the document
tree a PHP page that checks that the user is logged in, then generates
an appropriate content-type header, then serves the file by calling
fpassthru(). The file can be anything you want: image, executable,
virus, .zip, or whatever, and its being binary won't hurt.

This is the URL you give to a user. The user can post it on the
Internet if he wants to, or you can let Google index it, but assuming
you properly wrote your login check, nobody can get the file unless
they are logged in.

I recommend the uses of PHP sessions for handling logins, but there
are other ways that work also.

Gordon L. Burditt
 >> Stay informed about: file protection