How to sucure a folder, but still accessable.

[Mancent]

I am not even sure if this can be done or not, nor do I know If I am asking in the right place. but here it goes.
 

I have this folder located here

http://192.168.0.2/account/1/

 

and to get in this folder account/1/  
I want to add a file called getfile.php
With some conditions to meet before it gets the file.

for a example if I have a file called picture.jpg
I do not want to be able to go to the web address and get the file directly.
In this case it would be

http://192.168.0.2/account/1/thumb/picture.jpg 
http://192.168.0.2/account/1/large/picture.jpg

 

What I am wanting to do is to lock the folders and only be able to get the files if they go to a url like this

http://192.168.0.2/getfile.php?id=1

 

get file will call for the folder of the account in this case 1

http://192.168.0.2/getfile.php?id=1&path=thumb

 

or path can be large in this case

and also I will add other conditions that will be requested like access token so you just can not get into any one folders with out having the correct access.

so when it is all said and done it would be something like this.

http://192.168.0.2/getfile.php?id=1&path=thumb&file=picture.jpg&access_token=kkjbkf9asdf89anfds98gasn87ta8sdf

 

and if all is well the file displays, but if not then nothing error message.
but also even though the file is located at 

http://192.168.0.2/account/1/thumb/picture.jpg 

 

they can not go directly to that link to get the file with out going through the getfile.php
so the getfile.php would send maybe some type of $_POST method that would unlock the folder maybe using .htaccss

any one have any ideas how I can lock a folder, and then use php to access it.  

Edited February 11, 2014 by Mancent

[Mancent]

<?PHP
if(isset($_GET["uid"]))
{
$uid = $_GET["uid"];
}
else
{
	return;
}
if(isset($_GET["path"]))
{
$path = $_GET["path"];
}
else
{
	return;
}
if(isset($_GET["getfile"]))
{
$getfile = $_GET["getfile"];
}
else
{
	return;
}
if(isset($_GET["thumb"]))
{
	$thumb = $_GET["thumb"];
	$mypath = '../../protected/accounts/'.$uid.'/'.$path.'/'.$thumb.'/'.$getfile.'';
	
	
}
else
{
	
	$mypath = '../../protected/accounts/'.$uid.'/'.$path.'/'.$getfile.'';
    
	
	
}


$line =   '<img src="../../protected/accounts/'.$uid.'/'.$path.'/'.$getfile.'"/>';
echo $line;


?>

So I was thinking about if I could do this also.

 

I started to write the getfile.php

 

and my thinking was to put the folder behind the web root.

 

so say I have my web root here

www/index.php

 

and you can read and view all the files in the www root, but you can not view the folder behind it

like

dir listing

www/

protected/

 

I wanted to put the files in the back so they are not access able using http://localhost/protected

but I wanted the getfile.php to read the protected folder where they files are on the server, but not have a link using URL

 

but that's not working yet. any ideas? how I can read files that are not in the web root directory

 

 

[Psycho]

There is actually an easy solution. The first step is to put these files outside of the web directory. For example, if the root of your site is at C:\webroot\mysite\, then put your files in a folder such as C:\webroot\files\. Now, that folder and the files in it cannot be accessed from the web browser directly through a URL. You can then create a page that will serve the files to the user. You can create that page to use whatever parameters you pass to do whatever you need.

 

Once you verify that the user is authorized you will 'send' them the file

 

 

//Insert code to determine the file to use and whether the user should access it
// . . .
// . . .
//$file - variable assigned value of path to file
// . . .

header('Content-Type: application/octet-stream');
header('Content-Disposition: attachment; filename="'.basename($file).'"');
header('Content-Length: ' . filesize($file));
readfile($file);

[Mancent]

ya that's good.. so this is working well the readfile was what I was missing.

this is good so you can use, external drives to store files off site then just code it to connect. that is good.

and this is working nicely

http://somedomain.com/getfile.php?uid=1&path=images&getfile=nameoffile.jpg&private=false&accesstoken=dsjfbhsdfonebibds8ds89fy9dasfgnsd987fgn9y8ds9

Edited February 11, 2014 by Mancent

[Mancent]

<?PHP

require_once "core/connect.php";

$root_path = '../protected/accounts/';

if(isset($_GET["uid"]))

{



if(empty($_GET["uid"]))

{

//RETURN TO HEADER 

return;

}

else

{

//DO A SELECT MYSQL TO CHECK IF USER ID IS REAL

$uid = $_GET["uid"];

}

}

else

{

//RETURN TO HEADER 

return;

}

if(isset($_GET["mid"]))

{



if(empty($_GET["mid"]))

{

//RETURN TO HEADER 

return;

}

else

{

//DO A SELECT MYSQL TO CHECK IF USER ID IS REAL

$mid = $_GET["mid"];

//DO A CHECK TO MAKE SURE MID IS WHAT THE SESSION ID === ELSE RETURN TO HEADER

if($mid == $_SESSION[mid])

{


}

else

{

//RETURN TO HEADER

}

}

}

else

{

//RETURN TO HEADER 

return;

}

if(isset($_GET["at"]))

{



if(empty($_GET["at"]))

{

//RETURN TO HEADER 

return;

}

else

{

//DO A SELECT MYSQL TO CHECK IF USER ACCESS_TOKEN IS REAL FOR MID

$at = $_GET["at"];

}

}

else

{

//RETURN TO HEADER 

return;

}

if(isset($_GET["security"]))

{



if(empty($_GET["security"]))

{

//RETURN TO HEADER 

return;

}

else

{

//DO A SELECT MYSQL TO CHECK IF USER SECURITY IS SET TO PUBLIC FOR UID

$security = $_GET["security"];

}

}

else

{

//RETURN TO HEADER 

return;

}

if(isset($_GET["f_stat"]))

{



if(empty($_GET["f_stat"]))

{

//RETURN TO HEADER 

return;

}

else

{

//DO A SELECT MYSQL TO CHECK IF USER UID IS FRIENDS WITH MID

$f_stat = $_GET["f_stat"];

}

}

else

{

//RETURN TO HEADER 

return;

}

if(isset($_GET["path"]))

{

if(empty($_GET["path"]))

{

//RETURN TO HEADER 

return;

}

else

{

//DO A SELECT MYSQL TO CHECK PATH FOR USER ID

$path = $_GET["path"];

}

}

else

{

//RETURN TO HEADER 

return;

}

if(isset($_GET["getfile"]))

{ 



if(empty($_GET["getfile"]))

{

//RETURN TO HEADER 

return;

}

else

{

//DO A SELECT MYSQL TO CHECK FILENAME FOR USER ID

$getfile = $_GET["getfile"];

}

}

else

{

//RETURN TO HEADER 

return;

}

if(isset($_GET["thumb"]))

{

if(empty($_GET["thumb"]))

{

//RETURN TO HEADER 

return;

}

else

{



$thumb = $_GET["thumb"];

$mypath = $root_path.'/'.$uid.'/'.$path.'/'.$thumb.'/'.$getfile.'';

if (file_exists($mypath))

{

readfile($mypath);

}

else

{

//RETURN TO HEADER 

}

}



}

else

{



$mypath = $root_path.'/'.$uid.'/'.$path.'/'.$getfile.'';

    

if (file_exists($mypath))

{

readfile($mypath);

}

else

{

//RETURN TO HEADER 

}



}















?>

 

Edited February 12, 2014 by Mancent