I'm working on an application (LAMP) where users can upload files to the server but cannot share it's files with other users. So, my problem is to implement a secure mechanism that ensures user A cannot access to files uploaded by user B.
My approach is this:
- Each user has a folder for its files (/upload/userA)
- Add a .htaccess file to redirect all access to /upload folder to a PHP script
- Check if the user has permission to access to the subdirectory (/userA)
Can you see any drawback in this approach? Any better alternative?