文件管理系统及其保护

Question

I want to code a PHP-server file managing system and I am not sure how things are if it comes to protection. I mean every user can simply type into their browsers exact url of those files that will be uploaded to server by users f.e: htpp:///www.domain.com/files/user_name/file.doc. Those files that will be uploaded are very delicate and cannot be accessed another way than when logged in :x I don't know how to make this work

Answer 1

You can save the uploaded file in a directory that is not available from the outside, and make a script to access these files.

For exemple, in an apache2 configuration, you could have this :
/var/www/html (directory available from the outside)
/var/mydata (directory where you are going to send the uploaded file into)

And you can have a script like :
/var/www/html/get_file.php

This script checks that the user is authorized to access the resources, and then force a download header.
Example for a zip file :

$attachment_location = "/var/mydata/myfile.zip";
header("Content-Type: application/zip");
header("Content-Transfer-Encoding: Binary");
header("Content-Length:".filesize($attachment_location));
header("Content-Disposition: attachment; filename=filePath");