A community in which webmasters can ask for help with topics such as PHP coding , MySQL , IT jobs, web design, IT security.
Current location:homephp forumphp talk in 2009 yearRestrict file access to authorized php users - page 1
User InfoPosts
Restrict file access to authorized php users#1
I(ve inherited an application with a glaring security hole.

It has session-based security, but file uploads (which are user specific) are not secured in any way and they are stored in the public file tree.

Filenames do not follow any convention as such, making them hard to guess, but the data is sensitive and thus I need to implement a security measure to prevent unauthorized file access.

Moving the location of the files is not really an option, so I(m looking at a htaccess solution to forward requests to a php handler script.

Does anyone have experience in implementing this type of thing or any good alternative solutions? Specific examples of .htaccess syntax greatly appreciated, as I(m struggling in this area.

posted date: 2009-04-10 10:48:00

Re: Restrict file access to authorized php users#2
I had made out the solution of this problem. click to view my topic...

hope that hepls.

posted date: 2009-04-10 10:48:01

Re: Restrict file access to authorized php users#3
I think you may need to write a script that will serve the images, then use htaccess to completely restrict access to the actual images from a browser.The script can take in the web path to the image, decide if the user has access, then use something like fpassthru to feed an actual image to the browser.All references to the images would need to be modified, however, to reference the serving script.So instead of accessing the images with /images/123/5423453245.jpg,it would be /image.php?images/123/5423453245.jpgOr something similar to that.

posted date: 2009-04-10 10:52:00

Re: Restrict file access to authorized php users#4
Don(t really understand why moving them isn(t an option, since pushing requests for them to a handler means it no longer matters where they(re stored. But you(re the man on the scene..htaccess looks like:RewriteEngine onRewriteRule path/to/where/these/files/live/(.*) /handlerscript.php/$1Then you pick up the remaining file path and name from $_SERVER[(PATH_INFO(].

posted date: 2009-04-10 10:53:00

Re: Restrict file access to authorized php users#5
Forgot about mod_rewrite.. this is a better solution.

posted date: 2009-04-10 11:01:00

Re: Restrict file access to authorized php users#6
Well, you could make apache parse .jpg file(s for a certain folder adding the following to your .htaccess AddHandler php5-cgi .jpgthen you could set a file of php to parse the request the way chaos was recomending you and doing a certain validation, then just return jpeg headers along with the correct picture u(d like to display here(s an example<?phpif($validUser) { header("Cache-control: No-cache"); header("Pragma: No-cache"); header("Content-Type: image/jpeg"); //correct picture address $img = imagecreatefromjpeg("2326_b_lil.jpg"); imagejpeg($img); } else { //code for error image }?>please let me know if you want a more extensive example

posted date: 2009-04-10 11:03:00

Re: Restrict file access to authorized php users#7
Thanks, I will take a look at this solution - the reason for not wanting to move the location of the files is that users receive emails with links to their files (again, not me I hasten to add!). I guess it could still be done, but would require a little more work to handle the redirect?

posted date: 2009-04-10 15:20:00

Re: Restrict file access to authorized php users#8
I see what you're saying, but that's really what I need to avoid doing (changing the links). They're not images by the way :-)

posted date: 2009-04-10 15:22:00

Re: Restrict file access to authorized php users#9
The files are not generally images, but they might be. Your example got me thinking though - wouldn't it be better to just use readfile rather than recreating the image (your code converts to an uncompressed true colour file, then back to a jpeg)?

posted date: 2009-04-10 15:27:00

Re: Restrict file access to authorized php users#10
Should have added to the above that I'll bounce the user to a login prompt in future (via the handler) if they're not logged in.

posted date: 2009-04-10 15:29:00

Re: Restrict file access to authorized php users#11
Im just using that function to easily load the file data and send it to the browser, you can replace this procedure with a simple fopen and echoing the input, since you already sent jpeg headers the browser will interp it as a image

posted date: 2009-04-11 12:23:00

Re: Restrict file access to authorized php users#12
What I mean is that the URL you're publishing to your users no longer has any actual relationship to where the files live. You could move the whole hierarchy out to /var/app/foo/bar/baz and your handlerscript.php could push out the content from there just as well.

posted date: 2009-04-11 16:13:00

select page: « 1 2 »
Copyright ©2008-2017 www.momige.com, all rights reserved.