Home/ Questions/Q 965081
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-16T01:56:09+00:00

I have an application that let users to upload files to server. All files

  • 0

I have an application that let users to upload files to server. All files are stored in one directory called Uploaded Files (which has Thumbnails directory inside).

What are the most common ways for preventing users to see these files ? I mean I don’t want users to see the files by typing URL like /path_to_website/Uploaded Files/1.png.

On the other side, authorized users should be able to see the files by getting a page that contains paths to files, like: ../Uploaded Files/1.JPG, ../Uploaded Files/2.png, ../Uploaded Files/3.gif. These users should be able to see only the files that appear on the page they got, i.e. I want to prevent them to see ../Uploaded Files/823.gif for example.

Please help to understand how this kind of things are done these days.

Thanks a lot !!

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    You can move the images into a folder out side the public directory and then stream them in via PHP to the users who are allowed to view them. By using the method detailed in the PHP header() manual for a very basic output (see Example 1).

    Otherwise you could put a .htaccess file in the folder containing:

    deny from all

    if you are running Apache, but you still need to stream it out through PHP.

    • 0