Question

I need to provide an unshared upload using php on apache on linux.

I can handle file uploads just fine, and move them to the desired folder. What I wanted to ask was how can I make it so that even if someone knew that folder and the filename, they could never download the file through a browser.

In other words, I need apache to be able to move the file to the folder, but to be unable to serve files from that folder.

Can php write to files outside the docroot? Is there something I can do with htaccess? Or even just linux directory permissions?

I was about to create a blank index.html and give the files a name containing a long random string (to make them unguessable) but decided there must be a better way.

Thanks all.

Answer 1

Upload your files outside the Apache DocumentRoot.

I.E.

DocumentRoot /var/www/public/

(where your php files are)

And upload in /var/www/uploads/