Home/ Questions/Q 184585
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-11T15:19:05+00:00

I’ve inherited an application with a glaring security hole. It has session-based security, but

  • 0

I’ve inherited an application with a glaring security hole.

It has session-based security, but file uploads (which are user specific) are not secured in any way and they are stored in the public file tree.

Filenames do not follow any convention as such, making them hard to guess, but the data is sensitive and thus I need to implement a security measure to prevent unauthorized file access.

Moving the location of the files is not really an option, so I’m looking at a htaccess solution to forward requests to a php handler script.

Does anyone have experience in implementing this type of thing or any good alternative solutions? Specific examples of .htaccess syntax greatly appreciated, as I’m struggling in this area.

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Don’t really understand why moving them isn’t an option, since pushing requests for them to a handler means it no longer matters where they’re stored. But you’re the man on the scene.

    .htaccess looks like:

    RewriteEngine on RewriteRule path/to/where/these/files/live/(.*) /handlerscript.php/$1

    Then you pick up the remaining file path and name from $_SERVER['PATH_INFO'].

    • 0