0

I'm thinking about a way to store and serve some files. Basically the files will be user uploaded doc files (via web form) - they are not overly important but might contain some personal info about the user who uploads them.

Only certain users and the uploader should be able to view these files.

They are currently stored in /files/ and the filenames are md5 hashes of the filename and some random 8byte string which should make them very hard to guess. I have a blank index.php in there to stop any directory viewing.

I was thinking of adding another layer of security which would default all these files to be unreadable and then send users who want to download them through a script which checks the user downloading it is valid, does a chmod on the file to make it readable, and then chmod back to being private later.

What are people's thoughts on the security of this? Does anybody have abetter idea of how to do this? Would the directory in the be susceptible to file scraping?

el_nariz
  • 259
  • 4
  • 15
  • 1
    Store the files outside the web directory entirely, and use something like [this script](http://www.finalwebsites.com/forums/topic/php-file-download) for downloading. That way, you can check if the user is logged in, and not need to fiddle with permissions to protect the files. – Joachim Isaksson Dec 18 '13 at 10:02
  • Do not show the complete file listing at all! Only allow access through an authentication layer, hand out only a list of files a user actually has access to and block all other requests. Store the files in a location which is _not_ accessible by direct requests. Only deliver files through the authentication layer. – arkascha Dec 18 '13 at 10:02
  • As far as file uploading goes. I made one a while ago https://github.com/simon-eQ/ImageUploader It is as secure as any fileupload can get. It may only need some code cleaning. – samayo Dec 18 '13 at 10:03
  • instead of doing chmod and using the file link to download you can use [readfile](http://in3.php.net/readfile). this takes out the guessing part out of scene. and don't have to worry about not setting the permission back. just make the entire folder where the files are stored not accessible by browser. – bansi Dec 18 '13 at 10:09
  • Thanks Guys, don't know why I didn't just think of storing them outside of the web directory - makes much more sense! Thanks! – el_nariz Dec 18 '13 at 10:10

1 Answers1

0

When guest enter file-link to download your private file , you should use mod_rewrite to redirect to php file ( code for authentication in here )

Thong Lee
  • 41
  • 3