Question

My site interacts with the PayPal Digital Goods API which on completion redirects back to my PHP script which then allows the download.

I would like to know the best way to protect the directory containing digital goods which is outside of the web root.

At the moment I am protecting the directories by removing all permissions. When the download script is called the permissions of the directory containing the digital good are changed to allow the download then removed again. Below is a shorthand version of what’s happening in the script.

chmod('/digital/goods/directory/file', 0777);
readfile(file);
chmod('/digital/goods/directory/file', 0000);

I’am sure this cant be the right way to do this. Could you use htaccess without the user having to enter the user and password? Any pointers would be appreciated.

Answer 1

Ensure the files aren’t being served directly. In Apache, you would keep them out of the DocumentRoot.

Then, the permissions shouldn’t matter, since there is simply no URL that maps to them.