restrict access to directory revisited

[robtomorrow]

I have a problem identical to this one that was posted a couple of years ago

"I am making a website with a members area. I have used some basic
session management to create a login page and then use the session to
control access to other pages.

I need to have a directory within the members area where the
organisation will upload files such as minutes of meetings, agendas,
etc. etc.. I want to be able to list the files in this directory on a
members only page, which I can do with opendir() readdir() etc. and some
formating to put links around the filenames.

My question is. How do I protect the files in that directory from being
accessed by somebody who knows the full path and file name?"

The best anwser was this one,

"Save the file in a folder that's not accessible through Apache, then use a
PHP script for file downloading:

<a href="download.php?file=whatsup.doc"> ... </a>

download.php:

$file = basename($file);
$filepath = "$download_folder/$file";

.... check to see if user is logged in ...

header("Content-type: application/x-octet-stream");
header("Content-Disposition: attachment; filename=$file");
session_write_close();
readfile($filepath);"

I got that to work, but that is not exactly what I want to do, that script creates a download link, I just want to display the file (pdf) as if it were a simple hyperlink. Can someone help me with a script that does that.

[zorgi]

You would have to send appropriate HTTP headers for each file.

For eaxmple for pdf files :

header('Content-type: application/pdf');
readfile("path/to/your/pdf/file.pdf");

or for jpg

header("Content-type: image/jpg");
readfile("path/to/your/jpg/file.jpg");

[robtomorrow]

Thank you zorgi,

This is the script I am wrote from what you gave me,

<?php
    //check to see if user is logged in
    require_once('auth.php');
 
    if(isset($_GET['file'])) {
        $file = $_GET['file'];
        header('Content-type: application/pdf');
        readfile($file);
    }
?>

And it works nicely,

Rob