Protecting folders

Collapse
This topic is closed.
X
X
Collapse
 
  • Page of 1
  • Time
  • Show
Clear All
new posts
Previous template Next
  • StevePBurgess@gmail.com
    #1

    Protecting folders

    I have a data driven website. Part of the website is a downloads
    section - all the downloads are help in a folder called "downloads" .
    When a general user (i.e. one that doesn't have a log in) uses the site
    and access the downloads page they are given a list of general
    downloads. When a member who has logged in uses the site, the same page
    presents the general downloads and the member only downloads.

    This all works fine.

    A slight hole in this security, however, is that the downloads folder
    is not protected. I have moved the member downloads into a subfolder
    within downloads. How can I protect this so that only people who are
    logged in can access it - so that general users cannot accidentally
    browse it or make a direct link to the documents within it?

    Hope this makes sense.

    Any ideas?

    Tags: None
    • frizzle
      #2
      Re: Protecting folders

      Not sure, but maybe you should htaccess the subfolder, and then write a
      script that checks wether the user is logged in or not, and if he is,
      it passes the file on to the browser.

      Not sure if it's possible, but this is where i'd start looking..

        Comment

        • friglob
          #3
          Re: Protecting folders

          upload index.php to members dir


          index.php :

          check login
          if user not logined > redirect to downloads
          else > print members dir content


          That is partial solution.

          <StevePBurgess@ gmail.com> wrote in message
          news:1111680901 .441654.276220@ l41g2000cwc.goo glegroups.com.. .[color=blue]
          > I have a data driven website. Part of the website is a downloads
          > section - all the downloads are help in a folder called "downloads" .
          > When a general user (i.e. one that doesn't have a log in) uses the site
          > and access the downloads page they are given a list of general
          > downloads. When a member who has logged in uses the site, the same page
          > presents the general downloads and the member only downloads.
          >
          > This all works fine.
          >
          > A slight hole in this security, however, is that the downloads folder
          > is not protected. I have moved the member downloads into a subfolder
          > within downloads. How can I protect this so that only people who are
          > logged in can access it - so that general users cannot accidentally
          > browse it or make a direct link to the documents within it?
          >
          > Hope this makes sense.
          >
          > Any ideas?
          >[/color]


            Comment

            • StevePBurgess@gmail.com
              #4
              Re: Protecting folders

              Hi - thanks. I thought about that but it turns out that the webserver
              doesn't allow users to browser the directory structure anyway. So I
              guess the biggest problem is people guessing the names of the downloads
              and linking to them directly. I guess this is unlikely to happen... :oS

                Comment

                Previous template Next
                Working...