[SOLVED] Trying to restrict access to certain folders in server

[Yesideez]

My website has various files available for download but I only want to have those files accessible by scripts contained on the web server.

 

I've got an empty index.php inside each folder so people can't browse the files but what I'd like to do is have them get "Access denied" by Apache rather than empty space.

 

I borrowed a one liner from a friend's set-up which he uses to do exactly what I'm wanting to do:

deny from all

but this denies everything even if I try and download a file using the website so I then had a read up and came up with this:

Order Deny,Allow
Deny from all
Allow from www.pictureinthesky.net

Again, that denies everything access still.

 

This is a direct link to one of the files:

http://www.pictureinthesky.net/files/games/cfodder2.zip

 

I've managed to set up a rewrite rule to prevent hotlinking but can it also be made to prevent users typing the URL directly into the browser?

 

Any help gratefully appreciated!

[trq]

You need to move the files into a directory that is outside of your document root. You then serve the files via a php script to authorized users only.

[Yesideez]

The files are inside their own folder already but it's how to authorise - that's the bit I'm stuck on.

[trq]

Inside there own folder outside of your document root?

[Yesideez]

Now I'm not sure I understand what you mean - if they're inside their own folder then they're outside of the document root :/

[trq]

Now I'm not sure I understand what you mean - if they're inside their own folder then they're outside of the document root :/

 

Not if those folders are within the document_root. eg;

 

[pre]

/home

  |

  |

  _ /web_doc_root

    |

    |

    _ /dir1

    |

    |

    _ /dir2

[/pre]

 

The contents of /home are outside your web document root and therefore unreachable via the web, dir1 and dir2 however are not and all files within them are directly accessible via http://yourdomain/dir1/*.

[Yesideez]

Gotcha!

 

Thanks for explaining that, I'll certainly be looking into relocating those file outside the public_html folder