3

So I have this php web app, and one of my folder contains some files that can be downloaded.

I have a download script that modifies the headers, in order to always offer a download link. (instead of showing a picture for example, when you click on a link, a download box pops out)

Right now, if you enter a url like: http://www.mywebsite.com/content/ You get the listing of all the downloadable files, and of course, you can just download them all, without going through the website interface.

Personally, I don't think it's a problem, since I often use downthemall or other downloading tool, and this type of access is a great time saver....

But of course my company does not think so :-p They want people to use the interface in order to view the Ads...

Would they be a way, maybe with a protected .htaccess, to leave the folder access to my download script, but deny access to the users...?

I hope I am making sense and you know what I mean :)

All help/remarks appreciated!

Pierre
  • 4,976
  • 12
  • 54
  • 76
  • First of all you have to understand that **not a single apache directive** can affect script access. So, there is not much sense in your question. Any directive you could use would be fine. – Your Common Sense Apr 19 '10 at 14:33

4 Answers4

6

Move the folder out of the webserver's root directory so that apache will not server files from that directory at all. You can still include files from the folder if it is readable by the apache/http user, but your site users won't be able to access it from any url.

Scott Saunders
  • 29,840
  • 14
  • 57
  • 64
  • I tried that before, but when using a download script that modifies the http headers, it did not work... My folder permissions are correct but... – Pierre Apr 19 '10 at 14:10
  • Hey @Piero, what the heck do you mean under "script that modifies the http headers"? And have you ever heard a word "debugging"? – Your Common Sense Apr 19 '10 at 14:20
  • It works, I do it all the time. Your script can be fixed. (@Col: He means the script through which users are supposed to download the file. It adds headers to force a download.) – Scott Saunders Apr 19 '10 at 14:23
4

You can make a .htaccess file and enter Options -Indexes this will disable listing of the files in the directory.

If you also need the traffic to originate from your site you will need to make a file say... index.php with code that checks $_SERVER['HTTP_REFERER'] to see if the traffic originates from your site.

EDIT

Oh I forgot you can actually fix it all in the .htaccess:

Options -Indexes
RewriteEngine On
RewriteCond %{HTTP_REFERER} !^http://your-host.com/.*$ [NC]
RewriteRule ^.* /403-page [L,R]

This will do all the work of the script I suggested, so you won't need it anymore.

Klaas S.
  • 1,572
  • 2
  • 10
  • 11
  • That sounds good, I will try it and let you know if it did what I wanted! – Pierre Apr 19 '10 at 14:11
  • referer check will always repel some fair users – Your Common Sense Apr 19 '10 at 14:21
  • This will not prevent people from downloading the files directly, just listing the contents of the directory. – Scott Saunders Apr 19 '10 at 14:24
  • @Col. Shrapnel: Absolutely, I would never choose that solution either, but it appears Piero's bosses/manager/... want just that though. – Klaas S. Apr 19 '10 at 14:24
  • @Scott Saunders: that's why I hinted at the index.php that checks the $_SERVER['HTTP_REFERER'] to allow or deny access. – Klaas S. Apr 19 '10 at 14:25
  • @Scott how this referer checking in the **script** will prevent **direct** (i.e. avoiding script) file access? – Your Common Sense Apr 19 '10 at 14:31
  • @Col. Shrapnel: I think you're getting me mixed up with ksangers. I agree with you (Col.) completely, the script cannot prevent direct access. – Scott Saunders Apr 19 '10 at 14:54
  • @Scott Saunders: Actually the script can block it. You need to enable `RewriteEngine` and add `RewriteRule ^.*$ index.php` to the .htaccess so all traffic goes to the index.php that handles what goes through and what does not. – Klaas S. Apr 19 '10 at 15:02
  • Ok guys, thanks for your help! @Col & Scott, actually I would like to get the download script working from another directory, because it is quite useful... but in this case the listing block was the only thing I really needed. These files are free to download so it's not a problem, my boss wanted to make sure they couldn't just list it and get it all without viewing the ads... Thanks! – Pierre Apr 20 '10 at 06:32
1

Yes, this is correct. .access files block access to the users, but has no influence on local serverscripts.

Ikke
  • 99,403
  • 23
  • 97
  • 120
0
Deny from all

in the .htaccess or move the files above document root

Your Common Sense
  • 156,878
  • 40
  • 214
  • 345