Question

I think this question should be something easy but after searching all over the web I couldnt find an answer, so I decided to ask here.

I have a file uploader in my website that works with php. The folder where files are being uploaded has 777 chmod. I also have a php script to list the files in that folder. What I need is to allow php to upload and browse files on that folder, but dont allow people to do it. The only solution I imagined is to chown that folder to another user different than default, so I could later chmod in filezilla and allow only owner to do it, so people will see the files trough the output of the php script, but not if they navigate to that folder.

Im using Debian, apache2. Id like to know what could I do.

To make it shor, my aim: allow php to upload, read, write and execute files in that folder, but not clients unless they use my php script.

Thanks in advance

Answer 1

Put all the files you’re talking about in their own directory. Add a .htaccess file to that directory. The contents of the .htaccess should be deny from all.

This will prevent any user from manually accessing the files as access will be blocked off. Your PHP script can still browse the contents of the file and serve it up as an attachment with the correct content type.

For more info on how to serve a file for download in PHP, read this: https://serverfault.com/questions/316814/php-serve-a-file-for-download-without-providing-the-direct-link