Protecting folders

I have a data driven website. Part of the website is a downloads
section - all the downloads are help in a folder called "downloads".
When a general user (i.e. one that doesn't have a log in) uses the site
and access the downloads page they are given a list of general
downloads. When a member who has logged in uses the site, the same page
presents the general downloads and the member only downloads.

This all works fine.

A slight hole in this security, however, is that the downloads folder
is not protected. I have moved the member downloads into a subfolder
within downloads. How can I protect this so that only people who are
logged in can access it - so that general users cannot accidentally
browse it or make a direct link to the documents within it?

Hope this makes sense.

Any ideas?

Not sure, but maybe you should htaccess the subfolder, and then write a
script that checks wether the user is logged in or not, and if he is,
it passes the file on to the browser.

Not sure if it's possible, but this is where i'd start looking..

upload index.php to members dir


index.php :

check login
if user not logined > redirect to downloads
else > print members dir content


That is partial solution.

<StevePBurgess@gmail.com> wrote in message
news:1111680901.441654.276220@l41g2000cwc.googlegr oups.com...[color=blue]
> I have a data driven website. Part of the website is a downloads
> section - all the downloads are help in a folder called "downloads".
> When a general user (i.e. one that doesn't have a log in) uses the site
> and access the downloads page they are given a list of general
> downloads. When a member who has logged in uses the site, the same page
> presents the general downloads and the member only downloads.
>
> This all works fine.
>
> A slight hole in this security, however, is that the downloads folder
> is not protected. I have moved the member downloads into a subfolder
> within downloads. How can I protect this so that only people who are
> logged in can access it - so that general users cannot accidentally
> browse it or make a direct link to the documents within it?
>
> Hope this makes sense.
>
> Any ideas?
>[/color]

Hi - thanks. I thought about that but it turns out that the webserver
doesn't allow users to browser the directory structure anyway. So I
guess the biggest problem is people guessing the names of the downloads
and linking to them directly. I guess this is unlikely to happen... :oS