php文件夹和文件权限

Question

i have some questions on how folders and files permissions work. say i have users directories outside 'protected' as below..

users
  -- usera
    -- docs
  -- userb
    -- docs
protected

i do not want user B who does not have the rights, to access anything in user A directories. also, i do not want any person to access the directories directory via url links. basically i just want users to be able to access their own directories, and no one else. how can it be done?

thanks!

Answer 1

I answered a simular question here limiting users to subdirectories which you should be able to adjust to suit your needs, I've copied it here as well.

Download.php

<?php
/** Load your user assumed $user **/

$file = trim($_GET['file']);

/** Sanitize file name here **/

if (true === file_exists('/users/user'.$user->id.'/'.$file)) {
   //from http://php.net/manual/en/function.readfile.php
   header('Content-Description: File Transfer');
   header('Content-Type: application/octet-stream');
   header('Content-Disposition: attachment; filename="'.$file.'"');
   header('Content-Transfer-Encoding: binary');
   header('Expires: 0');
   header('Cache-Control: must-revalidate, post-check=0, pre-check=0');
   header('Pragma: public');
   header('Content-Length: ' . filesize($file));
   ob_clean();
   flush();
   readfile($file);
   exit;
} else {
   throw new Exception('File Not Found');
}

.htaccess To deny all direct file downloads

deny from all

You would then link to the folders by using /download.php?file=filename.ext and it would only download that file from the users directory of the current user.

You'll want to ensure you sanitize the input file name so you're not vulnerable to directory transversal exploits.