如何防止直接访问文件？

Question

I have a system where users upload image files. I only want specific users to have access to these files and not for anyone to just go to example.php/image.jpg and see any user's image...Thanks

Answer 1

You can add the following to an .htaccess file, and drop the file into the directory where your images are stored :

To prevent directory browsing:

Options All -Indexes

To prevent image hotlinking:

RewriteEngine on
RewriteCond %{HTTP_REFERER} !^$
RewriteCond %{HTTP_REFERER} !^http://(www\.)?mydomain.com/.*$ [NC]
RewriteRule \.(gif|jpg|js|css)$ - [F]

Replace mydomain.com with your own domain name.