NYCPHP Meetup

[Chris Snyder]

One way to do it is to store the locked-down content outside of the 
document root, and then use a php script as a gatekeeper-- if a user 
requests a file, the script checks authentication, sends an appropriate 
Content-type header, and then outputs the file.

If you decide to go that route, you need to figure out how to call the 
gatekeeper script:

Easy way:
http://example.com/gatekeeper.php?file=realtive/path/to/file.pdf 

Harder, using Apache location directive (see below):
http://example.com/gatekeeper/path/to/file.pdf

For the second example to work, you'd need the following in httpd.conf 
(Location directives aren't allowed in htaccess):
<Location /gatekeeper>
    ForceType application/x-httpd-php
</Location>

Warning-- make sure your gatekeeper script doesn't allow the user to 
access a file outside of the content directory. Always prepend a content 
root and reject any paths with .. in them, otherwise you may end up with 
someone asking for ../../../etc/passwd

    chris.

Phil Powell wrote:

> This challenge is beyond me, as it seems to be the case.
>  
> I am having to set up a user-authentication script that is basic 
> logon/registration process.  mySQL db captures username, password, and 
> other important fields such as their payment category and isAdmin (if 
> they are an admin on the site).  Once stored they will be able to 
> login once payment category is '4' (which means 'PAID'). 
>  
> Upon being able to login, one of the features any user, admin or not, 
> can do is to view restricted files in the /web/contents folder.  They 
> can view the list or click onto a link and view the file itself 
> (assuming it's a url-friendly file like .txt or .doc or .pdf or 
> something).
>  
> Here's where I am totally stuck.
>  
> The /web/contents folder must be locked down so that the outside world 
> cannot view it; only authenticated users must view it.  Problem is, by 
> doing that I force a double-login since that would involve using 
> .htaccess on the folder.  (Note, I was told mySQL has a means of 
> interfacing with .htacesss, however, that too would fail because the 
> requirements for login involve username, password, isAdmin and 
> payment_category all being set to certain values).
>  
> I thought of locking down the folder to 700 and each script uploaded 
> to 600 (using TCL CGI instead of PHP to do the actual uploading), 
> however, how would I be able to allow for users to VIEW non-ASCII 
> files (like .doc or .pdf)?
>  
> Has anyone faced anything like that, if so, please let me know.
>  
> Thanx
> Phil
>
>------------------------------------------------------------------------
>
>_______________________________________________
>talk mailing list
>talk at lists.nyphp.org
>http://lists.nyphp.org/mailman/listinfo/talk
>  
>