CODEWITHSUNDEEP
phpsecuritycodeigniter
Faryal Khan
Faryal Khan

Reputation: 869

Prevent user from coying file from website

I have some images and pdf file on my server which I use in my website The path to the images is

<img src ='/import/folder/image.jpg'>

Every image is associated with a pdf which resides with the image like the pdf for the above image will be at /import/folder/pdffile.pdf

the image source is visible to users

when some one view the source of page and copy the image source and paste in url after my base url

let suppose my base url is localhost.com if some one manually write localhost.com/import/folder/image.jpg he can access my whole images and pdf file even my whole file system

How can I prevent users from accessing my file structure ?

I am using php and codeigniter

Thanks in advance

Upvotes: 0

Views: 695

Answers (5)

Ren&#233; H&#246;hle
Ren&#233; H&#246;hle

Reputation: 27295

In this case its difficult to prevent that people download your images. When you use "/import/folder/" its a public folder on your webspace. You can save the path with .htaccess.

For Your PDF files you could deliver the PDF File over php.

<a href="getpdf.php?file=123.pdf">Get PDF 123</a>

In the script you can check if the user has the rights to download the file and wheather the file exists and return the PDF as application/pdf output.

header('Expires: Thu, 19 Nov 1981 08:52:00 GMT'); 
header('Cache-Control: must-revalidate, post-check=0, pre-check=0'); 
header('Pragma: no-cache'); 
header("Content-Type : application/pdf"); 
header("Content-Disposition: attachment; filename=".$filename.".pdf");

Then the people can download the file. But in this case you have to save PDF is theirs.

Edit:

Then put the .htaccess to the folder with

deny from all

<FilesMatch "\.pdf$">
    Order Allow,Deny
    Deny from all
</FilesMatch>

Upvotes: 1

Michal
Michal

Reputation: 3368

Depending on what your server capacity is and how big the files are, you could do the following:

  1. Stream both - the JPEG and the PDF file using what I call a "data-proxy" - a PHP script that reads the file content and streams it back to the browser, like (be careful to set the correct content type) (similar to what Stony proposed, although he left the readfile() part out):

    $file_path = $download;
header('Content-Description: File Transfer');
header('Content-Type: audio/mpeg');
header('Content-Disposition: attachment; filename="'.$_GET['file'].'"');
header("Content-Transfer-Encoding: binary");
header('Expires: 0');
header('Cache-Control: must-revalidate, post-check=0, pre-check=0');
header('Pragma: public');
header('Content-Length: ' . filesize($file_path));
ob_clean();
ob_end_flush();
readfile($file_path);
exit;

  2. Obfuscate the files. Make the filenames something like md5($filename.$salt) and remove the file extension. If you have the files in different folders (like /images and /pdf)) you don't need the extension for the streaming as you only read the content of the file. You could also place them outside the accessible web space (I think you need open_base_dir for this), thus no one except you would be able to access them. Use .htacces to further restrict access to the files as described in other answers.

  3. Employ a session for the above script so only logged in users get the streaming.

  4. Encrypt the files - you could encrypt the whole content of the files. So even if someone would get the file content, it would be encrypted. You can decrypt them just before streaming. If you employ a secure encryption algorithm this should be quite secure. However, this depends to the file sizes and the server capacity to a large extent as I suppose encrypting the whole file could be a problem if it's a large one.

  5. Make the PDFs password protected. Although not really secure as it can be easily removed, it makes basic users run against the wall... You can do that on the server side too with an automated script.

Upvotes: 1

Bram
Bram

Reputation: 1112

Put Options -Indexes in a .htaccess file you place in localhost.com/import/folder/ (or higher up the document tree). This will disable access to the file structure in localhost.com/import/folder

Preventing users from accessing your files is something different, like Stony suggested, you can stream the files using php.

Edit: I saw your comment about people "guessing" the url of an image. You could store all the images with an encrypted filename. Something like an md5 hash of the filename and the uploadtime combined. Then store those encrypted names in a database table...

Upvotes: 0

Your Common Sense
Your Common Sense

Reputation: 157839

he can access my whole images and pdf file

this is how the web works.

even my whole file system

not whole of course but only files that you put into public access folder

How can I prevent users from accessing my file structure

they don't have an access to your file structure but to the public folder only.
you can't prevent users from accessing public folder because your site will stop working.

you have to ask more certain question, why and which files you want to secure.

Upvotes: 2

Broncha
Broncha

Reputation: 3794

You can use this in the .htaccess

RewriteEngine On
RewriteCond %{HTTP_REFERER} !^http://your_site_url/.*$ [NC]
RewriteRule \.(jpg)$ - [F]

This will prevent the direct access of the images, but the images will be vissible in your website

Upvotes: -1

Related Questions