Question

I have some images and pdf file on my server which I use in my website
The path to the images is

<img src ='/import/folder/image.jpg'>

Every image is associated with a pdf which resides with the image like the pdf for the above image will be at /import/folder/pdffile.pdf

the image source is visible to users

when some one view the source of page and copy the image source and paste in url after my base url

let suppose my base url is localhost.com
if some one manually write localhost.com/import/folder/image.jpg he can access my whole images and pdf file even my whole file system

How can I prevent users from accessing my file structure ?

I am using php and codeigniter

Thanks in advance

Answer 1

In this case its difficult to prevent that people download your images. When you use “/import/folder/” its a public folder on your webspace. You can save the path with .htaccess.

For Your PDF files you could deliver the PDF File over php.

<a href="getpdf.php?file=123.pdf">Get PDF 123</a>

In the script you can check if the user has the rights to download the file and wheather the file exists and return the PDF as application/pdf output.

header('Expires: Thu, 19 Nov 1981 08:52:00 GMT'); 
header('Cache-Control: must-revalidate, post-check=0, pre-check=0'); 
header('Pragma: no-cache'); 
header("Content-Type : application/pdf"); 
header("Content-Disposition: attachment; filename=".$filename.".pdf"); 

Then the people can download the file. But in this case you have to save PDF is theirs.

Edit:

Then put the .htaccess to the folder with

deny from all

<FilesMatch "\.pdf$">
    Order Allow,Deny
    Deny from all
</FilesMatch>