Thanks for the suggestion - this is kind of what I've done in the end - all
hyperlinks to protected files are served by a script which checks for site
authentication before delivering the file - found the following useful
script on another forum:
//authentication checking script first, then...
$dir = $_SERVER['C_DOCUMENT_ROOT'].'/protected/';
$file = $dir.basename($_REQUEST['dl']);
if (isset($_REQUEST['dl']) && file_exists($file)) {
header('Content-type: application/force-download');
header('Content-Transfer-Encoding: Binary');
header('Content-length: '.filesize($file));
header('Content-disposition: attachment; filename='.basename($file));
readfile($file);
} else {
echo 'Either there was no file with that name for download, there was an
error, or your login session expired.';
}
Thus, if anyone tries to access the protected directory directly, a prompt
for a password is given, which should prevent all but the most tenacious
hacker (there's nothing worth that much effort in the directory anyway), and
if any registered user tries to copy the links to the files (in the form
http://www.mydomain.com/dl.php?dl=filename) and pass them onto a
non-registered user, entering the url into the browser will forward them to
the log in page.
I will add the 404 handler as per your suggestion too, just as an extra
safeguard.
J
--
-----Personal Disclaimer--------
Thanks to the explosion of abuse of email on the 'net,
I have taken to adding this disclaimer to all email. It's
not a legal statement, just a form of insurance. If you
get a message that appears to be from me, but it doesn't
have this disclaimer at the bottom, please treat it as
spam, as it has not originated from me.
-----End Disclaimer------
"Daniel Tryba" <news_comp.lang.php@canopus.nl> wrote in message
news:clo16s$1o4$1@news.tue.nl...[color=blue]
>
> So you are using apache:
> - move file out of the documentroot (or into a directory protected by
> .htaccess)
> - add a 404 handler to the protected-directory which points to a php
> script which uses your normal authentication methods
> - have this script serve the "protected" files, you'll need to set the
> correct mime-type and http-status (eg 200) if the actual file can be
> found
>
> --
>
> Daniel Tryba
>[/color]
